A veteran chief audit executive shares his game-plan for adding value and meeting stakeholder needs
As the FIFA football World Cup in Rio de Janeiro Brazil approaches, it’s timely to consider how well your internal audit team is positioned for success. Does your team have the skills, conditioning and coaching to succeed at the highest level in the boardroom? Consider a ‘game-plan’ that will enhance your internal audit team’s goal-scoring potential by ensuring that your team:
- Is in tune with what’s really going on in the business, and what’s coming over the horizon.
- Discovers things that the audit committee and senior management didn’t know.
- Consistently delivers professional excellence at the levels demanded by high performing audit committees.
An entity needed to rebuild and re-energize its internal audit team from the ground up. The team was struggling. The results showed that they were well behind the exemplars … the Audit Committee’s average satisfaction rating sat at a lowly 55%. The champions were scoring around 90%.
A new ‘captain-coach’ was appointed in the form of the chief audit executive. He articulated the vision, and then established strategies to sharpen the team’s focus and direction, enhance its contribution, and satisfy the needs of the audit committee and other stakeholders.
After three years, the audit team was scoring sensational goals … they were providing fresh and meaningful insights. The function was widely regarded as high-performing and was seen as mature. Its overall approach, processes and reporting were representative of world class. And the Audit Committee’s average satisfaction rating had risen to 95%. Worthy World Cup contenders! This article captures the essence of the transformation, and provides tips that you can champion irrespective of your position on the team.
TIP 1 Be attuned – know the business and what needs audit focus
Given the symbiotic relationship between the audit committee and internal auditors, it is essential that internal auditors understand the changing needs of their stakeholders. Internal auditors can shape their own plans to be in tune with the business by drawing on:
- The vision, values, objectives and priorities of the entity’s strategic planning suite.
- The documented enterprise risks (both current and emerging) and legislative obligations.
- Information on the entity’s governance arrangements.
“The head of internal audit should live and breathe the business – not live and breathe auditing.” Audit Committee Chair in Better Practice Guide issued by Auditor General of Australia
TIP 1 – TOP TEN PRACTICES
- Understand the environment in which the entity is operating, including external factors and competition.
- Know the entity’s strategic direction – what’s happening now, what’s likely to happen, and what are the emerging risks.
- Establish a constructive partnering arrangement with the audit committee, and build a high level of mutual trust.
- Keep abreast of audit committee expectations through regular discussions (mainly chief audit executive and committee chair). Whilst formal reporting and presentations at audit committee meetings are vital, the informal discussions with members are often even more valuable.
- Establish a comprehensive and structured stakeholder relationship program to know what is coming ‘across the horizon’.
- Develop a risk-based and strategically focused forward work program that ensures that the internal auditors get into the right areas at the right time.
- Establish high-level themes within the forward work program to facilitate future reporting on trends and systemic issues, rather than just focusing on the results of individual audits.
- Assist the entity to value independent scrutiny and embed early in major system developments, construction and similar projects, and business re-engineering projects.
- Strive to always deliver auditor excellence in what, when and how they do their work.
- Get into the business to see what really goes on.
TIP 2 Be balanced – apply a balanced approach to provide valued insights
Audit committees need skilled and competent internal auditors to help them to discover things they didn’t know. For instance, internal auditors with a solid ‘game-plan’ in the form of a risk based audit plan are well-positioned to:
- Identify emerging issues and risks.
- Make the connections, so the audit committee can understand the trends, systemic issues and reporting themes arising from internal audits.
- Provide insights on the culture of the entity, together with an opinion of the efficiency, effectiveness and ethics of its operations.
- Deliver creative reports, where the ‘picture is painted’ through photographs, pictures, illustrations, graphs, or video rather than many pages of written commentary.
- Provide assurance that management is embracing audit recommendations and achieving sustained improvements to the associated governance, risk and control arrangements.
“I like the way that internal audit asks the right strategic questions and reports on trends and systemic issues rather than just focusing on the results of an audit.” Audit Committee Chair
TIP 2 – TOP TEN PRACTICES
- Achieve a balanced coverage in the forward work program, blending traditional areas of financial audit coverage with efficiency, effectiveness and ethics elements; incorporate deep dives and spot checks.
- Position internal audit so that it is looked upon as a source of advice and provider of quality value-add services.
- Expand involvement in activities that may be beyond traditional coverage, working with business leaders on areas like business continuity, risk management, and compliance until they reach a reasonable level of maturity.
- Access industry and economic information independently to reduce reliance on management’s perspective of organizational and sector risks.
- Tap into organizational health, and share impressions and insights on emerging issues with audit committee members.
- Showcase the contribution to the business of internal audit activities in a comprehensive annual report to the audit committee and key executives.
- Deliver crisp reports that really matter, and pitch them in a manner that aligns to the critical business drivers. Reports must be short, sharp and succinct.
- Enhance high-level reporting to the audit committee by summarizing and reporting the outcomes of all audits under agreed themes.
- Write ‘without fear or favor’, and ‘tell it as it is’ but write in a balanced style ‘for the world to see’ recognizing the concepts of freedom of information.
- Undertake effective monitoring and reporting of the status of audit recommendations.
TIP 3 Be credible – regarded as credible in the eyes of stakeholders
Professional excellence reflects that the internal auditing leaders:
- Maintain a risk-based auditing methodology that is efficient, effective, and contemporary, and leads to the timely discovery of issues and opportunities.
- Deliver value to the business and help management to achieve business objectives through governance, risk and control insights.
- Have a contemporary auditing mandate coupled with an independence of mind.
- Understand and consistently apply professional auditing standards.
- Establish a well-balanced multi-disciplinary team of auditors with relevant industry experience.
- Maintain a credible and capable auditing team that delivers the requirements of the internal audit charter and the forward work program.
- Establish a mandatory requirement for auditors to maintain continued professional development to stay relevant.
- Provide strong encouragement for auditors to pursue CIA and other auditing-specific certifications
- Utilize professional outreach strategies to maintain connections with audit leaders and practitioners from outside their entity to avoid becoming too inward-looking.
“The credibility of an internal audit function is underpinned by three key pillars – professional excellence, quality of service, and professional outreach.” Audit Committee Chair
TIP 3 – TOP TEN PRACTICES
- Review the internal audit charter each year so it remains relevant, consistent with better practice models, and complements the audit committee charter.
- Maintain effective structural reporting lines, with functional reporting to the highest level, such as the audit committee and / or chief executive.
- Showcase the role, standing, independence and contribution of internal audit in the entity’s published annual report.
- Pursue positive trends in management’s perception of internal audit, through key measures such as the value add and usefulness of audit recommendations.
- Tailor a balanced scorecard reporting approach that suits the nature of the entity.
- Comply with professional auditing standards, and deliver an overarching quality assurance assertion to the audit committee each year.
- Provide to the audit committee a periodic benchmarking report outlining the overall auditing capability (experience, average auditing years, qualifications, and professional certifications).
- Establish recruitment and retention strategies that deliver a well-balanced auditing team with a professional culture. Complement the strategies with a professional development plan for internal audit.
- Maintain internal auditor communication strategies to ensure consistency in dealings with stakeholders.
- Maintain honesty and fairness in all reporting and relationships, at all times and at all levels; especially, handle sensitive matters in an impartial way.
BRUCE TURNER, CGAP, CRMA, CISA, CFE, CFIIA (AUST), FIPA, FFIN, FAIM, MAICD is a former CAE and is now an audit committee chairman in Australia.