It’s February and the holidays are behind us, winter is in full swing, and many of our New Year’s resolutions to get to the gym more often or do a better job saving money have fallen by the wayside.
It’s not too late, however, to set some goals for internal audit to reach in 2020. As internal audit experts tell us, departments that continue with business-as-usual practices will render themselves obsolete. It’s important to constantly up the ante and keep improving the internal audit team with an eye toward adding more value to the organization.
With this in mind, here are five focus areas for 2020 that can help supercharge the internal audit function and help take it to the next level:
1. Explore new technologies
There is a reason this first resolution is to “explore new technologies,” and not necessarily to adopt them. That’s because while newfangled advances, such as robotic process automation (RPA) and artificial intelligence, hold lots of promise, they are not silver bullets for improving internal audit processes. In other words, proceed with caution.
Still, disruptive technologies have had a profound impact on nearly all businesses. That means internal audit must play a role in the organization’s response to such transformation, including understanding these new technologies. According to the 2019 North American Pulse of Internal Audit study conducted by the Institute of Internal Auditors (IIA), cybersecurity and IT issues have grown to represent nearly 20 percent of the average audit plan. That means internal audit must have a greater technology capability to execute such audits and provide real value in a digital age.
At the same time that organizations are becoming increasingly digitized and tech heavy, internal audit is being asked to do more with less. That means leveraging technology inside the internal audit department to automate some functions and operate more efficiently. To fulfill its mandate, internal audit must:
- Reduce effort devoted to routine activities, such as repetitive control testing and monitoring;
- Standardize and automate high value-added activities, such as fraud detection and continuous auditing; and
- Build and deploy advanced solutions such as predictive analytics and artificial intelligence.
All of these trends and forces require internal audit to be more tech enabled. While adding a few more tech whizzes to the staff can help, it’s really a change in mindset that is needed to become a tech-savvy, innovative modern internal audit function.
2. Become more customer service oriented
We all know the difficulties that internal audit teams can have in convincing those throughout the organization that internal audit isn’t the policing department of the company trying to play “gotcha.” Treating audit clients as customers and working to have more of a customer-service orientation toward them can go a long way in changing those negative views of internal audit. Start by making an across-the-board change to calling auditees “audit customers.” This change alone can alter the mindset of internal audit to become more customer focused.
Another way to become more customer focused is to approach each audit as more of a collaboration between internal audit and the process or unit that is being auditing. Seek input from audit clients on the goals and scope of the audit, listen to their concerns, and try to make things as transparent as possible. Try to minimize disruption to audit customers with good planning. Don’t ask for documents you already have or for data you can pull yourself from the company’s ERP platform.
Finally, be sure to conduct a customer service survey at the end of each audit to find ways to make the process run smoother or to address audit customer concerns and issues.
3. Deepen your knowledge of the business
Near the top of just about any list of important attributes of internal auditors sits “knowledge of the business.” Indeed, the best internal auditors never stop working to learn the ins and outs of the business.
One strategy to boost knowledge, particularly the crucial business knowledge that may be lacking in inexperienced auditors, is to bring in professionals from around the business—often called “lunch and learns”—to discuss what they do and how their particular part of the business functions. These events usually include opportunities to ask questions and gain a better understanding of particular processes that may be the subject of upcoming audits.
Forward-thinking CAEs also encourage their team members to foster relationships with process owners and business managers. They may move individuals through assignments out in the business or hold events that encourage relationship building, which can help auditors improve their knowledge of the business.
4. Conduct a few unconventional audits
Every annual audit plan will contain audits that are required by regulators, important to addressing cybersecurity risks, or that address the usual suspects of fraud and abuse, such as travel and expense reporting or third-party contracts. While some companies are working to automate these common audits, advance them to continuous monitoring, or leverage past audits, in some cases there is no way around them. And then there are the audits that arise from the all-important risk assessment. Excelling at these audits is critical to the success of the audit function.
Most internal audit shops stop there. Smart internal audit shops leave room on their audit plans to address emerging risks or areas of concern for the board that can arise throughout the year. It’s wise too, however, to include a few unconventional audits in the audit plan. Take a look at something the audit team has never assessed before that may even be a little experimental or where risks may be hiding. One example is looking at the use of open source software in the organization, which can be fraught with hidden risks. How about the potential for copyright abuse? Is the company wasteful in its use of legal assistance? Finding waste and abuse in an area that’s not often considered can be a big win for internal audit and highlight the function’s ability to add value to the organization.
5. Embrace the idea of constant change
We all know that internal audit must do a better job at innovation (see focus area #1), and it must embracing change. But that’s easier said than done. Most audit shops are stretched thin. Budgets are tight and even where there are resources to hire more people, talented auditors are hard to find to fill open jobs. Most annual audit plans leave little wiggle room to tackle other projects, and chief audit executives have very little time and resources to reinvent the department or to overhaul the way it works. The Catch 22 is that continuing on the same old path is a recipe for disaster. The internal audit function is changing too fast to ignore innovation and change.
Chief audit executives most adopt a mindset of innovation. They should constantly be on the lookout for ways of working smarter and better, and empower internal audit staffers to do the same. If resources are an issue, make the case to the board and senior management that internal audit also needs investment to advance. Conduct pilot projects using data analytics and RPA, and set aside time for additional training and discussion. Risks are changing rapidly, so too must internal audit to stay ahead of them.
So while your New Years workout routine or new diet might already be a thing of the past, setting some new goals and focus areas for internal audit in 2020 is critical for the success of the function. And working toward improving internal audit’s processes is important whether you are a chief audit executive or the newest hire on the team. Working at the five focus areas above could play a part in putting your audit function on the right path for the year. 
Joseph McCafferty is editor & Publisher of Internal Audit 360°