It’s easy for internal audit to get stuck in a rut.
We approach the year with plans to revise last year’s internal audit plan, but in the end, we don’t change that much. We move to the comfort zone and put the audits we know how to do and the ones that seem important on the audit plan. It’s very possible, particularly for teams that have been in place for a long time, to cling to a “that’s the way we have always done it” mentality.
Meanwhile, the business landscape is evolving rapidly. What was important last year has changed. It is crucial for any auditing process to have a long-term impact and, at the same time, offer some actionable plans for the short term. With the constantly changing times—due to socio-economic factors, the pandemic, supply chain disruptions, changing employee preferences and behaviors, and other relevant trends that affect the company’s work patterns—internal audit needs to be as strategic and risk-based as ever.
Sure, a solid risk assessment will help focus internal audit on what matters. But that’s not all it needs to keep from falling back on old habits. Internal audit team members also need a comprehensive understanding of the inner workings of the organization, a full grasp of the strategic plan, and, dare I say it, vision.
An internal auditor is not someone who is hired, provides his or her services, and leaves. Rather, the internal auditor is a person who helps guide the company by taking into consideration its long-term vision. The best internal audits are forward looking, where the auditors consider the vision of the company to analyze the way forward and provide insight on the roadmap for the organization. In the process, the internal auditors also identify the possible risks and long-term benefits of such decision making.
The Board of Directors directly collaborates with the qualified internal auditor to address the gaps in the management system. Good audits inform the strategic plan or set of plans, and the good internal auditor stays with it in the long run to add value. This audit performance ensures that the results derived are targeted to spot the pain points, inform decision making, and provide immense value to the company.
I mentioned that a good risk assessment is the best starting point for focusing on what matters. But the following are some other focus areas that can lead internal audit down the path to auditing what matters and moving on from the mundane. Let us discuss strategic planning and auditing through the following points:
1) Know the Past Performance of the Company
It’s often said that to know where you are going, you must realize where you have been. Internal audit must deeply investigate how well the organization is taking advantage of its core competencies, availability of resources, and existing third-party relationships to achieve its objectives. It can be measured against the goals of the company, checking on the competitor’s and the company’s past performances. Looking at the past performance, an auditor can know the historical data that helps predict the future performance and profits of the company. This investigation also benefits the company to set a budget for future spending, and determine the true value of assets. The audit highlights any discrepancies in the accounting or management processes of the company and may expose fraud.
2) Current Business Strategy and Day-to-Day Operations
A specialty of the strategic company audit is, if done the right way, it can excavate new opportunities and hidden challenges. A deep dive deep into your company’s day-to-day processes to analyze things is vital. Constant check-ins of your company’s work culture, dynamics, synergy levels, operation methodologies, hiring and training processes, sales and marketing processes, systems used, and lastly, the cost of customer acquisition can yield big benefits. Taking into consideration all of these things, an auditor will minutely access the potential areas of improvement.
3) Core Competencies vs. Core Complexities
The core complexities are factors that can hinder the growth of a company. Internal audit must assess the business’s core competencies to avoid such situations. The complexity of any business lies in the market position and its power in the market.
Therefore, senior management’s focus should be on the things that matter in terms of competitive advantage to get the edge over competitors. The internal auditor must be a critical thinker to provide insight on those core competencies and core complexities.
4) Know the Vision Statement
The vision of the company is considered the starting point. A goal of internal audit should be to plan strategically and help inform the roadmap to depart from point A and reach the destination at point B. The core purpose of strategic planning is to align the vision with a mission that leads the company’s inner core values.
The vision will be a guide for the strategic planning to reconsider things that are not working in favor of reaching the mission. In case any such statement doesn’t exist, then time to brainstorm the idea should be allocated.
5) Emerging Risks and Risk Mitigation
Risks are inevitable in any kind of business. However, being prepared is the only way to avoid losses and mitigate these risks at a minimal cost. There are various risks involved in the business process that can be evaluated by strategic auditing. Analysis of financial statements, day-to-day processes, and work ethics can provide an efficient way out. The level of risks is based on the complexity of the business, type of transactions, and other factors. However, the auditor must first determine the auditing risks as well. The control risk, detection risk, and inherent risk are a few ideas that an auditor might consider.
6) Company Portfolio
Considered to be the company’s resume, a portfolio illustrates all the company’s accomplishments and strengths, thus serving as a potential tool for attracting various projects. Investments, risks, and returns of the business are a part of the portfolio that determine whether these are underperforming or strong. It is the duty of an internal auditor to evaluate the risks and returns on investments of the business and realize whether they’re strong or underperforming. The portfolio is all about positioning your company at a market level that gives you an edge over competitors.
7) Change Management
The world is evolving rapidly and change can sometimes be measured in fractions of a second. If the global COVID-19 pandemic taught us anything, it is that the whole world can change dramatically in an instant and if you aren’t prepared to deal with change, you are destined to fail. Internal audits that can get at the ability of the company to adapt to rapidly changing scenarios will certainly be value additive.
How flexible and agile is the organization? How fast is key decision-making? How about the business continuity and disaster recovery plans? Does the organization have rigid structures that will crumble when the shaking starts, or are they more fluid and adaptive? The ability for internal audit to assess change management systems will become more and more crucial over time.
8) Strategy Execution
More often, amazing strategies fail to bring in the desired results, not because they lack any creative and good ideas but because the organizatoin lacks the conviction to implement those strategies effectively. Strategic audits need to figure out the company’s willingness and capacity to execute the strategy effectively. A pre-defined timeframe must be provided for the implementation of each objective.
9) Focus on Brand Building
Ultimately, an internal auditor by providing its services is helping to build the brand name for the organization indirectly. Auditing is not just a process that has to be followed by a company at timely intervals, it is a path towards creating a mark of the company focusing majorly on brand building. So, what does that mean? Brand building is about consistency in all things, including the product, customer service, and messaging, but also in the values, mission, and culture of the organization. By viewing internal audit’s mission through this brand-building lens, it will help you focus on spotting inconsistency and push the internal audit team to focus on what builds value over time.
10) Challenges to Growth
Without clarity of roles, responsibilities, timeframe involved, and measuring the success achieved, a strategy is just a plan without action. Internal audit has to bring in creativity and flexibility in coping with different demands of different situations. There will be challenges in the defined strategy of the organization during implementation that can make growth on that plan stagnant. After a specified timeline, feedback from senior management can help in the assessment of growth and the assessment to challenges to plan implementation.
No matter how many uncontrolled situations occur and challenges to the strategic plan arise, internal audit needs to be on the forefront of adapting to those changes and keep an eye on the long-term vision ahead to provide the clarity for better decision making.
—
Only by moving on from the mundane, can we free resources to focus on internal audits that matter. Those are the ones that help the organization adapt to the changing times and a changing workforce. It doesn’t have to mean changing our entire outlook towards our audit work, but instead changing our mindset to broaden our objectives as internal auditors and daring to, yes, have vision. 
Tanmoy Sengupta is an internal audit and risk management professional with more than 20 years of experience.