Demonstrating quality and excellence in everything they do is an increasing demand on the Chief Audit Executive.
Since the global financial crisis the world of internal audit – and the challenges internal auditors face – have changed. Internal audit teams (often smaller than they were) are under greater pressure to meet stakeholder expectation and demonstrate how they contribute to business value or value creation.
The temptation can be to focus on areas of compliance, and to become swamped in day-to-day procedures and tasks, which do not have meaningful impact within the business.
But is this what senior decision makers in the business really value? When we seek feedback from business leaders on their internal audit teams, technical skills and the ability to meet compliance requirements are rarely questioned. Other weaknesses are, however, more likely to be identified: a failure to think strategically, commercially or scan the horizon is a typical lament. Internal auditors are also seen as focusing exclusively on the symptom, rather than then understanding the cause. Some are thought to lack a real understanding of the business itself and don’t fully understand the commercial impact of decisions made by management. These are comments made by stakeholders who often want internal audit to be engaged at a strategic level.
On the other hand, there are business leaders who do not see the value of internal audit at a strategic level. Instead they view internal audit as a quality control tool that uncovers systemic errors in systems and processes.
These are concerns. By failing to engage with key stakeholders in the right way, which includes executive and senior management leadership, internal audit is missing the opportunity to build relationships and gain greater profile and impact at the top table.
One way that internal auditors can seek to counter or avoid any such criticisms is to review their own operations and identify areas for improvement, this may involve holding an honest conversation with stakeholders about what is expected and what is being gained from internal audit. Improvements may include up skilling auditors to think more strategically during audits or it could be a review of the internal audit strategy which underpins all internal audit activities. In this way, internal audit continuously improve the support they provide to their organisation. But in order to improve, internal audit need to know how they are performing now, and how that performance is perceived.
An External Quality Assessment (EQA) review is a key tool for helping internal audit teams achieve such improvement. By means of EQA, internal audit’s strengths and weaknesses can be identified, and a plan of action developed for supporting improved performance and the delivery of excellence.
EQA should not be viewed as a threat to internal audit, but as an opportunity. It provides an overview of performance – a springboard from which internal audit can develop enhanced service provision to the business.
An EQA has the power to transform internal audit’s impact and its perception among stakeholders because it considers the value that internal audit currently delivers and its aspirations as well as how these are met. Alongside reviewing audit files and reports, the EQA reviewers obtain feedback from internal audit’s customers – whether members of the audit and risk management committees, members of the executive and senior management or line managers within business operations. An independent reviewer can potentially obtain more open responses than chief internal auditors could themselves about whether internal audit is meeting business needs, offering strategic insights and having a tangible impact on business performance.
An EQA review can also potentially benchmark the internal audit team against peers in similar organisations and industries. This could include comparisons of basic resource levels such as headcount, but also the way the department operates – its degree of access to experts and whether any elements are outsourced, for example.
Clients who have experienced our EQA reviews tell us what they perceive to be the benefits: these include access to an objective view of internal audit activities, recommendations from experts, a road-map for further improvement and benchmarking against other internal audit teams. Internal audit teams may, as a result, decide to review their planning processes, their consideration of strategic issues or their role in risk management.
An EQA report is, of course, just that – a report. How internal audit, management and the Audit Committee acts on the contents is important. The EQA report could be filed on a shelf. On the other hand, internal audit teams that use the findings to drive improvement in their operations can look to achieve greater impact in their organisations, and increased influence among senior decision makers.
Governance, risk & assurance