Implementing a New Audit Function

As a follow-up to the article, “ Internal Audit’s New Role ,” ( JofA, Sep.04, page 65), which I thought was great, I would like to comment on the other side of the coin—implementing a new audit function.

As the article pointed out, it’s a whole new world out there for internal auditors and companies, but both need to be on the same page in order for the function to work.

For starters, when building a new audit function one must consider the following points:

Management must fully understand internal audit’s role. They must know that internal audit does not monitor controls, make decisions for business units, provide resources to other areas or act as substitutes for the external auditors.

Education is the key to success. If you ask 10 people to define internal audit, five won’t be able to give you an answer, and the other five will offer eight opinions. Therefore, when starting an internal audit function, particularly in this new environment, one must educate all levels including senior management and line management. Forget continuous auditing—one needs continuous education!

The article emphasized the need to hire the right chief audit executive—clearly important, but the CAE is then charged with finding the right staff. With Sarbanes-Oxley creating unprecedented demand for quality auditors, patience and persistence are imperative in this search. Settling for mediocrity is a recipe for disaster down the road. Our audit committee chair uses the acronym SWAN—smart, works hard, and nice—to represent the key elements for hiring quality staff. But as a new function, it also needs self-starters and ambassadors.

Experience also is a requirement. One cannot hire straight out of college anymore as the stakes are too high, and a new department cannot afford to spend the time training.

A new function must show progress quickly. However, this is often difficult as an audit can take several months to complete if thoroughly performed, not to mention the difficulties of getting staffed quickly. Some quick hits early can be as easy as communicating your mission statement, scope of work and type of services you’ll provide (audits, system development reviews and consulting). You should be developing and scoping your audit universe and initial audit plan, while at the same time getting staff on board and working on some audits.

These are just a few of my initial thoughts on some of what needs to be done immediately when starting an audit function.

Bruce Caplain, CPA
North Easton, Massachusetts