Four steps to formalize internal audit’s strategic impact

Internal audit isn’t just about compliance anymore. Increasingly, the function’s role is being incorporated into the broader business strategy – from mulling over major capital projects to advising on mergers and acquisitions. But executives say they need to do a better job of formally describing the role internal auditors will play in charting the course of the business.

Three-quarters of executives surveyed by Ernst & Young said strong risk management has a positive impact on their long-term earnings performance. And internal auditors play a key part: An equal percentage said their internal audit function has a positive impact on their risk management efforts, according to the report, The Future of Internal Audit is Now, which polled 695 chief auditors and other C-suite executives. But 61% said they had no documented mandate aligning internal audit with the organizational strategy.

“The paradigm for internal audit’s role is shifting to a more holistic role, encompassing compliance, operational and strategic advising,” said Brian Schwartz, Ernst & Young’s internal audit leader in the Americas. “Today’s internal audit function must be aligned to the organization’s strategic initiatives to be relevant. It is imperative that audit functions revisit their respective mandates and adjust their focus to include coverage of strategic and operational business risks, and not only financial compliance.”

The report recommends a four-step process for executives to follow in creating a formal strategy document for the internal audit function:

• Develop and refine internal audit’s strategic vision: Incorporate the needs of key stakeholders plus the roles and responsibilities of internal audit into a plan for what internal audit should accomplish over a long period.
• Identify and prioritize key strategic initiatives: Align initiatives to key business risks and key operational and functional priorities. Make sure internal audit has the staff, tools, processes and functional insights necessary to accomplish the objectives.
• Design key performance indicators: Determine metrics that will measure how internal audit fares in meeting its initiatives, aligning with stakeholder expectations and producing desired results.
• Develop an operating strategy: Describe activities that will help internal audit accomplish its objectives. Determine key milestones and how the function will communicate its progress to key stakeholders. Create a mechanism for internal audit to adapt to changing priorities so it can remain relevant.

The strategic plan can help internal audit develop and retain a key role in charting a successful path for an organization. Schwartz said building a relationship of mutual trust with management also is critical in maximizing internal audit’s relevance to stakeholders. He said internal audit functions can develop a “relationship map” that identifies key stakeholders and assigns specific internal audit leaders to “own” those relationships and interact with those stakeholders on a recurring basis.

“This includes formal meetings to discuss upcoming audits and casual contact to discuss changes to business objectives,” Schwartz said.

Prominent role in planning

Despite the lack of a documented mandate in many organizations, internal audit already is playing a prominent role in business planning. The areas where internal audit is contributing include major capital projects (identified by 49% of survey respondents), IT systems implementations (42%), mergers and acquisitions (37%) and material contracts (32%).

Schwartz said organizations can overlook the real value internal audit can provide. He said that when the function is set on a compliance path with little alignment to strategic priorities, management can overlook the contributions internal audit can make in creating organizational value. Internal auditors can even lose sight of this themselves, Schwartz said, when they focus strictly on compliance.

“Our survey points to the need for internal audit to step back from the audit plan and develop a strategic plan,” Schwartz said. “This is one way for internal audit to challenge the value it brings and its true alignment to the strategic priorities of the organization.”

—Ken Tysiac (ktysiac@aicpa.org) is a JofA senior editor.