Wednesday, July 29, 2020

Internal Audit: Adding Value 2.0

 

By: Nicodemus Tan, Partner, Governance & Risk, CIA, CRMA, CFSA, CA

(First published in the Internal Auditor Magazine, June 2020 issue as “Adding Value 2.0” by The Institute of Internal Auditors, Inc.)

 

Internal Audit: Adding Value 2.0

In the current environment of cost-cutting and changing priorities, internal audit will be challenged to demonstrate its value to the organisation. Yet, the value of internal audit is hard to fathom. If the audit function's core value lies in helping the organisation reduce risks, how does it quantify and report on losses averted when risk events did not occur?

As internal audit's value proposition expands beyond its traditional assurance boundaries, audit functions have an opportunity to rethink how they contribute to the business. While many facets may be intangible, internal audit can use recognised metrics to demonstrate its tangible value to audit committees and senior management.

 

Current notions of value

In communicating to the audit committee, many internal auditors have measured and shared work completed as a proxy for value delivered. They have used the quantity of audit projects performed, cycles covered, or number of issues raised and reported as key performance indicators (KPIs).

However, work completed does not necessarily correlate with value delivered and may distract stakeholders from the actual value delivered. It also is easy for internal audit to inflate such a single facet of quantitative data by sacrificing quality. For example, audit functions could limit the scope of reviews to increase the number of audits or the number of cycles reviewed.

Many internal audit functions use the balanced scorecard method to measure performance and communicate their value. It is a useful tool to translate internal audit strategy into actionable plans, with detailed metrics to  show progress. However, most of the metrics commonly used in balanced scorecard or other forms of assessment relate to the execution of internal audit plans and may not measure value accurately.

Take for example the perceived quality of internal auditors based on their academic qualifications or years of experience. Although experienced auditors with strong academic achievements may be considered more likely to deliver value, this metric may not reflect the actual value those auditors delivered. Similarly, another common KPI is the completion of audits within budget, a metric that is important for cost control but does not measure value.

 

What is valuable to shareholders?

It is difficult to score a goal when one does not know where the goal post is. To provide and communicate value, internal audit must first identify what its key stakeholders - the audit committee and management - deem valuable.

While internal audit reports functionally to the audit committee, the discussions and agreement with senior management about its value proposition are no less important. Senior management is closer to the business and provides powerful independent feedback on internal audit to the audit committee. Given the profession's advancement over the past decade, the value of internal audit is no longer limited to the recommendations auditors provide. Likewise, discussions of value should go beyond assurance over internal controls. Internal auditors can assess what stakeholders find valuable in several ways.

 

Review Stakeholder Topics

As the chief audit executive (CAE) prepares to discuss value drivers with the audit committee and senior management, a good starting place is to review recent communications. Requests by the audit committee and senior management or seemingly run-of-the-mill interactions that were not captured by current metrics
may indicate value drivers.

 

Seek Feedback

Formal discussions with the audit committee and senior management about the value proposition should take place at least annually. Common methods for gathering feedback include electronic surveys of individual  stakeholders, face-to-face or phone interviews, and facilitated focus group discussions with the audit committee
and senior management. These discussions can be conducted separately or jointly.

Where practical and meaningful, a focus group discussion involving the CAE maybe preferred. Unlike a survey, this interactive format can uncover an individual's blind spots, encourage cross-pollination of views, and build consensus among stakeholders.

If conducted well, surveys or discussions with middle or lower management following each audit can provide timely responses. These clients often are the original and unfiltered source of feedback for senior management. Responses about what internal audit did and did not do well can enable the department to fine-tune its value proposition and better match the value management seeks, which can change throughout the year. The responses also are a great source of information for the CAE's annual discussions with the audit committee
and senior management.

 

Discuss Value

During the discussions about internal audit's value, CAEs and their auditors should note that there is a fine line between proposing suggestions or alternative views and appearing to promote their self-interest. Even in situations where management's requests seem unreasonable or irrelevant, internal audit should ask questions to clarify the intent of the proposal rather than reject the notion outright and be seen as defensive.

Where there is material misalignment, the feedback can be a golden opportunity for internal audit to identify an expectation gap. While it is uncomfortable to hear negative feedback, it is important to interpret it correctly and constructively to retain the client's trust and enable a more collaborative partnership. Otherwise, clients may decide that internal audit will not act upon their feedback.

 

Acknowledgement-based Metrics

Once internal audit has agreed with its stakeholders on the value proposition, it should develop metrics on a reciprocity basis. This means the metric should not be a measurement that is determined solely by internal audit but also includes acknowledgement and affirmation by management.

 

Talent

An increasingly recognised value internal audit provides is a talent pipeline. Many organisations have either actively recruited internal auditors to join their business functions or included internal audit as a rotational stint in their management trainee programs. If management does not perceive this as valuable, it would not offer these positions to auditors. Correspondingly, the number of auditors who are offered business function positions is a good indicator of value generated and acknowledged by the organisation.

 

Training

Well-established internal audit functions often train process owners on risks and controls, but management may not always consider this valuable. One way to assess and report on this value is to collate information on the number of attendees and their feedback. Using a consistent grading scale to compare across time and regions, such feedback could indicate the value the training provided.

 

Process Improvement

Many organisations practice the Six Sigma approach of reducing defect rates in a product, process, or service. To measure internal audit's value, management could adopt this methodology by comparing the error rates of processes before and after business units have undertaken remedies recommended in an internal audit report. For example, Six Sigma practitioners can compare the error rate or near-miss rate of dispensing medication at a pharmacy before and after it has implemented a maker-checker control that internal audit suggested. Conversely, management may only measure error rates for processes that it considers to be key risk factors, as error rates of other processes would not demonstrate value.

 

Consulting

High-performing internal audit functions often are involved in value-enhancement projects such as IT system design discussions and pre-acquisition due diligence. Internal audit's participation in these consulting projects are typically at management's request, which indicates that management realises internal audit's value.

 

Analytics Expertise

Another source of value is internal audit's use of analytics. Auditors often share the insights gleaned from these techniques with management following the completion of an audit. As this becomes a standard practice, many internal audit functions have progressed to coaching and transferring these techniques to management, which is a convincing sign of value.

 

Communicating Value

The unique environment of each organisation and the dynamic role of its internal audit function mean that there are far more ever-changing sources of value. To stay relevant, internal audit should keep the communication channels open and check in periodically with the audit committee and management about any shifts in the goal post. To maintain credibility, internal audit must not cherry-pick its metrics. It should not just report regularly on metrics that are under its direct control and report selectively on all other positive information only on an ad-hoc basis.

A good practice is to set relevant metrics for each of the agreed-upon value drivers based on acknowledgment based results and confirm them with the audit committee. For example, rather than the number of training sessions conducted for management, internal audit could monitor training feedback from attendees. Instead of using the number of audits performed with data analytics, the department could use the number of data analytics scripts adopted by management.

Internal audit should provide these metrics to the audit committee and management periodically, regardless of the actual score. Moreover, it should provide them before beginning the annual management survey of internal audit to facilitate a more accurate assessment. Then, internal audit should report the results of the annual management survey and the metrics together to the audit committee to give a full picture of the value the department has delivered.

Where internal audit has fallen short of certain KPIs or its metrics are not up to par, it should not appear defensive or attempt to boost numbers in the short run. Instead, auditors should understand the underlying value proposition. For example, if the number of internal auditors hired by business units decreases, the CAE should pause in promoting the team to the business owners. During this time, the CAE should ask management if the type of skills that the business is seeking has evolved or if the audit staff's training is sufficient for auditors to add value to the business.

 

Convincing Stakeholders

In the current business climate, the risk landscape of organisations is changing at an unprecedented rate, as are the expectations of internal audit's key stakeholders. To deliver a greater level of value, internal audit needs to reconsider its value proposition from a blank slate, starting with stakeholders' current expectations both now and in what may be a radically different future. A candid, open, and consistent approach to identifying, agreeing upon, and reporting on internal audit's value proposition can make the most persuasive case for the function's value.

 

Get in touch with the author(s):

Nicodemus Tan
Partner
Governance and Risk
  |  Email

 

Download The Salient Point - Internal Audit: Adding Value 2.0:

>> Back to The Salient Point>> Main Page

 

DISCLAIMER: All opinions, conclusions, or recommendations in this article are reasonably held by Baker Tilly at the time of compilation but are subject to change without notice to you. Whilst every effort has been made to ensure the accuracy of the contents in this article, the information in this article is not designed to address any particular circumstance, individual or entity. Users should not act upon it without seeking professional advice relevant to the particular situation. We will not accept liability for any loss or damage suffered by any person directly or indirectly through reliance upon the information contained in this article.