Norman Marks on Governance, Risk Management, and Internal Audit

There’s an interesting article published by the International Federation of Accountants (IFAC), We need to Maximize Internal Audit’s Impact.

It is based on the results of a survey by the UK’s Chartered Institute of Public Finance and Accountancy (CIPFA) of internal auditors in the public sector. While it might appear that the results would only apply to public sector functions, I believe they have wider relevance.

The report said (with my emphasis and comments):

• Increasing the impact of internal audit on an organisation is essential if it is allowed to become more effective. But what do we mean by ‘impact’? We define it as ‘internal audit’s ability to support the organisation in achieving its strategic objectives and goals.’ Some of the main areas to assess whether internal audit is having an impact include good engagement with senior managers, whether internal audit’s priorities are clearly aligned with organisational ones, providing timely and meaningful assurance, the ability to challenge constructively and the freedom to be dynamic and change focus.
  • Comment: I like the emphasis on helping the organization be successful – which is far more than managing risks that have a negative effect.
• 93% of internal auditors thought that they contributed to the effective management of the organisation, while 88% of clients agreed.
• Almost three-quarters (73%) of heads of internal audit who responded believed that they acted as an independent critical friend, but only 43% of management agreed with this. Perhaps of more concern, our research identified only 35% of audit committee members thought that internal audit provided this role. Ninety one per cent of heads of internal audit said they provide advice on new systems and developments, but only 62% of managers agreed. This disparity in how internal audit’s impact is currently viewed is common across a range of different services and roles provided by internal audit – with clients consistently believing internal audit’s input is significantly less than what the heads of internal audit believe. Perhaps one of the best ways to significantly increase the impact that internal audit makes is to look to the future. We asked respondents to identify three key areas that internal audit should focus on in the future which will have the greatest impact on the organisation. Cybersecurity was the top priority, with just under 60% of respondents wanting internal audit to focus on this key strategic area in the next three years. Just over 50% identified digitisation and data use within organisations as the next most important area while 47% thought that climate change and sustainability would be important areas of focus for internal audit professionals.
  • Comment: the phrase “independent friend” is a curious one that I have not seen before. Trusted advisor is perhaps the more common version. Even so, CAEs have to do more than talk about value, they have to deliver it. Only when management sees that internal auditors are actually helping them be successful will they believe it.
• The area of internal financial risk, which internal audit has traditionally provided assurance in, such as payroll and income, are generally already well managed with little exposure to risk. So, does internal audit still have a role to play in mitigating financial risk? Thirty-five per cent of respondents said they thought financial viability was a key area for the future. This includes more strategic areas such as financial resilience and medium- and long-term financial strategies – both of which carry considerable risk to the organisation. Without seeking to influence the financial policies themselves, internal audit can provide vital independent assurance to decision makers to allow them to take on more risk and be more ambitious.
  • Comment: I would change this to include auditing cash management, including cash flow. Remember what is King!
• …internal audit should take a more strategic role in areas of future importance, which may be outside of its traditional activity, if it is to have a real impact on the organisation. Of course, audit professionals cannot be expected to become experts in areas such as cybersecurity and climate change, but they can provide independent assurance, critical analysis, strategic advice, promote transparent decision making, put in place good governance arrangements and help to mitigate risk in all of these areas.
  • Comment: you can’t be effective in auditing the business if you don’t understand it.
• Organisations must invest in continually upskilling their internal audit teams with life-long learning, continuing professional development and expose them to developing areas of strategic interest. If internal audit is to keep up with the pace of change in an organisation, then it starts with giving those teams the skills they need.
  • Comment: Conferences and seminars (in person, preferably) are valuable. May I plug my books as well?
• Internal audit managers must become better advocates for their teams, and promote the contribution of internal audit throughout the organisation. This way, managers and clients will better understand its impact.
  • Comment: the best way to sell is through performance.

There’s a great deal of value in these words. But it all starts with the internal auditors’ mindset.

Are they there to find fault, or to help the organization succeed?

If it’s the latter, then prove it!

I welcome your thoughts.