Internal Auditing-Shifting from 'Inspection' mode to 'Advisory' mode

The expectations of an organization from an Internal Audit are manifold. The mandate of an Internal Audit function is either stated through a formal charter or in many cases informally stated and implied; best practice guidelines recommend that the expectations from an Internal Audit function be explicitly stated in the charter. To examine what these expectations are, let us go back to the definition of Internal Auditing as defined by The Institute of Internal Auditors (IIA):
“Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.
The key phrases to delve upon are “…consulting activity…” and “…evaluate and improve…”; both phrases normally associated with advisory services, rather than on inspection services. Advisors are expected to be enablers and facilitators, where as inspectors only provide a findings report.

Shifting from an inspection to an advisory mode can be achieved through changes in some key areas in the way an Internal Audit function is conceptualised, set up, deployed and measured.

The Internal Audit Concept
The concept and expectations of an Internal Audit Function are spelt out in an Internal Audit Charter, which typically comprise a set of responsibilities, as stated below.

• Identify and assess potential risks to the operations.
• Review the adequacy of controls established to ensure compliance with policies, plans, procedures and business objectives.
• Assess the reliability of financial and management information presented.
• Assess the means of safeguarding assets.
• Review established procedures and systems and propose improvements.
• Appraise the use of resources with regard to economy, efficiency and effectiveness.
• Follow up recommendations to make sure that effective remedial action is taken.
• Carry out ad-hoc appraisals, investigations, or reviews requested by the Management.
Even though the statements do have an implicit reference to evaluation and improvements; the focus of responsibilities is onverifying compliance and prevention of fraud. Naturally the Internal Audit team’s focus stays within these two elements; the onus of innovation and improvements lying with the auditees and their respective departments.

It is strongly recommended that the following additional responsibilities are added in the Internal Audit Charter:
• Conduct analytical review of performance and provide objective recommendations to improve.
• Drive improvements by advising and facilitating changes in systems, controls and tools required to sustain planned improvements.

The approach and tools used internal auditors, such as checklists and templates, are based on the responsibilities stated in the Charter. Therefore, explicitly stating the role of Internal Auditors in planning and implementing changes and improvements would be the first step an organization can take to shift Internal Auditing from ‘inspection’ to ‘advisory’ mode.

The Internal Audit Set-up
Internal Audit teams, normally, are set up as a separate department with no operational responsibilities, a practice followed to ensure independence. Traditionally, personnel in these functions are limited to accounting and finance background, and not necessarily with expertise in process and performance improvement tools.

Having a right mix of personnel with experience in operations, management, financial analysis, process evaluation, performance tools and business excellence models would serve well to set up a team which can complement each other’s capabilities and work towards serving the common objective of establishing the Internal Audit function as a model for sustained business improvements

Organizations, which rely on a skeletal staffing, may find difficulty in imparting the multi-dimensional skills to the Internal Audit Function. Such organizations may look at the following alternative arrangements:

• Create a virtual Internal Audit team comprising cross functional members; monitored and deployed to ensure independence.

• Outsource certain sections of the Internal Audit to service providers who can bring in the required expertise and experience.


Internal Audit Deployment Approach
Internal audit teams require a paradigm shift from ‘Transaction verification’ to ‘Process Walkthroughs’, a shift from focusing on ‘what’ to ‘how’.

Reporting on non-compliance to specified policies and procedures also needs a shift from merely stated ‘what’ to examining the ‘whys’ of such a non-compliance; root-cause analysis and the implications of such a non-compliance on performance are required to be examined. This can be achieved only by conducting a ‘Process walk-through’ using samples of transactional records, rather than just verifying the existence of documentary evidence to specified transactions.

This approach emanates from business excellence models which always link results with established enablers, rather than leaving fulfillment of results to adhoc methodologies which are dependent on specific individuals within the organization.

Internal Audit Function Measurement

Internal Audit charters of organizations rarely provide a mechanism or guideline to evaluate the performance of an Internal Audit function. Even if they do exist, the focus of such measurement is on the number and coverage of internal audits, the timeliness of reporting and adherence to yearly plans.

Though, it does remain a challenge to link organizational improvements and performance to an internal audit function, effort towards creating more business oriented measures for the internal audit function would be the first step. A sample of such measures could be:

• No. of improvement projects initiated through internal audit findings
• Quantum of leakages/ wastages noticed through internal audit findings
• Reduction in ratio of external/statutory to internal audit cost
• Reduction in probability of occurrence of undesirable events and subsequent risk reduction

Measurement of Internal audit based on the performance of auditees would prompt auditors to move into an advisory role.


To summarize…
Shifting the focus of Internal Audit from an inspection to an advisory mode would, over a period of time, create a collaborative approach across the entire organization for driving improvements, with the Internal Audit function playing a very crucial enabling and facilitating role.

Neelakantan K.
Senior Consultant,
Morison (UAE) Consulting