Quick Way to Know if Your Internal Audit Team is Adding Value…Ask!
Most consumer-centric organizations know that the best way to find out if a product or service meets or exceeds expectations is to ask customers – the people who use that product or service. The same holds true for your internal audit team. Who are your customers? Governance (i.e. Executives and the Audit Committee). With this in mind, the best way to know, without any doubt, how well your internal audit department is perceived by the rest of the organization is to actually ask the governance of your organization. And I don’t mean just go up to them and say “how do you think the internal audit team is doing”… as this will probably get you a canned response of “fine.” Instead, I suggest at the completion of each audit, ask governance if they believed they received at least enough value from the findings and recommendations of the audit to cover the cost of the audit.
For example, I calculated the cost of my internal audit team’s audits as follows: (blended hourly rate based off of department salaries) * (the number of auditors on the specific audit)* (40 hours per week)*(the number of weeks in the field). I also included any travel costs incurred since my team traveled 50% or more. At the end of each audit, I included a very simple cover letter attached to the final executive summary and audit report. The cover letter went something like this:
“This audit cost the stockholders $XX,XXX. Did you see value greater than this cost in the results of the audit?
Yes / No
If No, why not? ______________________________
Other comments you would like to share: __________________________________________”
The feedback I received from governance let me know if we really were helping the organization achieve its business success objectives or not. Once I had refocused my team to focus on those risks that could impact the organization’s business objectives, I received very positive feedback 95% of the time. The few times I received less than positive reviews, the feedback usually identified issues within my team that I needed to address, but probably would have taken much longer for me to realize without the feedback.
If you are not ready to go to this level to determine the value you provide your organization, you may consider meeting with your executives and audit committee to gain an understanding of what they believe internal audit could do to add value to the organization. Then discuss if your team has the resources to meet their expectations. This is a great way to gain agreement on what internal audit can and cannot provide. For those areas you currently do not have resources to address, you can use this information to develop a strategy to obtain or develop the resources needed to meet Governances expectations in the future. As a side note, if the response you receive is to focus on compliance issues only, then you may have one of two situations: 1. Governance does not know what internal audit is capable of doing besides compliance type audits or 2. They do not believe your team adds value so they will regulate you to the “compliance corner”. Neither is optimal but with the first scenario you can meet with Governance and give examples of other ways your team can help the team be successful. In the second scenario, you really need to reassess what your internal audit has been doing because whatever it s, it isn’t working. The following are some things to consider:
Change takes time. Start small. Speak to (or find) mentors within your organization, solicit feedback from governance, begin reaching out to and building relationships with other teams in your organization. Ask a trusted executive for their honest opinion. Ask them if they know what internal auditors do. The answer to this question can be particularly illuminating!
Bottom line: Find ways to create more value than cost. This will take some time and adjustment.In the meantime you can always conduct an internal self-assessment by determining the cost of each audit and reviewing your audit report to see if it provides at least that much value to the organization.
“Continuous effort – not strength or intelligence – is the key to unlocking our potential.”