Setting priorities to establish and expand internal audit
Internal audit is a key component of corporate governance. However, in some cases, internal audit teams are small or not resourced as well as they should be. This guide provides recommendations to help heads of internal audit establish and grow an effective function that can meet its priorities.
Below we introduce seven challenges commonly faced by internal audit functions. The recommendations provided in the guide to address these challenges are based on interviews with 12 current and former heads of internal audit, conducted by ICAEW’s Internal Audit Panel.
Download our report for a detailed outline of the challenges and recommendations. ICAEW faculty members can view the full-length guide.
How well is internal audit’s work understood and regarded?
Based on the interviewees’ experiences, organisations recognised the need for an internal audit function, but the role was not well understood. New heads of internal audit spent a significant amount of time outlining its purpose, scope and value.
Which activities should a smaller internal audit function prioritise?
All the interviewees indicated that internal audit’s primary role was to fulfil the organisation’s need for risk-based controls assurance. One unanimous message from our interviewees was the absence of ‘no go’ areas for internal audit, although several noted that limits in specialist resources as well as budget placed practical constraints on coverage.
How does internal audit deliver the greatest impact?
All internal audit teams deliver a service that includes an audit strategy, an annual plan and individual assignment reports. Opinions among interviewees differed as to whether written reports or verbal communication had the most impact.
How can internal audit attract and retain the right talent?
Attracting and retaining people with the right balance of skills, including the more sought-after specialisms, was a priority for all our interviewees. Rapid advances in technology are posing challenges to internal audit teams of all sizes.
Can the inevitable shortfall in specialist skills be overcome?
Even in the most favourable circumstances, an internal audit team is unlikely to have the technical skills and in-house experience to cover every financial, operational, strategic and IT issue in depth. Budgetary considerations led some heads of internal audit to seek specialist assurance work from outside the organisation.
How can internal audit build strong stakeholder relationships?
Interviewees found that often management in smaller businesses have not had the opportunity to understand what a well-functioning internal audit team looks like, so being able to depict its role and value at the start and involve senior executives in the process is a key element to ensure its success.
How can internal audit achieve the right balance between input and management interference?
Independence of the internal audit function is paramount to success, but input from business stakeholders is critical for audits to deliver value. It is important to establish that the internal audit function and the audit committee have final say on the audit plan and the outcomes produced so that business engagement is framed in the right context.
Related topics
How do you audit a robot?
Guidance for internal auditors on how to provide assurance over the key risks involved in implementing robotic process automation (RPA).
How to audit culture
This practical guide outlines the eight steps to follow to conduct a successful internal audit of culture.
How to audit the cloud
Guidance on how to conduct an effective cloud audit with a focus on cloud security, operational resilience, supplier management and legal and regulatory compliance.