Revolutionizing Internal Audit: A Strategic Blueprint for Enhanced Board Engagement and Efficiency

Dr. Aroshan Indujeeva DBA

( Independent Sarbanes Oxley Practitioner | Corporate Governance & Audit thought leader | Chief Internal Auditor )

Introduction: Rethinking Audit Reports for Enhanced Board Involvement

During my tenure of over 14 years as a Chief Internal Auditor, many board members, especially chairpersons, have voiced that reviewing lengthy internal audit and compliance reports can be one of the most tedious and time-consuming elements of board meetings. Typically, these reports, often extending beyond 50 pages, can induce what is commonly referred to as 'Board Fatigue.' This calls for a transformative approach to internal auditing that prioritizes relevance and efficiency in our fast-paced business environment.

The Shift from Control-Centric to Impact-Oriented Auditing

Overcoming Traditional Mindsets

Traditionally, internal audits have focused primarily on control or procedural violations, often overlooking the actual impact on business operations. This traditional approach can lead to redundant controls that may not necessarily contribute to business efficiency. It's essential to reevaluate not just the necessity of a control but also its cost-effectiveness and overall impact on the organization.

Strategic Control Assessment

Instead of adding layers of controls, auditors should assess the return on investment for each control implemented. This involves a detailed analysis of the control’s objectives, the risks associated with its failure, and the financial implications of both its existence and potential failure. By focusing on these areas, auditors can help management implement controls that are both effective and economically justified.

Streamlining Audit Processes: A Three-Phase Approach

Pre-Control Phase

Optimizing control design starts with minimizing potential errors at the data entry stage. Implementing robust data validation processes can prevent errors before they occur, reducing the need for additional controls and associated costs.

Control Phase

Where possible, automations should be implemented to enhance efficiency. For example, a simple end-of-day process could be automated through scripting, reducing the need for manual intervention and thereby cutting costs.

Post-Control Phase

In some cases, it might be feasible to skip the pre and during-control phases and focus directly on post-event analysis. Advanced analytics can identify exceptions or non-compliances within a critical timeframe, allowing for timely corrections that mitigate potential impacts.

Prioritizing Impact: The Core of Modern Internal Auditing

The primary focus during any audit should be on the potential financial impact—how much the company has lost or stands to lose. This shift in focus from mere compliance to evaluating the effectiveness of the internal control environment is crucial. Auditors must design their tests to assess how control failures impact the business, relegating minor procedural deviations to a secondary concern unless specifically required by the audit committee.

Visualization for Decision-Making: Maximizing Engagement in Board Meetings

Embracing Conciseness and Clarity

To combat dwindling attention spans during lengthy board meetings, internal audit reports should be concise and visual. Limiting reports to one or two slides with clear, graphical representations of data can significantly enhance comprehension and decision-making. This approach leverages human nature’s preference for visual over textual information, making it easier for board members to grasp complex data quickly.

Effective Presentation Templates

A well-designed slide should summarize the audit succinctly, highlighting key aspects such as auditable areas, period, sample size, and the methods used. Distinctions between business impacts and control breakdowns should be clear, enabling the board to understand the severity and financial implications of each finding.

Visualizing for clarity : Enhanced decision making

As I mentioned at the onset, all of us hate to look at lengthy word documents going on an on. Anyways , Audit commitees are time consuming and exhaustive affair and after a good 1 hour in to its’ affairs , the committee member attention spans dwindle in a quite significant manner. So, as CIAs out job should be ensure that we make the best of the shorter attention spans and add value, and the best method to do that it to visualize your reports. Humans by nature react & grab information fast & well , when its’ graphical. Take road signs for an example – Imagine if road signs were boards of long TEXT !!!

One Slide Max Always !!

Ensure your audit report summaries are limited to max 1-2 slides. For individual issues / observations , please use hyperlinks where if any member needs more info , you have the required back up. One of my favorite presentation templates are as follows :

Key highlights in my format

One slide summarizes the entire audit. The top fields indicate the master & sub processes, auditable period , sample size as well as the sampling frame / method. It also indicates the comprehensiveness of the population in play by indicating whether analytics have been used in the audit. The rating is clearly specified and the observations are split in to two areas

Business Impact vs Control breakdowns

The management & the committee must be well aware of the nature of the control breakdown. When IA clearly indicates the potential impact on mentary terms , it is clear enabler to convince the target audience on how dire / serious the issue is. Because human minds / rather business minds are wired to commensurate the importance / gravity of the issue along with the actual or potential monetary loss to the business. Then we prioritize the control breakdowns or issues in policy / procedure level governance which are rather a 2nd level fix.

Why such categorization?

It is to provide a clear prioritization template for auditors and managers on the urgency to fix the issue. Any Impact-based issue which has a potential loss, it is imperative for audit to highlight the issue even during the fieldwork phase and management has the immediate responsibility of remediating the issue, and ensure protection of shareholder wealth.

Conclusion: Setting a New Standard in Internal Auditing

The evolution of internal auditing from a function that primarily checks compliance to one that strategically assesses business impacts and control efficiency is not just beneficial but necessary. By adopting these strategies, internal auditors can ensure their work directly contributes to organizational success, aligns with business objectives, and sustains board member engagement.

By redefining our approach to internal audits, we can transform a traditionally mundane task into a dynamic tool for strategic decision-making, ultimately protecting and enhancing shareholder value.