What Does A High Performance Internal Audit Function Look Like?

It’s that time of year when internal audit functions set their goals for the year and staff set their own objectives. We are all urged to strive for the stars and excel in terms of our performance. But what does a high performing internal audit function look like? Here are some pointers - feel free to critique or add your own.

Delivery

Our audit functions are businesses financed by the companies that employ us or the public authorities that engage us. We make commitments to deliver a quantity of reports up to a certain standard. Have we organised ourselves to meet our obligations to audit committees, regulators and our paymasters. It’s not only a question of delivering the quantity of audit reports that we promise but also producing our output in a manner that allows the organisation to digest what we deliver.

Change

An internal audit function that just produces reports but stimulates no change is probably a waste of time and money. Let’s assume that your organisation does not have the perfect control framework. I have yet to work for one that has! How are you organising yourselves to provoke change? Do you have a documented engagement strategy to address the control pressure points in your organisation? Does this strategy ensure that the right types of audit work are conducted? Does the strategy identify the auditees that merit the most attention during the year? Have you organised yourselves to tackle the emerging risks that you see? I see internal audit as a change agency - not a neutral assurance shop.

Values

Values are important in life. 2023 should be an opportunity to encourage your team to apply these values. Obviously for an internal audit function values of integrity are critical. But are we organising ourselves to encourage our staff to grow? Are we empowering people or accidentally diminishing them? Are we promoting collaboration? Are we encouraging each person to play their role as a leader? Let’s not only allow the extroverts to speak? Let’s also find a way to give our introverted colleagues a voice??Fundamentally does your internal audit function have objectives that support the values that you hold dear?

A Factory of Risk Management Excellence

We all want to feel respected. In addition to the above, what else can your internal audit function do to feel respected? I like the idea that the business wishes to poach, or alternatively, politely ask to borrow or transfer members of my team. It means that we are doing something well. Are you striving to become a factory that produces excellent control orientated risk managers. Why not set some objectives that measure the degree to which you’re producing these valuable individuals?

What else should we be striving for?