In a recent blog post, I shared some statistics that confirmed an inconvenient truth: the typical internal audit department is small – averaging less than 5 internal auditors.

I wrote about internal audit engagements that make a “big impact.” However, as some who read the post pointed out: “impact must be sustained over time.” One or two big impact internal audits will not ensure the long-term success of an internal audit department – particularly a small one.

I often hear chief audit executives (CAEs) of small audit shops lament about the challenges of working with limited resources. In a way, I can sympathize. For much of my career, I worked in or le​d small audit shops. In fact, the first three years that I served as a CAE, I only had three or four full-time internal auditors on my staff besides myself. As my career progressed, however, I eventually led mammoth audit staffs of several hundred auditors. While it was nice to have all those resources to dedicate to the complex high-risk areas of the organization, I never felt quite as proud of our ability to generate a “big-impact” with my team as I did with those smaller shops. I learned from those early days as a CAE that you can make a big impact with a small audit team, but you must leverage a strategic mindset to do so.

Several years ago, I had the opportunity to speak at a conference of CAEs who led small internal audit shops. I outlined six strategies from my own experiences on generating a “big impact” with a small staff.

Here is a quick look at the strategies I shared:

Strategy #1: Follow the Risks
Audit engagements are most likely to produce substantive results when they pinpoint areas of significant risk to the enterprise. We all know that our professional standards call for engagement plans based on risk assessments. At smaller internal audit shops, however, this important rule sometimes gets shortchanged. Most of us understand the importance of assessing risk as part of our annual planning process, but in the rush to complete individual audit engagements, we frequently skip the assessment phase of engagement planning. Small audit shops have fewer audit resources, and focusing those resources where risks are the greatest is often a key ingredient in generating high-impact results.

It’s important to remember the most common risk factors in audit planning. Each enterprise and business unit is different, but in general I like the list identified long ago by Larry Sawyer, which identifies the most common risk factors as:

• Timing and results of previous audits
• Materiality and liquidity
• Confidentiality
• System maturity
• Stability of the system
• Administrative controls
• Employee turnover
• Unit revenue and volume
• Performance indicators
• Public relations

Strategy #2: Multiply Resource Capacity
These days, it’s important for all internal audit functions to make the most of their resources, but at a shop with particularly limited resources, the ability to leverage outside resources can be especially important. While there are many creative ways to leverage resources, the four that I found to be the most powerful when leading small shops included: a) relying on the work of others, b) using functional experts, c) augmenting the internal audit staff with “guest auditors,” and d) co-sourcing.

Over the years, I have leveraged each of these strategies to increase the capacity/impact of my audit departments. In those lean years when I was trying to prove to management how additional resources could generate real value, I literally “begged, borrowed and stole” additional resources from wherever I could find them.

Strategy #3: Benchmark for Leading Practices
Benchmarking is simply a process for comparing the performance or practices of one internal audit organization to another. It can be done either formally or informally, and it is particularly important for smaller internal audit shops, where the CAE may be somewhat isolated from the expertise of other experienced audit professionals.

As a CAE leading small shops, I found The IIA to be an extraordinary resource in connecting me with CAEs of similar sized audit groups. We frequently compared internal activities, processes, functions, or operations. I relied on benchmarking to facilitate improvements of my shop and to accelerate change, using tested and proven practices and identifying areas for improvement. Some of the objectives of benchmarking are to examine performance across organizations and industries in search of practices that are new or innovative. It also can be useful for involving process owners or for convincing skeptics of the need for change.

Strategy #4: Drive Efficiency through Process Improvement

Some of the biggest impediments to internal audit productivity are our own ineffective and inefficient processes. Large audit staffs can afford a certain amount of inefficiency. Small shops cannot. The advent of “Agile Auditing” has helped, but as a profession, we still have quite a bit of work to do in this area – particularly in the use of technology. Despite the fact that we are experts in reviewing operations, quality reviews often indicate that internal audit organizations can improve processes for planning (both annual and at the engagement level), conducting engagements, documenting results, reporting results, monitoring results, and for quality controls.

In my new seminar, “Auditing at the Speed of Risk,” I spend half of the classroom time focusing on how internal auditors can plan, conduct and report the results of internal audits at the “speed of risk.” As advocates for efficiency and effectiveness in our organizations, we must practice what we preach.

Strategy #5: Measure Results to Drive Impact
A major key to ensuring a big impact is simply to measure our own performance. By keeping track of measures such as return on investment, audit cycle time, customer satisfaction, and the percentage of our recommendations that have been implemented successfully, we can measure how well we are doing at meeting our goals.

As internal auditors, we expect operational management to measure their results, yet we often fail to take the same actions ourselves. When was the last time you looked at all the costs of completing an engagement — not just internal audit’s personnel and travel costs, but also the costs to operating personnel in terms of time for interviews, walk-throughs, and report reviews? If you look at the total costs from management’s perspective, were your audits a good value? Each individual audit report may or may not have a big impact, but at a minimum your audit plans should demonstrate value relative to costs. If internal audit is not generating more value than it consumes, it is time to re-think the audit planning process with a keen eye for value-per-dollar-spent.

Strategy #6: Deliver More Than Assurance

The events of the past two decades have reinforced the fact that risk management and controls are important. But value-added advisory engagements such as assessment services, facilitation services, and remediation services also can add value and improve an organization’s operations in a big way. Advisory engagements are likely to be high impact because they generally are the result of management requests for needed services such as counsel, advice, facilitation, process design, and training.

Internal auditors are a repository of institutional knowledge about risk and controls in their organizations. Yet, we often keep that knowledge to ourselves unless it’s needed in an assurance engagement. Studies have repeatedly shown that management values advise as much (if not more than) assurance. So, impart the knowledge you have at every chance you get.

These Strategies Are Universal
Looking back on my experiences in leading small audit shops, I am reminded that the most memorable successes came about not as a result of my team working harder, but as a result of their working smarter. One of the keys to working smarter is to focus our activities where they can have the greatest impact. Remember: You don’t have to be big to generate a big impact. Each of the above strategies can help any audit organization — even the smallest internal audit shop — identify areas where we can increase our impact. And isn’t that what we all want? After all, the opportunities to bring about positive change and create value lie at the heart of our profession.