Five Characteristics of Impactful Internal Audit Departments

An evergreen challenge for internal auditors is how to make a real impact. Gone are the days when we could simply be value protectors who patrolled the organization looking for fraud, waste, and mismanagement. To make a true impact in 2022, we must also be change agents who are catalysis for transformational ideas that help create value for the organizations we serve.

If you occasionally have doubts about the impact of internal audit in your organization, you are not alone. A Deloitte survey not long ago found a staggering 60 percent of chief audit executives (CAEs) believed the internal audit function did not have a strong impact and influence within their organization. And, while that was bad news for internal auditors, it was actually an improvement from 72 percent in an earlier survey.

During the COVID-19 pandemic, internal audit’s impact and influence was arguably strengthened at many organizations. In The IIA’s 2022 North American Pulse of Internal Audit report, only 10 percent of CAEs rated internal audit’s COVID-19 impact as a “top 3” area of concern. But with a new risk-induced disruptive event occurring virtually every month, we still have a lot of work to do. When I saw the Deloitte survey results, I posted a question on LinkedIn asking whose fault was it if internal audit did not make a strong impact in the organization. I assumed that most would say it was the CAE’s fault. To my surprise, many responses at the time pointed to management or the board.

It’s not always easy to admit our faults, but I was dismayed to see how fast many CAEs blamed others for internal audit’s shortcomings. I recognize that, in some corporate cultures, management and the board suppress internal audit, and some have no interest in a strong and well-resourced internal audit function. However, I do not believe this represents the majority of organizations around the world.

In organizations where internal audit does not make a substantial impact or exert a strong influence, we need to acknowledge that some of our own actions contribute to the problem. I don’t want to play the blame game here, but the path to fixing a problem starts with acknowledging it. If most CAEs believe internal audit doesn’t make a big impact in their organizations, it is vital to understand why.

I have had the opportunity to visit quite a few internal audit functions over the years, often meeting with members of the audit committee and C-suite. I found that internal audit functions that are generally regarded as influential seem to share several characteristics.

1. Focusing on Critical Risks

If you aren’t focusing on the organization’s most critical risks and monitoring those that may become critical in the future, it shouldn’t come as a big surprise that you may not be making an impact. For years, internal auditors acknowledged how critical cyber risks were in their organizations, but only in the last couple of years have audit plans begun to reflect the level of risk. The same is true of environmental risks such as climate change. Acknowledging the risk is there will have little impact compared with focusing internal audit resources on the risks where appropriate.

2. Enhancing Business Expertise

Internal auditors who don’t understand the business, will never be in a strong position to offer influential advice. Imagine, for example, receiving business advice from your teenager. A teen might occasionally have helpful ideas, but you probably wouldn’t turn to him or her for counsel the next time you need to make a critical business decision. For internal auditors, having audit expertise isn’t enough: We also must cultivate a deep understanding of the business, so that we can engage in credible conversations with management and the board on business and strategic risks facing the organization. After all, internal auditors must be credible before they can be incredible.

3. Sharing Insights and Advice

Influential internal audit departments don’t simply check other people’s work or try to catch errors; they offer advice for making improvements. If your advice results in substantial savings or eliminates unnecessary expenses, for example, then you most likely will be influential. But if your internal audit report simply points out routine paperwork errors from the past, your influence is probably limited.

4. Improving Internal Audit Innovation

Multiple studies have found that internal audit groups that adopted innovative approaches and methods tended to have greater impact and influence than those that do not. More than two-thirds of the Deloitte survey respondents with strong impact and influence said they expected to increase their investment in internal audit innovation over the next three to five years, citing developments such as data analytics, robotic process automation/cognitive technologies, predictive analytics, risk anticipation, and adopting agile approaches.

5. Identifying Emerging Risks and Sharing Foresight

I will never forget the first time I pointed out an emerging risk during the course of an internal audit. My client sat up straight, opened his eyes very wide, and said, “Oh, I hadn’t thought of that.” At that moment, I knew my work was having an impact. It’s a rewarding experience for an internal auditor.

As an advocate for this profession, I am always attuned to trends and developments in internal audit. When new research is published, I am sometimes encouraged by the progress we are making. However, I am sometimes discouraged. It is an anathema that any CAE would be content to lead an internal audit function that is not seen as impactful or influential in its organization. When internal audit is not seen as impactful, it is not time to point fingers. It is time to roll up our sleeves.                                                  

There are a lot of factors that determine whether your internal audit function has a strong impact and influence. The vast majority are within your control. What are your thoughts on internal audit impact and influence? I welcome your ideas.