From Good to Great: Strategic Planning Can Define an Internal Audit Function

When you compare internal audit functions, you can expect to find quite a few differences. High-performing departments stand apart in their mindset and how they approach their work. They grasp the importance of delivering value, and they are seen by stakeholders as an indispensable resource. They deploy a knowledge-management platform, use automated tools, and train their employees differently. But there’s one trait that distinguishes the best internal audit functions from the pack: A commitment to comprehensive strategic planning.

It’s not that internal audit departments don’t plan out their activities. These days, almost everyone creates a risk-based plan at least annually, and they update it throughout the year based on new information. However, surprisingly few build comprehensive strategic planning into their schedules.

The best internal audit departments understand that both types of planning are necessary: As I tweeted recently, “A risk-based annual plan will guide internal audit activities throughout the year, while a strategic plan will act as a guide beyond the horizon.”

Strategic planning is an excellent way for internal audit to identify, produce, and assess the value it should be delivering to its stakeholders. I believe that, by taking a systematic and disciplined approach such as the seven-step process contained in IIA practice guidance, we can help ensure internal audit is moving in the right direction. Those steps:

1. Understand the relevant industry(ies) and the organization’s objectives.
2. Consider the International Professional Practices Framework standards and guidance.
3. Understand stakeholder expectations.
4. Update the internal audit vision and mission.
5. Define the critical success factors.
6. Perform a SWOT analysis.
7. Identify key initiatives.

It’s easy to define the steps that should be included in a strategic plan, but it’s not so easy to guarantee positive results. Fortunately, successful strategic planning is rarely a matter of luck. Like many internal audit activities, the best strategic plans are those produced by hard work and a fierce commitment to success by everyone in the organization.

It’s essential to pursue each step of a strategic plan rigorously. To “understand an organization’s objectives,” for example, it’s not enough to obtain a copy of its most recent written objectives. We must also understand the unwritten objectives of the enterprise we serve, as well as its strategic plan, budget, technology, and other assets. In comprehensive strategic planning for internal audit, all parts of the process are important. But perhaps the most important is how the planning aligns with the overarching goals of the enterprise. Much of the analysis done in strategic planning is to help develop achievable goals that reflect business realities.

To be effective, the strategic planning process must go beyond development of high-level goals and priorities. That’s because, to effectively implement the plan, those high-level statements must be translated into detailed plans or policies that are understood and implemented throughout the internal audit function.

A clearer vision of the future is only the starting point for positive change. Not only must we develop strategic foresight, we must help establish a framework and culture for converting that foresight into action.

As I said, effective strategic planning is not easy. It takes a significant investment of time and resources. But I believe that development of a formal, documented strategic plan is essential to developing a fully effective internal audit function. It also is a hallmark of leading internal audit departments because comprehensive strategic plans can serve as a blueprint for quantum improvement.

If you have not incorporated strategic planning into your overall planning activities, consider reviewing The IIA’s Practice Guide: Developing the Internal Audit Strategic Plan. It is an important part of The IIA’s strongly recommended guidance, and is available at no cost to IIA members.