Generating a Big Impact With a Small Audit Staff – Part II

In my last blog post I discussed how often CAEs of small audit shops lament about the challenges of working with limited resources, and I expanded on three of six strategies I recommend for generating a “big impact” with a small staff. I’ve talked about the impact you can make by following the risk, leveraging the resources you do have, and benchmarking your success. But there are three more strategies that I’ve found can mean the difference between just another audit and making a lasting difference for the organization and a lasting impression on your stakeholders.​

Strategy #4: Improve Internal Audit Processes
Some of the biggest impediments to internal audit productivity are ineffective and inefficient processes. Large audit staffs can afford a certain amount of inefficiency. Small shops cannot. As a profession, we still have quite a bit of work to do in this area: Despite the fact that we are experts in reviewing operations, quality reviews often indicate that internal audit organizations can improve processes for planning (both annual and at the engagement level), conducting engagements, documenting results, reporting results, monitoring results, and for quality controls.

One common objective is to reduce engagement cycle time, or the time required to complete an audit. During the past century, delivery of news information has progressed from monthly, to weekly, to daily, to hourly, to the present, when news is delivered instantly to your cell phone or desk. Our customers are becoming conditioned to speed, but unfortunately, internal auditing has not kept pace.

Timeliness is a journey that begins with the survey phase and includes planning and fieldwork, concluding with the final report. Some of the reasons for long cycle time include an extensive survey phase, scope or objectives that are too broad (or that grow over time), poor plans, inefficient methodology, uncooperative activity personnel, limited expertise, staffing constraints, excessive evidence/workpapers, delays in writing draft reports, an inefficient editing process, untimely supervisory reviews or quality assurance processes, extensive legal reviews, delays in receiving final approval for release of draft reports, delays by activity personnel in providing a response, or delays in resolving disagreements.

Unfortunately the consequences of long cycle time can be disastrous: poor customer satisfaction, out-of-date audit results, diminished value of products, or even diminished value of the audit organization itself. In internal auditing, the work never stops, so it’s important to remember to wind up older projects before the audit information can become stale.

Strategy #5: Measure Results
A major key to ensuring a big impact is simply to measure our own performance. By keeping track of measures such as return on investment, cycle time, customer satisfaction, and the percentage of our recommendations that have been implemented successfully, we can measure how well we are doing at meeting our goals.

As internal auditors, we expect operational management to measure their results, yet we often fail to take the same actions ourselves. When was the last time you looked at all the costs of doing an audit — not just internal audit’s personnel and travel costs, but also the costs to operating personnel in terms of time for interviews, walk-throughs, and report reviews? If you look at the total costs from management’s perspective, were your audits a good value? Each individual audit report may or may not have a big impact, but at a minimum your audit plans should demonstrate value relative to costs. If internal audit is not a good value, it is time to re-think the audit planning process with a keen eye for value-per-dollar-spent.

Strategy #6: Advisory or Consulting Engagements Can Be “High Impact” Too 
The events of the past decade — Enron, WorldCom, Sarbanes-Oxley, and the global financial crisis, among others — have enhanced recognition of the fact that financial controls are important. But value-added consulting engagements such as assessment services, facilitation services, and remediation services also can add value and improve an organization’s operations in a big way. Consulting engagements are likely to be high impact because they generally are the result of management requests for needed services such as counsel, advice, facilitation, process design, and training.

Assessment engagements are those in which the auditor examines/evaluates a past, present, or future aspect of operations and renders information to assist management in making decisions. Examples of these engagements include assessing the risk of a physical security breach, evaluating a proposed reorganization plan, assessing proposed internal controls, or estimating total costs of decentralized acquisition.

Facilitation services are those in which auditors assist management in examining organizational performance for the purpose of promoting change. In a facilitation role, auditors do not “judge” performance. Instead, we guide management in identifying organizational strengths and opportunities for improvement. Examples include strategic planning support, business process reengineering support, benchmarking, performance measurement, and control self-assessment.

Remediation services are those in which the auditor assumes a direct role designed to prevent or remediate known or suspected problems on behalf of a client. Examples include developing and delivering training courses, reviewing or drafting proposed policies or systems, and augmenting operating personnel.

These Strategies Are Universal
Looking back on my experiences in leading small audit shops, I am reminded that the most memorable successes came about not as a result of my team working harder, but as a result of their working smarter. One of the key ways we can work smarter is to focus our activities where they can have the greatest impact. Remember: You don’t have to be big to generate a big impact. Each of the above strategies can help any audit organization — even the smallest internal audit shop — identify areas where we can increase our impact. And isn’t that what we all want? After all, the opportunity to bring about positive change lies at the heart of our profession.