• Blog

Thinking Like an Auditor

  • Is Your Audit Department “Highly Effective”?

    June 6, 2019 | By Toby DeRoche MBA, CIA, CCSA, CRMA, CICA, CFE

    Today's fast-paced and evolving business environment requires an internal audit to consider its capabilities and needs to ensure appropriate strategic planning. How can CAEs develop strategic plans that result in their stakeholders viewing the audit function as “highly effective”? Our research has found an approach that builds on three dimensions of effectiveness that must be addressed to be highly effective:

    • Meeting stakeholder expectations
    • Operating core processes
    • Conforming to internal audit standards and applicable regulatory requirements

    Is your audit Dept Highly Effective

    Meeting Stakeholder Expectations

    Before we can even attempt to meet stakeholder expectations, we need to understand their needs and objectives. The IIA’s global stakeholder study identified several expectations common to many organizations.

    First, stakeholders expect high-quality assurance work from the audit department. When we’re following the standards and completing an adequate review, the work we produce should always be completed with the highest rigor.

    Second, it’s critical to identify key, strategic risks and align our audit plan and audit programs to these risks. We’ve also found that senior management and audit committees expect to see reporting that addresses these strategic risks.

    Finally, business knowledge is expected. An auditor’s expertise is often said to be a mile wide and an inch thick. It is true that we need to have at least a basic understanding of nearly all common business processes, but we should also have a deeper understanding of the specifics related to our industry and organization.

    Operating Core Processes

    When evaluating our operating core processes, we should consider all aspects of the audit department. As you go through this exercise, start with the basics, the people who make up the department, and work your way out through your processes and all the tools used to support those processes.

    While not exhaustive, the core processes should include:

    • Human capital
    • Risk assessment
    • Working practices
    • Partnering
    • Knowledge management
    • Technology
    • Communications and reporting
    • Performance measurement

    Conforming to Internal Audit Standards and Applicable Regulatory Requirements

    As auditors, we should always start with the fundamentals of conformance to The Standards as a foundation for growth. Depending on the organization, these may include the IIA International Standards, Yellow Book, Green Book, or other sources of guidance. In addition to standards, we must also conform to any applicable local regulatory requirements, and specific industry regulations.

    To learn more, we invite you to download our latest thought leadership report: Strategic Planning for Internal Audit: A CAE’s Guide to Driving Value Creation.

    Download the Report

  • View Demo
    Contact Us
    Request More Information