From Where and How you start sets the tone for where you end. This stands true for the success of Internal Audit functions while considering Audit planning as a starting point.
In our Internal Audit Management Solution, abilite the starting point in the audit planning process is identifying the business objectives under strategic, operations, reporting, and compliance domains. Once that is done, risk assessment is performed against the objectives and finally, you determine the areas that need to be audited for the year.
This is how we believe the Audit Planning process should commence, but not many Internal Audit functions to whom we had the privilege of providing a walkthrough of our solution, follow this approach
Hence, to have a broader view, a survey was conducted couple of weeks ago in which 572 Internal Audit professionals from across the globe participated and a majority (60%) was of the view that they take Business Objectives as a starting point in Audit Planning process followed by processes (29%) and departments (11%).
While the results are very encouraging, it is important to identify the rationale behind taking business objectives as a starting point and challenges Internal Auditors may face in following that route.
There could be different ways to analyze but if we go through the definition of Governing Body as given in the latest IIA 3 Lines Model, things will become clear. IIA defines Governing Body as:
“Those individuals who are accountable to stakeholders for the success of the organization”.
We know that Internal Auditors are reporting to the same body. The question that then begs our attention is; can Internal Auditors start their work without knowing what matters for the success of an organization, i.e., the business objectives, or looking at it from a different angle, can they afford to spend time and effort on areas which do not matter to the success of an organization.
A prominent theme emerged during the poll was that we should consider all three at tandem i.e., Objectives, processes and departments, which I believe would not be the right approach. You start with the objectives, identify the processes that support those objectives and then touch base the departments through which the processes flow but merely selecting any department or process because it was not audited in the last year or so would not be the right approach.
One may say that for example a section of an admin department providing support to employees may not come under radar if we only consider objectives at an organizational level. This is also not true. Objective of an organization for the year under consideration may be “Enhance Employee Engagement”. You may determine that one of the factors amongst many others impacting engagement is how the employees are provided support by the “Admin” and naturally it would then become important to review the underlying processes.
Consider the example of Business Objective (BO) “Expansion through awarding new franchises” for seeing as to how starting from BO helps to connect all the dots. It will facilitate in taking into consideration all the processes that flows within say Commercial, Legal, Finance & Quality Assurance etc., hence not even a small leg in the entire value chain will have a chance to be missed out which is critical for achieving the business objective. Taking business process as a first step – would result in doing something that does not matter in achieving the business objectives – or departments would end up overlooking an important piece in the puzzle.
Second poll in the series was related to the challenges that one may face when envisioning to start from the business objectives. Though the participation was very low this time but it was almost evenly split between “BO not documented” and All of the Above”
We will touch base on these challenges in our next brief.