Flipping the script on internal audit

Imagine you mysteriously awaken on an unfamiliar boat in an unknown location. There are others onboard with you, but they’re equally confused about the situation. In an effort to clarify your shared predicament and determine a path forward, you realize … you need some information.

But what information is most critical? And which questions should you ask (and to whom) to gather such information? In short — where do you start?

However tempting it may be, it wouldn’t prove helpful to jump right into a bevy of logistical or technical considerations (how big the boat is, whether the anchor is stored, what changes you could make to maximize your fuel efficiency and so forth). These questions — and their answers — are undoubtedly important. But beginning with what and how is a lot like deciding between a hammer and nails or a welding torch before you know what you’re trying to build.

Instead, it may be best to begin with deeper and more fundamental questions (who is onboard, where are we headed, are there more optimal routes or destinations given our current situation, etc.). Asking these identifying questions first provides a foundation from which you may then explore the implication questions (like first knowing what you’re trying to build, then deciding the best tools and techniques for the job).

A real-world approach

Similarly, in the incredibly complex world of internal audit, it’s even more important than ever to flip the script with the questions you’re asking to first consider the who, why and where of your internal audit function and then turn the page to better explore the what and how.

As internal audit functions genuinely look to improve and drive more value, they often begin by considering what they should change within their operations or how they can perform more effectively and efficiently. While these questions are important and can help move the needle, they sometimes lead to misaligned ends (like the hammer v. torch scenario above). By contrast, starting the process with questions that help an internal audit function understand who they are, why they are a function and where they are meant to focus is paramount to ensuring long-term success and direction while establishing and maintaining their identity within the organization. When internal audit functions (especially those that strive to be leaders in the industry) guide their organization to prioritize deeper, more fundamental questions first, they encourage and equip their team to collectively pursue greater understanding and unity when eventually considering the more technical questions.

To accomplish this mindset shift, internal audit functions may consider challenging themselves to think about the following questions:

• Are we having a meaningful impact and driving value in the way the company defines value? (What are we impacting?)
• Are we fostering relationships and influencing stakeholders across all levels in the organization? (Who are we engaging with?)
• Do we have credibility to play a role across different dimensions of the organization, or are we limited? (Where do we have permission to engage?)
• Are we at the table providing a forward-looking perspective when decisions are being made — or are we only brought in to audit retroactively? (When do we play our role?)

If the answer to any of the above questions is no, the follow-up needs to be: why? These types of purpose and identity questions will help reveal limitations that need to be addressed through the more practical how questions that follow.

How might this play out?

For example, by first asking such identity questions you discover that your function is limited to financial and IT risks because you lack the expertise to effectively engage the business outside those areas. This might seem to be a setback at first. However, this realization has successfully prevented you from immediately diving into the nuts and bolts of situations outside your scope and equipped you with the knowledge of a gap you must address. You can now move forward with a much more targeted and necessary implication question — how do we expand access to whatever expertise we currently lack so that we deepen our credibility within the business?

It may seem a subtle shift, but a critical assessment of these identity-based considerations quickly helps uncover strengths that are positively contributing to the function as well as shortcomings that are detracting. Answers to the identity questions outlined above may, in turn, help guide internal audit functions in their answers to the implication questions that many often start with — those focused on enhancing talent, improving processes and maximizing the benefit of technology. Such questions include:

• Does our operating model allow us to meet the changing needs of the company while building a diverse and intellectually curious team?
• Is our methodology flexible and does it cover the wide range of innovative services (assurance and advisory-focused) necessary to effectively address complex risk areas?
• How well are we infusing technology and analytics throughout the internal audit lifecycle to accurately assess and report on the risk landscape and internal controls environment?

Each question above can be challenging to tackle and will likely elicit varying responses from those in the function. And yet each question is critical to an internal audit’s eventual success. Just as critical, however, is the sequence in which these questions are asked.

Determine first your boat’s destination, then ensure you’ve set an appropriate course and have adequate talent and resources to arrive as desired.

Similarly, determine first your company’s purpose and priority, then ensure you've set an appropriate course for your internal audit function and have adequate talent and resources to operate as desired.

So, where do you go from here?

Flipping the script of your internal audit approach isn’t easy. It’s rarely the natural response. It’s far more common to first focus on the tangible, bite-sized components. In pursuit of practical, effective solutions, it’s easier to ask, “What can we change?” or, “Is there some tool we can better utilize?” rather than, “How does our purpose align with our role?” or, “Where are we trying to lead this effort?” But we’ve successfully navigated these waters time and time again and we know the way forward. Let’s go there — together.

Whether you are building an internal audit function or looking to take your function to the next level, Baker Tilly can help you answer these big-ticket questions.