9 / 32
October 2016 //
Canadian Government Executive /
9
Internal Audit
more likely to effectively convey key mes-
sages to busy managers and executives in
a convincing and timely manner.
3. Improving auditors’
knowledge of operations
Auditors and executives agreed that in-
depth knowledge of the auditee’s business
is one of the most important factors that
can enhance the value of services offered
by audit teams. However, such knowledge
is difficult to acquire for those outside of
operations. More creative human resource
management could help in this regard.
77% of our survey respondents said that
acquiring experience in non-audit roles
would help them deliver more value as
internal auditors. In this perspective, in-
ternal audit units should consider the use
of rotational assignments to help auditors
spend time in operations. Conversely, the
temporary assignment of non-auditors to
audit teams to support specific projects
could also help in some cases.
4. Leveraging audit findings
to deliver enterprise-wide
improvements
By conducting audits across their organi-
zation, auditors are in a unique position to
gather intelligence about common weak-
nesses and particular best practices. At
the moment, this unique intelligence is
rarely fully exploited because audit en-
gagements are typically approached as
separate projects. To maximize the value
of their services, audit units should ensure
that they systematically leverage the find-
ings of audits for the benefit of the entire
organization. For example, audit units or
central agencies should consider system-
atically reviewing audit reports for lessons
(e.g. common weaknesses or best practic-
es) that would benefit managers across
their organization or even the entire pub-
lic service and share these lessons widely
to allow programs that have not been
audited to learn from others’ experience.
Similarly, when common weaknesses are
found, auditors should try to initiate and
help develop enterprise-wide corrective
measures or even offer training to man-
agers to help prevent future problems in
those key areas.
5. Expanding the role
of internal auditing in
enterprise-wide risk
management
Poor risk management, excessive process
and risk aversion are problems in many
public organizations. As specialists in risk
management and the smart use of internal
controls, auditors are well positioned to
help improve risk management practices.
Yet, at the moment, only 62% of auditors
feel that they have a clear role in support-
ing risk management.
To enhance their contribution to risk
management, auditors must go beyond
simply auditing their organization’s en-
terprise-wide risk management (ERM)
framework: they must actively contribute
to the adoption of more sophisticated ap-
proaches to risk management by manag-
ers. More services could be provided to
help managers better understand their
risks (e.g. teaching or facilitating risk self-
assessment exercises), craft good risk man-
agement strategies and make a more mea-
sured, judicious use of internal controls. In
many organizations, better collaboration
between auditing, controller and enter-
prise-risk management functions would
help promote a more sensible, enterprise-
wide approach to risk management.
6. Engaging in a more
concerted effort to expand
the use of data analytics
We found very strong agreement that
greater use of data analytics by auditors
could lead to higher value services in the
future. From continuous auditing and the
automation of procedures to the power of
analytics to deliver deeper insights, ex-
ecutives saw great potential in those tech-
niques. Similarly, 75% of auditors said that
additional training in the field would en-
hance their capacity to add value to their
organization.
However, to capture this potential, inter-
nal audit units will need to engage, some-
time in partnership with central agencies,
in more concerted efforts to overcome
problems of data management and lack of
qualified personnel. The central pooling of
technical expertise should be considered
in some organizations. Moreover, concert-
ed efforts must be made to further teach
the potential of these techniques across
the entire community, including with
executives and auditors who will never
acquire these technical skills. Deploying
data analytics to good effect is not merely
a technical challenge, but also a cultural
one as it first requires entire audit teams
to think differently about the use of data
in auditing.
Internal auditors play a valuable role
for the public sector by providing an im-
portant line of defence against fraud,
mismanagement and poor stewardship of
resources. We are certainly not advocating
abandoning or weakening this role. But a
good defence must also proactively sup-
port the capacity of its team to perform.
Moreover, by enhancing its capacity to
help managers learn from current weak-
nesses and state-of-the-art practices, audi-
tors will further strengthen their organiza-
tion’s defensive capacity and help prevent
future problems.
Today’s internal auditors can play an im-
portant role in facilitating organizational
learning and even supporting successful
innovation across the public sector. How-
ever, to fulfill this potential, more atten-
tion must be paid to the ways in which au-
ditors can more effectively collect, analyse
and distribute relevant knowledge and
know-how across their organization. We
need to think about internal auditors as
agents of organizational learning and help
them better play this part of their role
across the public sector.
L
uc
J
uillet
is Associate Professor in
the department of Public and Inter-
national Affairs at the University of
Ottawa.
In fact, while the provision of reassurance
remains essential, our study found that the
elements of audit services that are currently
considered to be of best value by most
auditors, chief audit executives and non-
audit executives are those more closely
associated with organizational learning.