While internal auditing has been considerably strengthened in most jurisdictions in the last decade, auditors must continue to look to the future and consider how they can deliver even more value to their organizations, helping them innovate and perform better. In today’s fast-changing environment, public managers are asked to become more innovative, to meet higher standards of accountability and to deliver better value, often with fewer resources. This demanding environment is also challenging internal auditors. As the public sector seeks to make the most of its internal auditors in the years ahead, what kind of choices should be considered? What can be done to help internal auditors deliver even more value in the future?
At the request of the Government Internal Auditors’ Council of Canada (GIACC), my colleague Catherine Liston-Heyes and I recently completed a study on these questions. We reviewed the academic and professional literature, conducted a national survey of public sector internal auditors, and talked to more than fifty chief audit executives, audit committee members and executives with program responsibilities. This work was recently published in a report entitled The internal auditor as an agent of organizational learning: Enhancing the value of internal auditing in the public sector. Here are some of our findings.
Comfort and learning are the backbone of internal auditing value
Internal auditing essentially delivers value in two ways: (1) it provides comfort and reassurance, mainly to the most senior officials, about the good stewardship of organizational resources, acting as a review and accountability function and (2) it fosters organizational learning about how to improve management controls, governance processes and risk management through a range of audit and advisory services that are particularly beneficial to managers and executives involved in operations.
While it is more common to think about the contribution of internal auditing to accountability, its role in organizational learning is equally important and public organizations should pay more attention to it. In fact, while the provision of reassurance remains essential, our study found that the elements of audit services that are currently considered to be of best value by most auditors, chief audit executives and non-audit executives are those more closely associated with organizational learning. Remarkably, improving internal auditors’ contribution to organizational learning is the most promising way to enhance the value of internal auditing to the public sector in the future.
Improving the value of internal audit services
To help their auditors deliver more learning value, many organizations should consider changes to current audit policies and practices. Depending on their circumstances, organizations will undoubtedly need to make different choices to improve their auditors’ contribution to organizational learning. There is no single way forward. But here are a few areas where our study identified real potential for value-adding changes.
1. Expanding the use of advisory services
63% of our survey respondents believe that they could contribute more to their organization if they offered more advisory services. Only 34% said that assurance services could offer more value than advisory services. In fact, most of our interviewees pointed out that, through advisory services, auditors can provide timelier – and thereby relevant — assistance to managers and that there is significant value in helping prevent future problems, particularly through some judicious advice on key transformation projects. Unfortunately, in some jurisdictions, auditors thought that internal guidance excessively restricted the provision of advisory services, precluding a better balance of assurance and advisory services.
2. Improving the communication of audit findings
Ineffective communication, especially through formal audit reports, was also widely believed to be an area needing improvement. Effective communication is essential to ensure that auditees learn from audit results and use them to improve their practice. At the moment, some organizations used standardized formats that can be highly constraining and require long writing and vetting processes that consume a lot of audit resources and hinder auditors’ ability to provide timely feedback.
These organizations should consider moving to shorter and more strategic audit reports, with fewer and less prescriptive recommendations focused on core issues. Internal auditors should also be encouraged to experiment with alternative, more dynamic methods of communication, more likely to effectively convey key messages to busy managers and executives in a convincing and timely manner.
3. Improving auditors’ knowledge of operations
Auditors and executives agreed that in-depth knowledge of the auditee’s business is one of the most important factors that can enhance the value of services offered by audit teams. However, such knowledge is difficult to acquire for those outside of operations. More creative human resource management could help in this regard. 77% of our survey respondents said that acquiring experience in non-audit roles would help them deliver more value as internal auditors. In this perspective, internal audit units should consider the use of rotational assignments to help auditors spend time in operations. Conversely, the temporary assignment of non-auditors to audit teams to support specific projects could also help in some cases.
4. Leveraging audit findings to deliver enterprise-wide improvements
By conducting audits across their organization, auditors are in a unique position to gather intelligence about common weaknesses and particular best practices. At the moment, this unique intelligence is rarely fully exploited because audit engagements are typically approached as separate projects. To maximize the value of their services, audit units should ensure that they systematically leverage the findings of audits for the benefit of the entire organization. For example, audit units or central agencies should consider systematically reviewing audit reports for lessons (e.g. common weaknesses or best practices) that would benefit managers across their organization or even the entire public service and share these lessons widely to allow programs that have not been audited to learn from others’ experience. Similarly, when common weaknesses are found, auditors should try to initiate and help develop enterprise-wide corrective measures or even offer training to managers to help prevent future problems in those key areas.
5. Expanding the role of internal auditing in enterprise-wide risk management
Poor risk management, excessive process and risk aversion are problems in many public organizations. As specialists in risk management and the smart use of internal controls, auditors are well positioned to help improve risk management practices. Yet, at the moment, only 62% of auditors feel that they have a clear role in supporting risk management.
To enhance their contribution to risk management, auditors must go beyond simply auditing their organization’s enterprise-wide risk management (ERM) framework: they must actively contribute to the adoption of more sophisticated approaches to risk management by managers. More services could be provided to help managers better understand their risks (e.g. teaching or facilitating risk self-assessment exercises), craft good risk management strategies and make a more measured, judicious use of internal controls. In many organizations, better collaboration between auditing, controller and enterprise-risk management functions would help promote a more sensible, enterprise-wide approach to risk management.
6. Engaging in a more concerted effort to expand the use of data analytics
We found very strong agreement that greater use of data analytics by auditors could lead to higher value services in the future. From continuous auditing and the automation of procedures to the power of analytics to deliver deeper insights, executives saw great potential in those techniques. Similarly, 75% of auditors said that additional training in the field would enhance their capacity to add value to their organization.
However, to capture this potential, internal audit units will need to engage, sometime in partnership with central agencies, in more concerted efforts to overcome problems of data management and lack of qualified personnel. The central pooling of technical expertise should be considered in some organizations. Moreover, concerted efforts must be made to further teach the potential of these techniques across the entire community, including with executives and auditors who will never acquire these technical skills. Deploying data analytics to good effect is not merely a technical challenge, but also a cultural one as it first requires entire audit teams to think differently about the use of data in auditing.
Internal auditors play a valuable role for the public sector by providing an important line of defence against fraud, mismanagement and poor stewardship of resources. We are certainly not advocating abandoning or weakening this role. But a good defence must also proactively support the capacity of its team to perform. Moreover, by enhancing its capacity to help managers learn from current weaknesses and state-of-the-art practices, auditors will further strengthen their organization’s defensive capacity and help prevent future problems.
Today’s internal auditors can play an important role in facilitating organizational learning and even supporting successful innovation across the public sector. However, to fulfill this potential, more attention must be paid to the ways in which auditors can more effectively collect, analyse and distribute relevant knowledge and know-how across their organization. We need to think about internal auditors as agents of organizational learning and help them better play this part of their role across the public sector.
Luc Juillet is Associate Professor in the department of Public and International Affairs at the University of Ottawa.
