Page 18 - ENGLISH MARCH final 2018

Audit Performance Audit Performance

By: Farah Araj and Robert Kuling plans which have no vision, mission or resources on particular goals since including internal audit. This could
organizations can’t do everything all at
actual strategy. They are simply the output
be cost cutting, diversity/gender
Improving Internal Audit of an annual internal audit plan that has once! All these elements, and more, would
empowerment, virtual offices etc.
been mapped across a 3 or 5 year period.
An organizational strategy usually answers
Performance through Strategic What this means is that some internal 5 questions which correspond to 5 major need to be addressed by the internal audit
audit departments do not exercise proper
department in the long term and as part of
elements of a strategic plan as shown in
strategic planning. The latest data from the
the internal audit strategic plan.
table 1 below.
Planning IIA’s global internal audit survey supports Strategic planning at an organizational level Developing the Internal Audit Strategic
1
this conclusion:
Plan – In Brief
usually takes place annually, although the
• Only 55% of internal audit
departments are fully aligned or almost specific objectives/strategies may or may The process (which is more of an annual
fully aligned with the strategic plan of not change depending on how well they are cycle) to develop an internal audit strategic
their organization (this drops to 42% going as an organization. plan is largely based on the same process
for the South Asia/India region).
So would internal audit strategic followed at an organizational level.
• Only 52% of Chief Audit Executives planning be any different from the above? Although CAEs may approach strategic
(CAEs) indicated that they have a Absolutely not! planning in a different way, a proposed
separate written mission statement for process is illustrated in Exhibit A.
their internal audit department. The organizational strategic plan also
impacts internal audit activities (both The starting point for any internal audit
• Only 36% of CAEs stated that they strategic plan is about understanding the
have an internal audit strategy strategic and operational). Here are 3 expectations of the key stakeholders: the
description. examples: audit committee, the CEO and senior
When analyzing the results above, one 1. Risks to Strategic Objectives: The management. These expectations differ
wonders how 55% CAEs can be fully or IIA Standards require internal audit from one company to another and
almost fully aligned with the strategic plan departments to address risks to could include expectations such as focus
of the organization when only 36% of them strategic objectives. A percentage of the on cost recoveries, assurance on key
have established an internal audit strategy. internal audit plan along with specific business processes, supporting fraud risk
audits would need to be identified and
An internal audit addressed and as part of the annual management, being a source of talent for
internal audit risk assessment and management etc. There may be multiple
strategic plan is not a planning methodology. views from stakeholders and CAEs
would need to prioritize them into “non-
series of audits over a 2. New Organizational Priorities: The negotiable” vs. “good to have” expectations.
organization may have set in motion
Understanding expectations is not a one off
3 to 5 year period! plans to expand to new countries/ exercise; this should be done regularly and
regions, to get into new business lines
preferably annually.
(or exit current business lines), have
Understanding Organizational Strategy plans to implement new systems, etc. What comes next is the understanding
Internal audit needs to ensure that it is of the current state of the internal audit
Before going into how to develop an ready to support the business through department. This could take the form of
internal audit strategic plan, we should these organizational priorities and gear an analysis of mandate, people, process
Developing a strategic internal audit would. Yet internal audit departments objectives (as defined by the organization’s take a step back and look at organizational up to have the resources to audit risks and technology or take the form of a
strategy. Simply put, a strategy is a plan put
SWOT analysis. This analysis is the core of
plan not only improves internal themselves don’t always have a strategic strategy). A strategy forms the roadmap in place to achieve a long term objective. in these new areas. any strategic plan. It will determine what
audit’s alignment to business plan, let alone a good strategic plan. for the internal audit department’s It is “big picture” thinking which gives an 3. Organization Wide Initiatives: your department needs to fix and what is
objectives, it also ensures that the Although strategic planning is not part mandate, people, processes and technology. organization a sense of direction. It helps There are organization wide capable of realistically achieving; you’ll
internal audit department remains This roadmap is what ensures that the to focus and prioritize an organization’s initiatives that impact all departments need to walk before you start running!
relevant. of the IIA’s International Professional
Practices Framework’s mandatory internal audit department remain relevant. Question Strategic Plan Element
guidance, it is part of recommended A Glimpse at the Current State of
Introduction guidance. It is one of the ways to address Internal Audit Strategic Planning 1. Where are we now? Current State Assessment
the IIA Core Principle “Aligns with the 2. Where are we going? Vision/Mission
If you were doing an audit of an Take a moment and Google “strategic
organization’s governance processes or strategies, objectives, and risks of the internal audit plan example”. What you’ll 3. How are we going to get there? Objectives, Initiatives, Activities
an audit of a subsidiary and discovered organization.” Without a strategic plan get is a mixture of guidance from the IIA
that their strategic planning process had it is difficult to demonstrate the internal and others, examples of internal audit 4. How will we know if we got there? Targets/Key Performance Indicators
significant gaps or was none existent, audit department’s alignment to the strategic plans, and naturally, irrelevant 5. How did we do? Performance Reporting
would this be an observation in your organization’s strategic plans and how they results. What is surprising at this day and
internal audit report? It most certainly are helping the organization achieve its age is the number of examples of strategic Table 1

16 INTERNAL AUDITOR - MIDDLE EAST MARCH 2018 MARCH 2018 INTERNAL AUDITOR - MIDDLE EAST 17