Auditing What Matters Most

Internal auditors can add value by selecting audits that contribute to achievement of strategic objectives.

​Organizations exist to provide value for their stakeholders, and increasing that value requires businesses to accept appropriate risks. But which risks? And how much uncertainty is too much? To make those decisions, management must evaluate and balance growth opportunities, goals, related risks, and effective deployment of resources, while never taking their eyes off the strategy and enterprise objectives.

Clearly, internal audit has an important role to play in this process. Yet some internal auditors are torn between performing traditional internal audit activities — the time-honored “tick and tie” procedures — and activities that contribute more directly to value creation. “Both those activities are important,” says Larry Baker, a senior leader in internal audit, enterprise risk management, and strategic planning in Oklahoma City. “Even when management is convinced the organization is doing everything possible to ensure that a process is working effectively, internal audit still needs to do an independent audit of the controls that make management feel so comfortable.”

However, in any business, time and resources are limited, and internal auditors who wish to serve as trusted advisors to the organization must ensure their efforts provide maximum return on investment. Priorities must be set. For some internal auditors, the act of prioritization may necessitate a fresh look at what matters most to the business. 

Identifying the “Right” Risks
Bill Watts, partner at Crowe Horwath in Columbus, Ohio, recalls a time more than a decade ago when the approach to determining what to audit was not as thoughtful as it is today. Audits tended to be very structured and repeatable. Then came the U.S. Sarbanes-Oxley Act of 2002, which indirectly caused companies to re-examine their control structures and how to improve controls, leading to evolution in other areas. “Internal auditors today must think more broadly, across the enterprise,” he notes. “Where is the company strategy focused, what are the major initiatives, and where is the money being spent? Those answers tell you what’s important to the entity, and that’s where internal audit should focus.” 

Read the complete article at iaonline.theiia.org