Professional Services+ Collaborative
Looking Forward: 3 Tips for Strategic Value with Internal Audit
October 6, 2023
Article | September 27, 2023
Many middle market organizations use internal audit only as a project-level reporting function. They focus on analyzing past activity to manage governance, risk, and compliance, but that fails to come close to reaping internal audit’s full value.
Looking back critically at data is certainly important and a crucial part of internal audit’s value, but when the information and insights gleaned by internal audit are used proactively, they can drive strategic value across the entire enterprise. Forward-looking organizations leverage internal audit as an opportunity to evaluate the effectiveness of resources, then turn those insights into greater success.
This brief offers up some of the ways that internal audit benefits forward-thinking companies, as well as tips for communicating its strategic value to various stakeholders.
"Historically, when folks think about internal audit, it’s been very compliance-focused. Now what we’re seeing is those internal audit functions really trying to be more strategic and aligned with the overall organizational strategy. Internal audit needs to deliver value while still maintaining independence. The question now is how can we be more proactive versus reactive?"
Katie Landy, Risk consulting principal, RSM US LLP
1. Advising implementations
One way for internal audit to add value to a company’s growth and strategy is to be engaged in the early stages of an organization’s new initiatives. Whether it’s a system implementation, a process implementation or another project where internal audit might not typically be brought in until later, engaging internal audit at the front end adds outside knowledge and guidance while the implementation is still ongoing.
This sort of engagement may not result in an audit report, but the material value is in internal audit assessing and analyzing the initiative while it’s still fluid and changeable. A typical internal audit might come in at the end of an implementation and then report on errors in compliance, etc. But by partnering with project management at the beginning, it’s much more proactive. The shift helps an organization going forward rather than solely looking at transactions that occurred in the past.
Internal audit tip #1
As part of your annual audit plan, make sure your internal audit team is able to select and work on organizational projects in the early stages of implementation.
2. Prioritizing risks
Internal audit can benefit by leveraging enterprise risk management (ERM) information in the internal audit plan, which is crucial for enhancing the effectiveness and efficiency of the audit function. By integrating ERM data into the internal audit process, auditors can focus on high-priority areas and align their efforts with the organization’s strategic objectives. This also provides an opportunity for the internal audit group to provide high-level, comprehensive retrospectives to audit committee and management, detailing how these key risks and opportunities are managed.
Using the organization’s stated key risks and opportunities as a lens in the annual internal audit planning process ensures internal audit is involved in reviewing key areas during the year. Rather than simply engaging the internal audit team to perform audits of those key risks, there’s forward-looking value in including them in the inception and analysis of those key areas. An internal audit team’s unique insight allows it to assess which risks are being mitigated from year to year (and thus might be de-prioritized) and which remain top concerns (and thus should get greater attention going forward).
Internal audit tip #2
Include your internal audit team in the discussion of your key risks and opportunities and leverage their assessments to focus your resources on the activities that target the highest risks.
3. Assisting acquisitions
A third way that internal audit can add forward-looking value is by assisting organizations with acquisitions. The understanding and skills that an internal audit team brings to an audit can be very valuable to an acquisition team conducting due diligence. Internal audit can essentially conduct an audit or risk analysis of the prospective acquisition to provide additional perspective as an organization.
Likewise, internal audit is an ideal contributor to the back end of an acquisition, especially when positioned to be part of the review team that goes through and makes sure the newly acquired business is functioning as expected. Whether it’s financial, supply chain, IT or any other specific area, the internal audit team can bring on resources with outside knowledge that’s usually contained within internal audit. It’s another powerful way to add value to an organization looking forward down the road and not merely looking in internal audit’s typical rearview mirror.
Internal audit tip #3
Bring internal audit onto your acquisitions team and engage them to run analyses of potential acquisitions, as well as assessments of recently acquired companies.
Conclusion
Many middle market organizations see internal audit serving one function in their enterprise. Yet it can add so much more value. From including internal audit early in implementations to leveraging its command of prospective acquisitions, forward-looking organizations can get more from internal audit than simply backward-looking audits.
This article was written by RSM US LLP and originally appeared on 2023-09-27. Reprinted with permission from RSM US LLP.
© 2024 RSM US LLP. All rights reserved.
https://rsmus.com/insights/services/risk-fraud-cybersecurity/looking-forward-3-tips-for-strategic-value-with-internal-audit.html
RSM US LLP is a limited liability partnership and the U.S. member firm of RSM International, a global network of independent assurance, tax and consulting firms. The member firms of RSM International collaborate to provide services to global clients, but are separate and distinct legal entities that cannot obligate each other. Each member firm is responsible only for its own acts and omissions, and not those of any other party. Visit rsmus.com/about for more information regarding RSM US LLP and RSM International.
