This is the second in a series of articles on value. This article will focus on detailing where internal audit can find value.
All engagements are not created equal. Or said another way, you can attain much more value from some types of engagements than others. So what are the core drivers of value in an audit? Or said another way, “Where’s the Beef?”
As in this classic commercial, I know I’ve spent more time during my career than I’d care to admit selling a big bun. All along knowing I could do more with the talent and resources we had. We had more beef to offer, we just needed an opportunity to sell it.
Before I get to how to sell our services, it is worth discussing the various services Internal Audit typically provides. I break them into six types:
- Recovery Work
- Reliance Activities
- Cycle Audits
- Risk-based Audits
- Management Requests/Consulting
- Strategic Audits
As you move down that list, you have ever more opportunity to add value, but it is also more difficult to measure that value directly. The table below summarizes the ease of measurement, the relative value to the organization and examples of each type of Internal Audit services:
|Level||Type of Activity||Value Measurement||Relative Value||Examples|
|1||Recovery||Very Easy||Low||Duplicate payments, overbilling|
|2||Reliance||Easy||Low||SOX 404, inventory counts, external audit procedures|
|3||Cycled Audit||Moderate||Moderate||Expense reporting, credit card usage|
|4||Risked Audit||Moderate||High||Information security, FCPA|
|5||Management Request||Difficult||Very High||Systems pre-implementation, M&A due diligence|
|6||Strategic||Very Difficult||Extremely High||Long-range plan assumptions, planning model management|
You may disagree with me somewhat on my classifications, but I’m fairly certain you want your department’s resources more focused on the last three than the first three. Like me, you may have had to battle to move up the levels and still haven’t reached your potential. So, how do we get our function properly allocated across the spectrum?
In one word – TRUST.
Our stakeholders have to trust us or they will not give us a seat at the table. Even when we have that seat, we may not be a “voting member.” Full trust comes after we:
- Demonstrate the capacity to staff and manage the engagements outside our traditional reach;
- Effectively communicate and persuade the stakeholders there is value to be gained by our involvement; and
- Deliver results.