In today's world, there is growing demand on internal auditors to visibly demonstrate their contributions toward achieving organizational objectives. Auditors need to serve as key partners to the board and management in identifying challenges that may hamper achievement of those objectives, as well as helping uncover constraints to seize emerging opportunities. Such efforts are achieved by performing focused, independent, objective assurance and consulting activities that align with the organization's strategy and priorities.
One key performance indicator (KPI) for internal auditing's success in these areas is the number of audits completed or audit issues raised. However, it is less common to see the number of corrective actions taken by the organization used as a KPI, possibly because internal auditors lack control over implementing these actions. The audit report, then, typically constitutes the last point of influence over an area under review.
And while audit reports tend to comprise the main outputs for internal audit work, it is difficult to gauge their impact until corrective actions are implemented satisfactorily and any risks identified are mitigated. In effect, unless internal audit results are converted into action, it is challenging to clearly demonstrate internal audit's contributions toward achieving organizational objectives. Accordingly, internal auditors should be more involved in helping organizations implement proposed corrective actions originating from their work. Five steps can help practitioners play a more proactive role in facilitating effective implementation, while still maintaining their independence.
1. Categorize audit issues to make them suitable for action. If audit issues are grouped in a systematic manner, management can more easily perform holistic analysis and take corrective actions. For instance, audit observations can be categorized into strategic, policy, compliance, process, IT, human resource, and financial issues. Each category has a different audience requiring different responses and attention. Normally, strategic and policy issues are best addressed by the board and top management, whereas the responsibility for compliance and process issues leans toward mid-level operational management.
2. Rate audit issues based on operational impact. Audit issues can be rated as high, medium, or low depending on risks associated with business objectives. Audit issues rated as high risk could be significant, drawing the attention of top management, compared to medium or low risks. High ratings could also help attract a sense of urgency in view of organizational impact.
3. Develop a robust audit issue tracking system. IIA Standard 2500: Monitoring Progress states that "the chief audit executive must establish and maintain a system to monitor the disposition of results communicated to management." Collective involvement of both internal auditors and management in designing and implementing such a system would enhance system effectiveness and ownership. The system could maintain features such as the ability to integrate with the audit system in use and access each proposed corrective action; accessibility to audit clients with a view to regularly update actions taken; and the capacity to analyze progress by status of actions (implemented, in-progress, not implemented), risk category (strategic, policy, compliance, processes), risk rate (high, medium, low), and business unit. Moreover, the system needs to be designed to allow aging analyses of pending corrective actions (e.g., those within the due date, or overdue by 3 months, 6 months, and 12 months or more).
4. Allocate sufficient resources for continuous support and counseling. Internal auditors, working with the business, are optimally positioned to assess the organizational impact of audit issues and identify any systemic challenges affecting implementation. Thus, they can provide advice on how pending corrective actions would best be addressed. Also, auditors may regularly reevaluate the relevance of the corrective action, periodically validate the adequacy of the actions taken, and provide feedback as needed.
5. Provide reports to the board and management periodically. Internal auditors need to report periodically on the status of corrective actions taken. The report may include status of implementation and outstanding actions by due date, risk category, risk rate, and business unit.
Following these steps can help develop a partnership between management and internal auditors. Perhaps more importantly, though, the process vividly demonstrates how internal auditors can help the organization accomplish its objectives. Internal auditors are encouraged to play a more proactive role toward implementing corrective actions and to help convert their audit output to concrete results.
The views and opinions expressed in this article are those of the author and do not necessarily reflect the official position of the author's employer.