Internal audit departments typically are structured as centralized or decentralized. Department structure plays an influential role within the department, as well as in the business operations that are audited. Therefore, it is crucial for internal audit management to evaluate which structure is the best fit for its team and the business.
Per The IIA’s International Professional Practices Framework, an organization’s internal audit activity is required to be in conformance with the Standards. However, the Standards do not specifically address departmental structure, so the chief audit executive (CAE) can determine how the internal audit activity is set up by examining the advantages and disadvantages of both centralized and decentralized.
In a centralized audit department, management and staff work in the same location and either travel to other office locations or work remotely to conduct audits. The centralized structure offers many advantages. First, internal audit leadership works in the same office. Members of management — ranging from supervising seniors to the CAE — not only meet in-person, but, more importantly, demonstrate a consistent “tone at the top.” Also, with the entire team in the same location, any team member has access to management, which can encourage informal, in-person coaching and mentorship.
Having the team together also promotes consistency in training, both at the entry level and experienced practitioner level. Internal audit policies and procedures, such as workpaper expectations, can be communicated and compliance monitored with greater uniformity. As it relates to uniformity, a centralized department can promote more equal opportunities, such as audit project assignment. In addition, when all staff work out of the same office, more collaboration among team members can occur.
There also are disadvantages with a centralized departmental structure, such as the inevitable travel component to the job — especially at the staff and senior staff levels. For some, the opportunity to travel the world may be appealing; however, because the time spent on the road can be extensive, it may be difficult to attract and retain top talent. Although conducting audits remotely can decrease the travel commitment, there are some audits that still require on-site walkthroughs; detailed test work; and meetings that cannot be performed via email, phone, or teleconference. On-site audit fieldwork activities are valuable, as there is much to gain when working with the audit client in person. This can be a benefit not only in the current audit, but through observation and informal meetings, candid conversation about the site’s operations can highlight what’s really going on. Additionally, there is value gained when internal audit is geographically closer to the operations it audits, as continual dialogue about regional policies and practices can assist internal audit during its risk assessment and audit planning processes.
A decentralized department assigns internal audit teams in more than one location, and each team is responsible for auditing that office’s (or region’s) operations. The decentralized internal audit department also offers many advantages. First, when audits are performed at a more local level, there is increased opportunity for internal audit staff members and management to collaborate throughout the actual audits. Internal audit managers can coach employees and provide advice in a variety of areas, such as walkthrough and interview techniques and workpaper and documentation execution. Unlike the centralized structure, where managers might supervise the team remotely, staff members benefit from the in-person guidance when managers are available on-site.
Additionally, with a decentralized model, audit staff members and management are close to the business operations under review, which can help forge relationships that result in candid dialogue about risk and controls. This can prompt requests for consulting engagements and advisory reviews, which benefit both internal audit and management.
There also can be some drawbacks to using a decentralized model. First, staff members (and management) may develop expertise limited to the office and region where they work. For example, auditors can gain expertise about part of a process that occurs in their location, such as product design, but miss other process components, such as manufacturing, that help complete the full picture of the process. Specialization also can limit skill development.
Another downside to a decentralized department is that each auditor typically performs multiple audits at the same time. Unlike a centralized model, which often can incorporate travel (and therefore, each auditor is assigned one project at a time), a decentralized model assigns multiple audit projects to each auditor, which can cause scheduling problems and demand careful attention to balancing priorities and deadlines.
Once internal audit leaders weigh the structure’s impact on the department, itself, it is critical to assess how the structure aligns with the organization. Two perspectives that can be used to evaluate organizational impact are company culture and structural alignment.
Company culture is the organization’s overall environment and atmosphere. It comprises the stated policies and procedures, as well as the values and norms, both of which permeate interactions, communications, and expectations. Every culture is different, as each organization has its own history and experiences that uniquely shape how the organization makes decisions. Internal audit leaders, therefore, need to determine how the selected department structure will complement the company culture. For instance, if the overall culture encourages manager/employee collaboration as a method to effectively support and train emerging talent, then a decentralized audit department may be a good fit. Such a structure enables managers to be on-site during audits and provide in-person feedback and coaching. However, a different company may encourage a talent development model that promotes professionals as generalists (as opposed to specialists), and therefore, a centralized audit department, which permits a wider range of audit project opportunities, may be a better choice to achieve congruence with the overall culture.
The manner in which other departments are structured within the organization influences the audit department’s structure. Does the organization have satellite locations? If so, what departments reside in those offices? If there are minimal resources in other offices, then a centralized audit department structure may be a best fit. However, if the organization is experiencing rapid growth in a certain region, an internal audit leader may consider a decentralized structure; by placing dedicated resources in that region, internal audit can partner with local management and collaborate on evaluating key risks and controls.
Thoughts for the Future
The determination of an internal audit department structure that supports both the audit team and the organization is an important decision made by the CAE and internal audit management. Like many other management decisions, it is worthwhile to evaluate the structure’s continued relevance and applicability periodically, as organizations change — sometimes extensively — over time.