Because of a scarcity of resources, small audit functions face several risks, including the inability to meet expectations of the board and senior management, failure to achieve objectives, and lack of continuity. But they can develop strategies and use tools to overcome these obstacles, taking advantage of opportunities related to their size.
Work With Stakeholders
Internal auditors in small audit functions should identify departments in their organizations that can add value to internal audit and assist it in leveraging scarce resources — departments such as risk management; compliance; environment, health and safety; security; legal; IT; governance and strategy; resource planning; and quality assurance. Building long-lasting relationships with these areas allows internal audit to be aware of identified risks and understand the processes and controls put in place to mitigate such risks.
Involving experts from other departments on individual engagements brings expertise that internal auditors lack for a specific project (IT, legal, engineering, etc.) and provides the experts with insight about internal audit methods and the types of information internal auditors are looking for. The experts should be independent of the audited area, supervised, and approved financially by management to provide assistance.
Internal audit also may consider asking someone within the organization to review audit work — someone who has knowledge and experience, particularly in governance, risk management, and audit practices, such as a former internal auditor or an employee who is a member of an audit committee in another organization. Documentation of such reviews should be kept.
There also should be cooperation with external auditors, peer reviewers, hired consultants, and regulatory authorities. Even if internal audit work is not used by external auditors or consultants, the chief audit executive (CAE) should keep in touch with them to discuss risks and potential flaws in the system of internal controls, as well as best practices. Knowing the plans and areas to be covered by external reviewers, an internal audit function can reallocate resources to other risk areas. The function may benefit from the findings in those areas addressed by external stakeholders and reviewers when they are interpreted through the prism of the whole organization.
Leveraging the knowledge, experience, and best practices of industry peers and local IIA chapters also can help resolve complicated issues. Through interaction with such groups, internal auditors can get access to valuable resources, such as presentations and manuals, templates of audit programs, and other internal audit documentation.
It is important that the CAE carefully prioritize internal audit work by considering audit activities included in the annual audit plan, emerging high-risk and sensitive issues, urgency of requests, and availability of internal audit staff and staff within the audited area.
Limited time can be prioritized by using internal audit software and software used by other departments for data analysis and reporting, as well as templates developed for various tasks and procedures. This allows internal audit to spend more time solving complicated audit issues instead of performing manual routine tasks.
Flexibility can be increased by reserving time for consulting and investigative engagements and other activities not known in advance. Internal audit also could consider performing audit engagements in two stages: interim and final. During the interim stage, internal auditors perform a preliminary review of available information and systems and discuss questions and concerns with audit clients to learn about additional resource needs or how much unplanned time auditors may require during the final procedures. Practitioners then can provide some insight to clients about what to expect during the final audit stage and contribute to better management of the budget and uncertainty.
It also is important that internal auditors participate in meetings on strategic initiatives early on, which enables them to add greater value to governance processes, risk assessments, and internal control improvements. Auditors can prioritize their limited time by attending the most crucial meetings and rely on the review of the minutes from others.
If internal audit still cannot manage all the requests or does not have the expertise to address some of them, it should consider cosourcing. This is beneficial when specialized expertise or software is needed, but not available, in an organization; multiple requests have to be addressed urgently; the value expected from the project can be leveraged; and additional budget is available for hiring temporary employees. Interns or cooperative education students can perform less complicated tasks, especially during the busy season, or be involved in administrative tasks for the internal audit function, which can assist in managing a small budget. However, appropriate safeguards should be put in place when providing temporary employee access to internal audit information.
A CAE should be open and work closely with the board and senior management when analyzing the resource needs of the audit function so they understand the existing trade-off between the resources, internal audit objectives, and compliance with the requirements of The IIA’s International Professional Practices Framework. If limited resources cause nonconformance with the International Standards for the Professional Practice of Internal Auditing, the board and senior management should be informed and should agree to this outcome. It is crucial that an open discussion among the CAE, board, and senior management happens regularly as expectations and objectives change, which leads to changes in resourcing needs.
Maintaining continuous communication with various departments in an organization can be done through planning and close-out meetings during engagements, collecting feedback in surveys, and organizing workshops and other training. Investing time in continuous communication can pay off for internal audit in the long run.
Develop a Continuity Plan
Continuity, consistency, and quality of work can be difficult to maintain, especially if there’s high employee turnover.The internal audit charter, policies, procedures, and manuals enable the function to comply with the Standards and improve consistency of audit work. The same is true for templates that are used during internal audit projects, management of the internal audit function, and reporting to the board and senior management. Well-organized records and information management assist in preserving these tools for continued use.
Another element of a continuity plan, as well as a requirement of the Standards, is the assessment of a quality assurance and improvement program (QAIP). A thorough QAIP reduces the risk of nonconformance with the Standards. To improve the QAIP, small internal audit functions can involve peer organizations to identify common flaws in it.
Activity calendars for each staff member that include important activities performed annually by each position and due dates (such as audit planning, QAIP, reporting to the board and senior management, etc.) also can be used. Such calendars will help provide directions for existing staff members, develop the expectations for newcomers, manage budgeted time, and monitor performance against targets.
Set Realistic Expectations
Though an audit function may be small, it does not mean it cannot be effective. With the right tools and focus, small audit functions can meet the expectations of the board and senior management, achieve objectives, and maintain continuity. By setting realistic expectations and being flexible and efficient, small functions can be just as successful as their larger peers.