Integrated auditing — a combination of financial, performance, and IT auditing — offers numerous benefits to an audit function, allowing greater impact without necessarily increasing headcount. Integration can help internal audit stay relevant in its role as trusted adviser in the rapidly changing post-COVID-19 environment.
Integrated auditing's strength is that it shows not just where money was spent, but how it was spent — an important consideration in the public sector, says Mara Ash, CEO of Business & Financial Management Solutions LLC of Austin, Texas. Taxpayers want government to spend their tax dollars prudently, efficiently, and effectively, and integrated auditing can provide this reassurance. It's a different concern compared with the private sector, which generally is more focused on making a profit. The public sector's concern, by contrast, is "Did you use my tax dollars efficiently?" Ash says.
The move to integrated auditing represents an evolution of internal audit, says Kip Memmott, audit director for Oregon's Secretary of State. Auditors — whether performance, financial, or IT — used to be more siloed into their respective areas. Now, each needs to know more about the others' areas. "It's an awesome opportunity for cross-training, not only from a technical skill set, but from a cultural area," he says, in terms of breaking down rivalries and developing understanding. While the performance, financial, and IT auditors all have different skill sets and work with different legal requirements and standards, they all are working toward the same end game — determining whether the client is executing its mission to the best of its ability, Memmott says.
Benefits of Integration
From the organization's point of view, the advantages are efficiency and effectiveness, says Domenic Savini, assistant director for the Federal Accounting Standards Advisory Board (FASAB) in Washington, D.C. For example, when auditors perform an integrated audit, they accomplish their objectives using coordinated audit processes and testing that typically cut across multiple audits and/or objectives during the audit cycle and yield results that are more comprehensive. The audit tests help satisfy multiple objectives and bring audit matters into sharper focus. This win-win situation keeps use of audit and client resources to a minimum and results in comprehensive recommendations and related solutions, says Savini, who notes his views are personal and do not necessarily reflect those of the FASAB or any of its members.
For Ash, integrated auditing allows public sector organizations to determine whether expenditures were made efficiently and whether they were effective. Determining effectiveness allows the organization to make good management decisions about the direction of the program. It also pushes auditors out of their comfort zones to look holistically at the organization and its processes, helping them to become more of a trusted adviser.
Integrated auditing exposes employees — especially those seeking management roles — to different operational areas, Savini says. This exposure helps them develop an understanding of their organization's various business processes, become more effective decision-makers, and hopefully, more well-rounded managers, he adds.
Integrated auditing also gives organizations a broader reach and more depth in its audits, and a powerful tool to look at complex issues, Memmott says. He notes both performance and financial audit standards require practitioners' data to be reliable, adding that IT can help make this determination. Meanwhile, the multiple concerns of a COVID-19 and post-COVID-19 work environment — managing a workforce, recruiting and turnover, telework, and flexible work schedules and work sites — all are areas in which internal audit should be involved, he says.
Bringing together performance, financial, and IT audits provides audits that are powerful, real-time, and proactive. Integrated auditing also pushes audit to take a more active role with its organization. "The idea with integrated auditing is to be more proactive, more strategic, and more forward looking," Memmott says.
Barriers to Adoption
Despite its advantages, integrated auditing is not often used in government, Memmott says. Many internal audit functions are small and do not have either the staff or the skill sets, especially for IT auditing. Risk aversion, the mindset of "this is the way we've always done things," also plays a part.
For Savini, having adequate and competent staff resources are a chief audit executive's primary concern, followed by efficient communication among the audit team members and management buy-in on the concept of integrative auditing. Management needs to understand that what may appear to be "scope-creep" is actually an investment toward future resource savings and better, more focused audit results, he says.
Integrated audits take longer because of their broader scope. Some areas may take longer than planned or newly discovered areas may need to be addressed. Integrated audits can be budget-eaters, especially if they are not well designed and coordinated, Memmott says. Conversations with the audit committee during development of the audit plan are important. "Because of the cost, it's got to be the right area," Memmott says.
The silos that can exist between different areas, such as between different types of auditors, also can be a barrier, Memmott says. Differences in expectations and relationships may need to be worked through with clients as well. "There's a lot of education, not only internally, but externally, that should go into integrated auditing," he says.
While not necessarily a barrier, auditors in the public sector need to stick to the facts, be aware of topics that might be politically sensitive, as well as avoid political groupthink and the influences of politics or political ideology, Savini says. Auditors in the public sector as well as those with highly engaged audit committees typically do not have the luxury of picking and choosing their audits. As a result, these auditors need to be clear and know how their results will be used. "We can't hide from doing an audit, but we have to do it in an apolitical and unbiased manner," Savini says. "We must protect the integrity of the internal audit profession."
Typically integrated auditing is done at the end of the fiscal year to coincide with the annual financial audit, Ash says. (An internal auditor typically would not perform the annual financial audit; however, internal auditors may be involved in providing assurance over internal controls affecting financial statements.) That said, real-time auditing has benefits, she notes, given that government entities are moving to integrated audits for their grant programs. They are doing so because grantees are required to show the outcomes associated with the funding they received, and federal guidance requires them to share new ideas or efficiencies. Real-time auditing enables grantees to make course changes during the performance period to ensure desired outcomes, and the results can be applied to other programs.
Integrated auditing, working hand-in-hand with real-time auditing, brings more muscle and provides greater assurance. The key, Memmott says, is in structuring the real-time audit to ensure that, even with the larger scope of the integrated audit, information is disseminated in a timely fashion.
In looking to implement integrated auditing, "my advice is always to start at the top," Ash says. She recommends making sure that management is on board and understands internal auditing as well as integrated auditing. With integrated auditing, it's a matter of breaking down the mindset of separation — financial and performance audits and understanding how they are integrated — then putting it all together with the organization's existing work tools and programs.
Second, Ash suggests looking at major, high-dollar-value programs, especially if they are subject to federal funding regulations, or if they are actively monitored at the state/county/local level. These programs provide a great starting point, because stakeholders and others will want information about program outcomes, Ash says. Third, she advises looking at high-visibility programs, the ones that are in the public eye.
In terms of helping teams work together, "data analytics is a magical tool," Memmott says, noting that it has the power to bring financial, performance, and IT teams together, even though they have different objectives. In addition, when building an audit plan, he says auditors should think about the objectives and the steps to meet those objectives, and build the plan specifically around integrated auditing.
In addition, a good onboarding program can help with recruiting and retention, break down the silos between disciplines, and build understanding across disciplines. Memmott notes that his department has a rotational program, for example, where performance auditors could rotate through IT.
Diversity within a team is critical as a means of supporting candid discussions on different issues, Savini says, and to help ensure audit stays apolitical and true to its objectives. He stresses the importance of hiring not based just on demographics, but hiring for diversity of thought, opinion, and experiences.
When working with public governing bodies such as county commissions and city councils, "integrated auditing is your friend," Ash says. An integrated audit can answer the organization's bottom-line concern — what it got for its expenditure on a project. With an integrated audit, Ash says she can tell the governing body that money spent on allowable costs and controls was effective, detail programmatic outcomes, and discuss what improvements might be needed.
While implementation of integrated auditing can have higher initial costs, the return on investment will pay for itself down the road, Savini says. In this current environment, organizations need to leverage every resource to get "mean, lean, and green," so it is an advantage to leverage the skills of auditors. "If they're ready, willing, and able, you have got the most important part of the battle won," Savini says.
Integrated auditing also will help organizations cope with possible cuts in federal funding and develop better programs, Ash says. "Integrating performance and fiscal auditing is something that we are going to have to get comfortable with now, because in the future it's something we are going to have to do to survive."