​​Determining the Value of Internal Audit

Comments Views

​Many internal auditors want an answer to the question: How do we put a value on internal audit?

Let's answer another question first: what is the value of a home? The correct answer is that a house is worth what somebody is willing to pay for it.

Now, what is the value of an internal audit function? The correct answer is that it is worth what the board is willing to pay for it.

The value is not some mythical calculation based on the value of process improvements or identified overpayments. No, it is worth what the audit committee of the board is willing to pay for it.

The value to the typical board is derived primarily from the value it places on the assurance it receives from internal audit. Any value from consulting activities is a welcome addition.

If the value is less than the cost, you have a problem. Hopefully, the value is more than the cost.

I think that efforts to show value by putting a number on proce​ss improvements and contract overpayment recoveries is putting too much attention on what should be a secondary activity for internal audit. Only when the board's assurance needs have been satisfied should internal audit seek to perform other value-add activities.

CAEs that want to ensure they provide the maximum value should look first to the value they provide to the audit committee if the board. Maximize the assurance value by ensuring you are providing peace of mind on the more significant risks to the organization. That is the meat; valuable consulting services to management are just the gravy. What's the point if gravy when there is little or undercooked meat?

I welcome your views.

​The opinions expressed by Internal Auditor's bloggers may differ from policies and official statements of The Institute of Internal Auditors and its committees and from opinions endorsed by the bloggers' employers or the editors of Internal Auditor. The magazine is pleased to provide you an opportunity to share your thoughts about these blog posts. Some comments may be reprinted elsewhere, online or offline.



Comment on this article

comments powered by Disqus
  • IAF-PGS-Assessing-IA-Practices-August-2021-Blog-1
  • IT-General-Controls-Certificate-August-2021-Blog-2
  • CRMA-August-2021-Blog-3