The value proposition of the internal audit function is inextricably linked to project management. The Project Management Institute (PMI) defines
project management as "the application of knowledge, skills, and techniques to execute projects effectively and efficiently." Efficient project management facilitates the completion of audit engagements within time and budget expectations. Effective project management promotes the delivery of an audit engagement that is perceived as relevant and valuable to the organization. The PMI further classifies project management into five processes, which can be applied to internal audit engagements.
1. Initiating Process
The initiating process provides a foundation that is critical for the audit engagement, including identifying and understanding the engagement's objectives, scope, duration, expected deliverables, and forecasted staffing and resource needs. Communication and collaboration between the audit team and the project's key stakeholders during the initiating process is fundamental to delivering an internal audit engagement perceived as valuable to the organization.
2. Planning Process
The planning process expands upon the initiating process to further define the processes, risks, and transactions that will be examined, as well as to identify the audit procedures and resources necessary to produce expected deliverables (Practice Advisory 2200: Engagement Planning). Engagement planning should follow a top-down, risk-based approach so that internal audit efforts are positioned to deliver the greatest value across the organization. To facilitate effective audit planning, Standard 2240: Engagement Work Program requires that internal auditors "develop and document a work program that achieves the engagement objectives." In accordance with Standard 2210: Engagement Objectives, adequate criteria for evaluating the area under review are necessary components of the engagement work program. Further, internal auditors must assess whether management has established adequate criteria for determining whether governance, risk management, or control objectives have been met. If the established criteria are deemed inadequate, internal auditors must work with management to develop appropriate criteria for evaluating the processes or transactions under review.
Another element that audit teams should consider as part of the planning process includes outsourcing and cosourcing of resources where appropriate. Outsourced or cosourced subject matter experts may possess the knowledge and methodologies to execute an engagement that is both more efficient and robust in addressing the function or area under review.
3. Executing Process
Also called the fieldwork phase, the executing process consists of the steps or activities taken to complete the engagement work program. Standard 2300: Performing the Engagement requires that internal auditors "identify, analyze, evaluate, and document sufficient information to achieve the engagement's objectives" by ensuring:
- Information is factual, adequate, and convincing so that a prudent, informed person would reach the same conclusions as the auditor.
- Audit conclusions are based on appropriate analysis and evaluation to provide insight and recommendations that are value-added.
- Fieldwork documentation supports the engagement's conclusions and results.
Both audit staff and audit management are charged with identifying opportunities to execute the audit engagement more efficiently and effectively. Data analytics and continuous audit software can expand audit coverage and extend the finite resources of the internal audit function.
Additionally, continued collaboration between stakeholders — especially process owners — and the audit team is vital to ensure relevant risks are appropriately reflected and updated within the audit work program. Audit staff can serve as critical eyes and ears during the execution of an engagement. For example, changes to the organization's systems, processes, or personnel can represent risks to the effectiveness of internal controls. Audit staff can play a key role in escalating such considerations to audit supervision, which would ensure the engagement work program remains relevant beyond the planning process.
4. Monitoring and Controlling Process
Internal auditors at all levels must monitor engagement execution to ensure fieldwork is trending appropriately toward completion. Audit staff must quickly identify, communicate, and escalate any issues or obstacles that threaten completion of the engagement. It is equally essential that audit supervision remains connected to engagement progress to address potential problems timely and facilitate project completion.
5. Closing Process
The closing process typically involves communication of engagement findings through an exit meeting with process owners, subsequent distribution of a final audit report, and any necessary follow-up. Another key element to consider in closing an audit engagement is the maintenance of a permanent file. The permanent file serves as an index of audit emphasis, procedures, and findings over time, and can prove beneficial in planning and executing future engagements.
From Management to Motivation
While project management is critical to every audit engagement, internal auditors also must consider project motivation. Motivation is driven by purpose — a defined and understood objective or ideal. While the internal audit function's overall purpose is communicated via a charter, an engagement's purpose is determined and refined during the initiating and planning phases.
Far too often, audit management initiates and plans in a silo — excluding audit staff or even internal audit stakeholders. As a result, these parties are not exposed to an engagement's efforts until the executing phase and can be disconnected from the engagement's purpose. Thus, these parties may be less likely to buy into the audit engagement, which can be detrimental to the effectiveness of the project's efforts. It is critical that all relevant parties are included — as appropriate — in the initiating and planning phases of the internal audit engagement.
Extending through the executing process, audit management must ensure the audit team remains connected to the purpose of the engagement, which is defined during the initiating and planning process. This is especially relevant for projects with an extended duration or instances where audit personnel have joined the engagement at a later time, and thus were not exposed to the engagement's objectives outlined during the initiating and planning phases. Effective project management and motivation are fundamental to delivering valuable internal audit engagements across the organization.