internal audit research
ComplianceFinanceTax & AccountingSeptember 17, 2020

Benchmark your internal audit process with Touchstone Research

For several years, professional services firms and associations have been encouraging and even imploring Internal Audit teams to evolve their methodology to keep pace with the changes that are happening within their own organizations.

Change can be difficult to initiate and be slow to occur though. It is difficult to know where change is needed at all, let alone where to focus first. Before trying to move forward, it is wise to understand where your team is today. But benchmarking data is not readily available in a way that is relevant but still anonymous. Until now.

In January this year, Wolters Kluwer TeamMate initiated a rigorous research effort. The Touchstone Research for Internal Audit was kicked off with the intention of creating a valid, data-driven maturity model for internal audit experts and providing internal audit teams with a clear understanding of the maturity of their processes and benchmarks to their peers. Creating a touchstone that they can return to in measuring their progress against a plan of action and against the progress of their peers.

I started my career in internal audit and advocating for internal audit needs is my number one priority and passion. With over 20 years of experience in the profession and a network of over 1,000 senior practitioners from all over the globe, I could see that guiding change would need metrics.
Colleen Knuff, Leading Touchstone Research for Internal Audit

Starting with a maturity model that was market validated in 2012, Colleen and her team dug into the trends and market needs that have been notable over the last eight years. "One of the key challenges, I saw with the model is that progression in the various internal audit activities was difficult to identify because often multiple activities are grouped together. Am I below or above average in my audit workpaper workflow? It was difficult to tell because that might be lumped in with my use of technology." stated Colleen.

The Touchstone Research Maturity Model was refined to break audit activities into 13 components that almost every internal audit team includes in their process regardless of country, industry or team size.

Colleen and her research team then designed an 89-question survey that would analyze how teams work and calculate their level of maturity1 for each of the 13 components.

The research survey was designed to focus on the process of internal audit, not the tool or application used which may dictate how an activity is performed. This approach allows participants who are using any tool, or perhaps no tool at all, to also assess their maturity and to ensure the maturity model is unbiased towards specific tool usage.

Within a month of launching the Research, over 600 responses were received. This allowed the research team to review the responses and re-calibrate the mapping calculations as well as refine the detailed descriptions for each level of maturity across the 13 components. With the re-calibration complete, full survey benchmarks could be created and automatically updated as more responses poured in. This means that the Touchstone Research Maturity Model is not a stagnant snapshot in time. The survey remains open and over time additional input will be requested from participants to reflect changes in business practices and the world. Audit leaders and teams now have the most comprehensive benchmarking tool the profession has ever seen and it will continue to evolve.

One of the more interesting insights into the maturity model mappings has been how right the assumption was that a single team can have wide fluctuations in their maturity across different components. Teams that achieve Trail Blazer status in one component, can be Fact Collectors in another.

Your team vs Full surveyAcross the board, the maturity model is showing that traditional activities like scheduling and keeping track of time are at Level 3 of the model. The global feedback is also showing that regardless of country, industry or team size, almost all participants are Level 1 when it comes to creating and communicating audit results (reports).

The feedback is also identifying that internal audit continues to lag in their use of technology and the implementation methods of that technology. "I expected to see this lower level of maturity for technology in certain situations, developing countries, new/small teams; however, this result is across the board," stated Colleen.

How can internal audit teams start their journey to evolving their practice?

Step 1: Take the Survey

Click here to take the survey.

Step 2: Understanding Where Your Team Lands in Each Component

It is rare that a team finds themselves in Level 4 and/ or Level 5 in all 13 components.

Discuss which components need attention. Your team might be okay with a lower level of maturity in a component because it is not within your team’s mandate (some public sector teams do not perform issue tracking as an example). You may already have a plan you are actively working for another component.

Before creating a plan to move from Level 2 to Level 5, you should also compare component mappings to your benchmarks to see how far you need to evolve just to catch up. If you are significantly behind your industry peers, use your network to learn what steps were taken to evolve. If you are a growing team, use your network to learn how to scale your methodology.

Change requires buy-in. Buy-in requires evidence for the need for change. The Touchstone Research Maturity Model provides the evidence and a map for your team’s evolution.

Learn More about Touchstone & Sign Up for Future Webinars

Learn More

120 Countries, More than 1,000 Participants

Touchstone Research StatsTouchstone Research Stats

Appendix: Defining Maturity

Fact Collectors: Use a cyclical based audit approach which is very document focused, little attention to the IIA Standards and low technology usage.  No collaboration with the business.

Information/ File Managers:  Use a cyclical based audit approach which is very document focused but attention to workflow and evidence of review is more prevalent.  Office technology in heavy use under a prescribed process. Little collaboration with the business.

Business Advisors: Risk-based audit approach with attention to the IIA Standards.  Purpose built tools and workflows are used for consistency and efficiency. Some collaboration with the business.

Value Accelerators: Risk approach with emphasis on streamlining activities and collaboration with the business.  Purpose built tools which provide transparency and visualization of outcomes are important.

Trail Blazers: Dynamic risk assessment/ agile audit approach with emphasis on automating routine activities and continuous collaboration with the business.  Emphasis on sharing real-time insights with stakeholders and visualization of outcomes are important.

Colleen Knuff - Senior Director, Product Management
Senior Director, Product Management
Colleen is a Certified Internal Auditor (CIA), Chartered Public Accountant (CPA), Certified Information Systems Auditor (CISA), and is certified in Risk Management Assurance (CRMA).
Global Internal Audit Research

Touchstone Research

for Internal Audit

Representing ground-breaking insight into the current and future state of internal audit.
Solutions

TeamMate+ Audit

Audit Management

The world’s leading audit management software - empowering audit departments of all sizes.