Benchmark your internal audit process with Touchstone Research

Starting with a maturity model that was market validated in 2012, Colleen and her team dug into the trends and market needs that have been notable over the last eight years. "One of the key challenges, I saw with the model is that progression in the various internal audit activities was difficult to identify because often multiple activities are grouped together. Am I below or above average in my audit workpaper workflow? It was difficult to tell because that might be lumped in with my use of technology." stated Colleen.

The Touchstone Research Maturity Model was refined to break audit activities into 13 components that almost every internal audit team includes in their process regardless of country, industry or team size.

Colleen and her research team then designed an 89-question survey that would analyze how teams work and calculate their level of maturity¹ for each of the 13 components.

The research survey was designed to focus on the process of internal audit, not the tool or application used which may dictate how an activity is performed. This approach allows participants who are using any tool, or perhaps no tool at all, to also assess their maturity and to ensure the maturity model is unbiased towards specific tool usage.

Within a month of launching the Research, over 600 responses were received. This allowed the research team to review the responses and re-calibrate the mapping calculations as well as refine the detailed descriptions for each level of maturity across the 13 components. With the re-calibration complete, full survey benchmarks could be created and automatically updated as more responses poured in. This means that the Touchstone Research Maturity Model is not a stagnant snapshot in time. The survey remains open and over time additional input will be requested from participants to reflect changes in business practices and the world. Audit leaders and teams now have the most comprehensive benchmarking tool the profession has ever seen and it will continue to evolve.

One of the more interesting insights into the maturity model mappings has been how right the assumption was that a single team can have wide fluctuations in their maturity across different components. Teams that achieve Trail Blazer status in one component, can be Fact Collectors in another.

Across the board, the maturity model is showing that traditional activities like scheduling and keeping track of time are at Level 3 of the model. The global feedback is also showing that regardless of country, industry or team size, almost all participants are Level 1 when it comes to creating and communicating audit results (reports).

The feedback is also identifying that internal audit continues to lag in their use of technology and the implementation methods of that technology. "I expected to see this lower level of maturity for technology in certain situations, developing countries, new/small teams; however, this result is across the board," stated Colleen.

How can internal audit teams start their journey to evolving their practice?

Step 1: Take the Survey

Click here to take the survey.

Step 2: Understanding Where Your Team Lands in Each Component

It is rare that a team finds themselves in Level 4 and/ or Level 5 in all 13 components.

Discuss which components need attention. Your team might be okay with a lower level of maturity in a component because it is not within your team’s mandate (some public sector teams do not perform issue tracking as an example). You may already have a plan you are actively working for another component.

Before creating a plan to move from Level 2 to Level 5, you should also compare component mappings to your benchmarks to see how far you need to evolve just to catch up. If you are significantly behind your industry peers, use your network to learn what steps were taken to evolve. If you are a growing team, use your network to learn how to scale your methodology.

Change requires buy-in. Buy-in requires evidence for the need for change. The Touchstone Research Maturity Model provides the evidence and a map for your team’s evolution.

Learn More about Touchstone & Sign Up for Future Webinars

120 Countries, More than 1,000 Participants

Appendix: Defining Maturity

Fact Collectors: Use a cyclical based audit approach which is very document focused, little attention to the IIA Standards and low technology usage.  No collaboration with the business.

Information/ File Managers:  Use a cyclical based audit approach which is very document focused but attention to workflow and evidence of review is more prevalent.  Office technology in heavy use under a prescribed process. Little collaboration with the business.

Business Advisors: Risk-based audit approach with attention to the IIA Standards.  Purpose built tools and workflows are used for consistency and efficiency. Some collaboration with the business.

Value Accelerators: Risk approach with emphasis on streamlining activities and collaboration with the business.  Purpose built tools which provide transparency and visualization of outcomes are important.

Trail Blazers: Dynamic risk assessment/ agile audit approach with emphasis on automating routine activities and continuous collaboration with the business.  Emphasis on sharing real-time insights with stakeholders and visualization of outcomes are important.