The global pandemic has created an extraordinary storm of crises and course corrections for organizations and internal audit functions worldwide. This dynamic risk environment tested internal audit’s resilience and value, and it has demanded that we work differently. I’ve been in awe of the almost super-human efforts by internal auditors to change their ways of working to account for the pandemic’s impact.
For some, there was even a backstory of budget or staff cuts to help firefight elsewhere in the organization. “Doing more with less” went from being a much overused and often empty platitude to a must-do and genuinely urgent reality.
The last year also proved that it’s possible to adopt new ways of working without threatening our conformance to IPPF principles and standards, even enhancing it in many cases. The same for audit methodology, with methodology owners quickly assessing any changes required to accommodate new ways of working.
Much of this change was driven by our business stakeholders or client needs. There was a mindset shift away from doing audits to our stakeholders toward doing our audits with our stakeholders (remembering the mantra that independence does not mean working in isolation). Above all else, it became paramount to reduce the time it usually takes to provide our insights, observations, and recommendations:
We have weeks, not months, to replan for fast-emerging risks.
Behaviors that emerged in audit planning:
- Initial audit plan updates completed in weeks (typically done annually and taking many months).
- Audit plan refreshed on a rolling weekly, bi-weekly, or real-time basis.
- Senior-level collaboration with executives on a weekly or bi-weekly basis.
- Audit committee (or committee chair) communication on a weekly basis.
- Laser-focused on:
- Which audit matters the most (i.e., which risk and controls and in what sequence).
- Value proposition of the audit and the value delivered by the audit work (i.e., there’s no shortage of work, so where can we best focus to deliver maximum value in the shortest period?).
- Higher percentage of the audit plan specifically requested by business stakeholders or clients.
We must build the best possible team for each audit.
Behaviors that emerged in audit delivery:
We all know that small teams are best to deliver high-quality audits most efficiently. The deployment of “real teams” became the norm for many audits.
Real team - Not an alliance, a collection of co-workers, or a pseudo team: