Internal audit functional outcomes are likely to cover the four areas of a typical internal audit functions operating model, namely:
- Position – How the function will be perceived.
- Process – What do you need to excel at to be successful including the technology to enable the achievement of your strategy.
- People – what kind of people do you need.
- Performance – what does success look like (measurement) for your internal audit work.
But what do these functional outcomes actually look like? Here are some examples of internal audit functional outcomes that I have seen in my work. They are all intended to describe what will be true over a 3-5 year period and provide focus for activity across the function:
- Leverage IA’s reputation as experts in internal control – Advocate and educate the business on effective control & its positive impact on business performance.
- Data driven insights – Data is central to all we do, deploying leading edge data analytics / continuous auditing techniques. Increased coverage, deeper insights and early warnings of risk.
- Auditor enabling tech – Increased leverage of core technology and harnessing new technology to enable more dynamic working
- Collaboration, diversity and inclusion – Embracing diversity of thought & background. Collaborating to leverage all the global team’s capabilities.
- Auditor experience (AX) – Auditor experience is simple, clear and supportive. Enabling great work by great people.
- Making space to innovate - Allowing us to try the ‘art of the (im)possible’, test, fail and learn, try again and succeed.
How do these stack up? A clear example of a ‘roofshot’ outcome is the focus on improving the auditor experience in the ‘AX’ outcome. The organisation that established this as a priority outcome identified that it had a tendency to over engineer its methodology and technology and wanted to signal to the team that it recognised this and was strategically going to hold itself to account to simplify all that they do and make internal auditing a more enjoyable experience. This outcome acted as the call to action for a radical overhaul of its methodology (reduced from over 150 pages to just 15) and associated shift to simplify its implementation of its TeamMate audit system for much greater impact. All of this became simpler, quicker and much more auditor friendly, significantly boosting productively and auditor engagement.
From a more ‘moonshot’ perspective is the outcome to ‘Making space to innovate’. This was intended to give time and space for more forward thinking innovation activity and also permission to test and fail with new ideas. This was identified as being a problematic area as the internal auditors were relatively risk adverse in trying new things that had a probability of failure and this was leading to lost opportunities where some great ideas were not taken forward. One way that they did this was through running change hacks and innovation incubators – where they took colleagues out of their work and facilitated idea development through to product design and testing in a compressed manner. This led to significant change in their methodology implemented overnight and also a pilot beginning their journey on implementing continuous business monitoring and the adoption of a more agile way of working.
There are two aspects of developing successful outcomes of this type:
- Engage widely - This aspect of the strategy is more likely to be successful if it is developed with wide engagement. Whilst your internal audit purpose, typically, will be developed by the leadership team the outcomes need to be developed with significant input from a range of your stakeholders. What is the value you will bring to the organisation and how will this value manifest itself? Your CEO, COO, FD, HR Director, etc will all have a view and ideas of where your function can deliver value to them. You can then consider this alongside the views of the non-executive directors who will also bring thoughts from other organisations they are involved with. Alongside this it is important that you truly listen to your team. Can you get a conversation going in the function around ideas and innovation and areas to change? It has been shown that engaging the team in determining the change significantly increases the probability of the change being successful. So find out what excites your team about how auditing may look in the future and where they see blockers / challenges to achieving this.
- Set a manageable number of outcomes – A series of 8-12 outcomes (perhaps aligned to the 4 areas, or derivations of these, of an internal audit operating model set out earlier in this piece) is likely to be much more successful that 20. You want the outcomes to provide direction to activity not constrain everything your internal auditors do. Having too many will lead to them being ignored or worse acting as a detailed plan that constrains engagement. Having too few will inhibit appropriate prioritisation over the 3-5 timeframe of your strategy.
So at this point in the development of your internal audit functional strategy you have a compelling purpose and a series of outcomes which you can align all the function behind. Next you need to consider what actual change activities you need to set in train to get closer to these outcomes and ultimately the purpose. In this context the next article in the series will explore the third characteristic of internal audit functional strategy, namely Align all activity to the strategic outcomes.
