Clear operating model
High performance internal audit team’s operating models achieve four goals:
However the business organizes itself, it makes sense for the audit function to replicate this as much as its size will allow. This may be along geographical lines if you are a multinational business, along product lines if you have many product streams, or along operational lines with manufacturing and sales functions all being separate. Mirroring how the business organizes itself provides clarity both to the team and the business on how you are looking to bring value.
The boundary of the operating model should not stop at the internal audit team’s door. Successful risk management and control comes when everyone in the organization is clear about their accountability for risk and control. In short, everyone understands the role they play and the significant decisions they can take in effectively managing risks and determining and operating controls. One high performing organization identified that this lack of clarity was a major issue. The organization did not just raise this as an audit issue but stepped forward to work with business colleagues to ensure that roles were properly defined, including responsibility for control management across the organization, and gaps were properly closed. High performance audit teams sit in an organization where accountability for risk and control is clear and, where it is not, they step up and make it so.
The operating model needs to be clear as to the importance of collaboration and teamwork and provide the team direction on this. For internal audit teams, this is likely to include areas such as specialist teams and resource pools for larger functions that need significant resource flexibility. The way the team is organized needs to ensure efficient information sharing, collaboration, and problem-solving.
Caliber of people
The operating model also needs to be clear as to the caliber of people needed to make the function a success and truly deliver on its purpose. It is important that those running the function have the status and credibility to engage as equals with the businesses that they are reviewing.
The final element of our business alignment characteristic is business acumen. High performance internal audit teams understand the business they are auditing. This means an intimate understanding of its products, customers, risks, and competition. There are a range of ways that high performing teams achieve this. First, they commit to the ongoing development of the team, this is non-negotiable. They also commit to ensuring everyone in the team has some business experience. This can be achieved in many ways, including direct recruitment, but progressive functions look to build a permanent two-way flow of talent both from audit into the business and from the business into audit. Some organizations establish schemes to achieve this flow. For example, one internal audit function established an ambitious goal that 50 percent of the function’s employees would have had a business secondment over a five-year period – known as ‘50n5’. This was backed by executive management and, as a result, they achieved this goal ahead of time.
Having explored the first of the four characteristics of high performance internal audit teams – business alignment – the next article in this series will focus on the second characteristic – internal audit stakeholder relationship management - all with the aim of internal audit working together to the benefit of the entire range of internal audit stakeholders.