Elevating internal audits: Moving beyond the traditional scope

A second important step to establish a risk-based audit plan, next to the implementation of a rolling risk assessment, is the execution of high-impact internal audits.

Leading Internal Audit functions proactively address identified high-priority strategic, operational, financial and compliance risks, including those emerging in the business landscape. If these risks are not covered by other assurance providers, internal audits are conducted beyond the traditional scope, in collaboration with business experts or consultants. This team of internal auditors and subject matter experts allows for effective audits of emerging risks, sharing best practices, and optimizing processes and related internal controls.

From our team’s extensive experience in setting up, developing and managing Internal Audit departments we have identified the following high-impact internal audits. These have been drawn from a spectrum of companies, including private and publicly listed firms, both national and international. Our expertise extends across diverse industrial and commercial sectors.

The main objectives of a high-impact internal audit remain to assess internal control’s design and operating effectiveness, verify if the identified existing and emerging risks are correctly and completely mitigated, and offer pragmatic improvement recommendations.

However, the approach differs primarily because subject matter experts are engaged across all phases of the internal audit. These experts, often referred to as guest auditors, bring depth and expertise to the internal audit process, enhancing its effectiveness and value to the organization as follows:

Phase 1 – Internal Audit preparation: Subject matter experts participate in scope meetings with stakeholders to ensure that business concerns and attention items are captured. They see to it that pertinent questions are asked in relation to industry standards, regulatory requirements, data quality and availability and best practices. This input is taken into account when developing the internal audit work program to include clear, comprehensive, and measurable tests of design and operating effectiveness regarding expertise topics.

Phase 2 – Internal Audit execution: Subject matter experts actively engage in audit fieldwork, using their expertise to evaluate processes and its internal controls, including the accuracy of the system setup and utilization. They assist in interviews and testing to assess the significance of observations, root causes, and potential impacts. Internal Audit continues to strive for full population testing, with subject matter experts contributing by leveraging their insights from data and systems.

Phase 3 – Internal Audit reporting: Based on their in-depth understanding of the audited subject matter, subject matter experts work closely with audit teams to draft comprehensive reports. These reports accurately detail quantified audit observations, risks, root causes, and recommendations. The experts first have their insightful recommendations validated by the business, which ensures buy-in and facilitates mitigating action plans. Then, they help communicate reports to senior management and the Audit Committee, explaining observations clearly. They may offer additional context or clarification as needed to drive positive change within the organization.

From the internal audits TriFinance conducted in 2023, several high-impact audits have reemerged, demonstrating their continued relevance in the current disruptive business landscape. Notable among these are revenue leakage, recruitment and talent management, ERP implementation, and evaluation of Shared Service Center effectiveness and efficiency audits.

These high-impact internal audits remind us, amongst others, of the ongoing need for organizations to maximize revenue potential, gain competitive advantage in the ongoing battle for talent, reduce ERP implementation costs and implement a shared service profit- instead of a cost center.

Subject matter experts can truly demonstrate their added value in these high-impact internal audits by:

• Enhancing organizational value: Revenue leakage experts will identify, assess and mitigate revenue leakage risks in diverse business processes and cost-and revenue streams. They analyze payment and billing processes, pricing, vendor and customer master data, and contract management. Their specialized insights enable the audit team to uncover subtle revenue loss scenarios overlooked otherwise. They offer pragmatic recommendations, including best practices and benchmarks, to protect the organization’s bottom line and safeguard its financial integrity.
• Securing competitive advantage in talent acquisition: Finding and retaining talent (“human capital”) ranks second in the Institute of Internal Auditors' annual Risk in focus survey, underlining its significance to the business and prompting increased requests for recruitment and retention internal audits. HR experts join as guest auditors, bringing deep expertise in HR policies, procedures, and best practices. Their involvement ensures that the internal audit evaluates the organization's compliance with HR regulations like the EU Pay Transparency Directive, employment laws, and ethical standards. They also offer valuable insights into recruitment and retention process design and effectiveness by assessing recruitment methods, candidate sourcing techniques, selection criteria, employee engagement programs, career development opportunities, and talent acquisition and retention metrics.

• Maximizing ERP Initiative Success: Drawing from their ERP system expertise, systems specialists offer crucial insights into technical implementation aspects. This includes system configuration, data migration, integration with existing systems, and adherence to best practices. Their thorough understanding of ERP implementation methodologies, including project management frameworks and system testing protocols, allows them to assess process correctness and completeness. Additionally, these subject matter experts can pinpoint system deployment risks like security vulnerabilities, data integrity issues, and system performance bottlenecks, and provide mitigation strategies. Leveraging their expertise enhances the audit's ability to evaluate ERP readiness, functionality, and alignment with organizational goals, facilitating a smoother transition and maximizing system value.

• Transitioning from a back-office to a Shared Service Center: There’s renewed interest in Shared Service Centers internal audits, aiming to optimize shared service models for efficiency, process streamlining, and profit generation across the organization. A subject matter expert with shared services implementation expertise is essential. They verify key aspects such as alignment with the organization's vision, focusing on meeting customer needs, ensuring high performance and service delivery, aligning processes from start to finish, fostering a culture of service and excellence, treating the center as a profit center, and committing to continuous improvement. Their expertise ensures that the audit covers these essential areas that are crucial for the center's success and contribution to the organization.

These insights emphasize the importance of conducting high-impact internal audits to drive organizational success and resilience. Engaging subject matter experts throughout this process is crucial for developing a risk-focused audit plan that truly adds value.

These experts bring specialized knowledge and insights, offering deeper understanding of key risks, opportunities, and areas for improvement. By leveraging their expertise, Chief Audit Executives can ensure that internal audits are targeted, comprehensive, and aligned with the audited organization's strategic objectives.

Moreover, subject matter experts play a vital role in enhancing the effectiveness, relevance, and impact of internal audit findings and recommendations. Their contributions facilitate informed decision-making, promote positive change, and ultimately strengthen the organization's ability to navigate risks and capitalize on opportunities in a dynamic landscape.

Image by Freepik on Freepik