Top 5 best practices for a cost-effective internal audit

What is internal auditing?

According to the Institute of Internal Auditors (IIA), internal auditing is: "An independent, objective assurance and consulting activity designed to add value and improve an organization's operations." It helps an organization accomplish its objective by bringing a systematic and disciplined approach that evaluates and improves the effectiveness of risk management processes.

Cost-effective internal auditing

For internal auditing to be cost-effective, a goal for all companies, two questions should be asked in each situation:

• What delivery model is best suited for us?
• What should our total internal audit investment be?

These two questions are interrelated, and the answers of one will impact the other.

What delivery model is best suited for us?

Many companies utilize varying resourcing options to help deal with this dilemma. Resourcing models can involve hiring an inside team, known as "insourcing," hiring an outside provider or vendor, known as "outsourcing," or utilizing a hybrid model of both, known as "co-sourcing."

The insourcing model

The auditors work internally under the organization. Such an audit function is usually managed by an in-house manager.

The outsourcing model

The auditors work for an outside organization, which has been contracted to work for the current organization. The organizations that utilize this method often don't have the necessary skill set available internally or the training or methodologies to develop the skill set come at too high a cost.

The co-sourcing model

This model can be a structured approach to suit the needs of a company with an existing internal audit department which faces a range of different challenges. This can be developed using several alternatives under the co-sourcing model including strategic sourcing or partial outsourcing.

What should our total internal audit investment be?

In an organization's service budget, the estimation and budgeting for internal audit cost is often a contentious area due to there being a lack of clear guideline defined for the internal audit function. The rules and regulations of internal audits vary from organization to organization as per the industry, due to regulatory and compliance requirement.

Top 5 best practices for a cost-effective internal audit

1. Determining and utilizing the right resourcing model

Determining what the resource needs of the company are and choosing the best model for meeting those resourcing needs is an important practice. While insourcing can often be the desired solution if the time or financial constraints do not support it, choosing this model can be to the detriment of the overall organization. Making sure you use the right model for each business's needs is critical.

2. Focusing on the core

To have a highly cost-effective audit, the first step is to concentrate on the crucial foundations of assets and functions that directly affect the internal auditing process. After this, you can disseminate the efforts across the company's workflows. This can be time-saving and will also help streamline the necessary changes.

The key is in reducing the scope during the initial stages. This helps the internal audit team concentrate on the highly-valuable attributes of the organization. It allows both management and the board some flexibility to set their policy and goals for the audit function, as well as deciding how to appropriately balance and manage the cost versus effectiveness of the audit. One way to analyze what functions need to be included is by conducting a BIA (Business Impact Analysis).

3. Utilizing enterprise risk management

After finding the core functions and assets, organizations should utilize an effective Enterprise Risk Management strategy that will be applied to the entire company's workflows. This is to further identify which domains need to be included in the scope of the internal audit, as well as to know how to move forward after identifying and addressing the issues found after focusing on the core functions and assets.

Creating a strategy that supplements the initial efforts of restructuring the internal audit systems helps an organization to focus on the critical functions affected by the issues and will provide a clearer perspective on which parts are problematic for the company from top to bottom. This eases the process of identifying the most susceptible assets that can be adversely exploited. This will also help the internal audit team to further concentrate on the high-risk areas and balance their resources cost efficiently.

4. Focusing on time management

One of the most important aspects of reducing the cost of the internal audit is appropriate time management. A well-defined timeline should be in place to restrict longer engagements, allowing time to be utilized most effectively. This can be achieved by allocating time durations to complete the entire audit, as well as each subtask in the entire process. By emphasizing time management, allocation of employee time and company resources are balanced with meeting the desired deadline.

5. Developing an effective team

Every company's biggest asset is their employees. Given this knowledge, it's crucial to develop the audit team using an appropriate balance of participation from management and from the functional teams. The red tape of hiring, training, and reforming of a team can often delay the process of audit and derail the objective of the process itself. It is essential to have the management buy-in and correct decision makers at the table to move the process along efficiently and reach the desired results.

All stakeholders should be informed and prepped for their roles in the process and expectations should be set in advance. This results in the appropriate allocation of time, effort and money for the organization.

Following these best practices allows the organization not only to consider the cost of maintaining the internal audit function, but also to consider its organizational structure, complexity and diversity of the business operation alongside the expectation of the stakeholders.

Sources

• The Institute of Internal Auditors, IIA
• Insourcing or Outsourcing - Internal Audit & Risk Management (Hot debate), LinkedIn
• Key considerations for your internal audit plan, Ernst & Young
• 10 Key Internal Audit Topics for Audit Committee Consideration, AICPA
• Internal Audit in Australia, The Institute of Internal Auditors Australia
• Kashan Pirzada and Nabeel Rehman, "Evaluating The Factor Of Cost And Benefit Of Internal Audit," Research Journal of Finance and Accounting