Internal Audit Best Practices

This is the Internal Audit Awareness Month. To celebrate this I am sharing my top 5 practices for Internal Audit.

1. Communicate, Communicate and Communicate: I ensure that the communication between internal audit and auditee are free flowing. Building trust is one of the hallmark of a good internal audit function. Internal Audit need to communicate at all stages with the concerned auditee. Planning, scheduling, advance intimation, kick off, regular meeting to update, closing meeting, draft report, final report, audit committee presentation and follow up for open issues, at each stage the communication is required. Communication can take shape of mail, chat message, phone call or a personal visit instead of only email or system.
2. Sharing of Audit objectives/ Audit program, Audit Test: Internal Audit is an open book activity and not a secret activity. Some Auditors does not want to share the audit program, audit checklist, audit test. They should go back to the purpose of internal audit. Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes. I believe that if auditee start using audit tests to ensure that controls are effective, then its a win for internal audit. Lets consider a situation where your performance is getting assessed but you don’t know the criteria for assessment; would you consider this situation fair? (if you doing a fraud investigation, then you need to maintain confidentiality to meet the investigation objectives.)
3. Be constructive/ positive and avoid negativity: Internal Audit is associated with lots of negativity. A large proportion is due to the fact that its viewed as a fault finding activity. A large number of auditor still indulges into fault finding and lots of management expects internal auditors to find faults. However, internal auditors can still make constructive comments and create a positive environment while discharging their duties. They should do a minor in communication and/or read lots of books on communication/ negotiation/ persuasion.
4. Focus on issue and don’t be obsessed with your recommendation: A good number of audit, provide audit recommendations. While its a good thing to do, provided process owners were involved into the recommendations process. With the process owner involved in the recommendation process, they own the action plan. As an internal auditor, our role is to inform about the risk. Management can still decide to do nothing.
5. Plan for the future: While it is easy to plan for past, management values the efforts to protect the future. Whenever organisation planning to roll out a new process, new policy, new system, management want to ensure that they have all the right things in place and taken care of all the risks that can be thought off. Internal audit is a valuable tool in the arsenal of management to ensure that. While operations may have a better and deeper knowledge about the operations, internal audit understand the inter relationship between various functions, compliances, weak areas in other processes. By reviewing pre and post implementation, Internal audit can become a truly business advisor.

Call for action:

Inputs/ comments/ suggestion: I welcome inputs/ comments / suggestions from readers on how to approach this issue. Feel free to correct me, educate me.

Credits :

Written by : Mr. Manoj Agarwal

Linkedin Id: https://in.linkedin.com/in/manojbagarwal