We have come a long way from the days where internal audit was seen as an internal version of our external audit colleagues, focused solely on financial risks and reporting.

Today internal audit provides a dynamic career option for individuals wanting to have real influence over their organisations. Internal audit, at its best, is creating insight and driving strategic transformation. We have a seat at the executive table and use it to effect. We focus on both upside and downside risks and opportunities, using the language of risk appetite.

Heightened expectations and regulatory obligations over the internal control environment mean that internal audit has never been more relevant or strategically important. It’s hard to see how companies needing to comply with the UK Corporate Governance Code can meet the requirement to assess and maintain internal controls over financial, reporting, compliance and operational risks without a sound embedded three lines model.

Despite this, we believe that too few people really understand what internal audit does and the hidden asset that exists at the centre of organisations. It would be rare to hear university students aspiring to join the profession. Rarer still for school age students. Equally, coming from the top down, the many forums in which the revisions to the UK Corporate Governance Code have been discussed, have made it clear that few directors appreciate fully the opportunity for assurance that internal audit provides.

Addressing this has been the focus of the Council of the Chartered Institute of Internal Auditors (CIIA) in recent strategy discussions. The institute is focussed on building relationships with stakeholders including the government, representatives of the Audit Committee forums and universities. Alongside this, we need all involved in internal audit to play their part. 

We believe there are five fundamental steps we can all take, whether talking to the Board, investors, regulators or future internal auditors:

1.  Be clear about the purpose of internal audit: Our purpose is to protect the assets and reputation of our organisations through a clear focus on the risks that are most significant. It requires us to have a broad-based view of the organisation, geographically and operationally. We need the skills and capabilities, as well as experience, in areas from cyber to engineering and from HR to R&D. Protecting the assets and future profitability/cashflows means managing downside risks and keeping the organisation and its people safe. Protecting the reputation means addressing the need to take risk appropriately to deliver the financial and non-financial returns the business needs.
2. Engage with the board whenever the opportunity arises: Directors carry a significant burden of responsibility. With increased reporting obligations they feel this burden more acutely. Internal audit offers a mechanism for assurance across all aspects of the business. If directors engage fully it enables them to make commitments with confidence. These commitments are as critical to investors as they are to regulators, suppliers and others. For the workforce and for customers assurance over commitments enables the business to avoid greenwashing.
3. Create a compelling story: We have to get better at selling ourselves and the service we provide. Few people understand the expert nature of internal audit and the fact that work is backed up by professional standards in a similar way to external audit. While we are not subject to the same regulatory environment, we train to obtain our chartered qualification and our work is subject to periodic quality assurance against mandatory standards. Reports and recommendations can be relied on. In the context of raised environmental and societal expectations, failure to recognise this results in excessive third-party expenditure.
4. Be courageous in addressing what matters: in years gone past there would have been questions about the breadth of internal audit coverage. Today we have widespread agreement that internal audit’s remit is to cover all material risks. And to form our own judgement as to what this means in practice. We have the opportunity to provide constructive challenge and to innovate. We won’t always be rewarded or recognised for this but it should not hold us back. There are many well known instances at present of leaders failing to ask questions rigorously and with integrity. Internal auditors should have the professional capabilities to do this in an appropriate manner.
5. Focus on substance over form: the Internal Audit Standards matter and we welcome the revisions currently being finalised. However, these standards provide the foundation of strong internal audit. The skill of an internal auditor, particularly the Head of Internal Audit, is to go well beyond this. To tackle the risks in a robust yet empathetic manner and to engage in strategic conversations about the implications. Are we willing to take further risk? What does this mean for our risk appetite? How do we adapt our processes and control environment? What do we know about our culture and the need for behavioural change?

With the imminent release of both the revised and final Internal Audit Standards and the refreshed Internal Audit Code of Practice, this is the time to start a conversation. To show our passion for the role of the third line in embedding integrity. To use the well-publicised current breaches of integrity amongst organisations to highlight that it doesn’t need to be that way. Good governance and accountability starts within the organisation. Internal Audit plays a vital role.