It is natural for businesses to organically outgrow processes and procedures, whether formal or informal, but this could cause fraud, errors, ill-informed decisions, and lost synergies.
Continuous improvement is essential for growing businesses. Often controls are weakest when they are shared between multiple functions, or when there is no identified owner. This exposes the business to risk.
As internal audit is independent, meaning it is not responsible for operating the business, which is management’s responsibility, it is best placed to perform “health checks” on business’s ways of working to drive compliance, process improvement and optimisation.
Internal audit can provide an overview of processes which straddle multiple departments and provide an unbiased objective assessment to identify the root cause – the basic cause which sets in motion the entire cause-and-effect reaction that ultimately leads to the problem / improvement – so that appropriate feasible solutions can be implemented.
Having an internal audit function also demonstrates to shareholders and other stakeholders that management is running the business effectively and efficiently, addresses weaknesses in a timely manner, identifies risks, verifies compliance, and implements appropriate improvements where necessary in a timely manner.
If the business strategy is to perform an exit, via Initial Public Offering (IPO), private sale, or merger and acquisition, having an internal audit function brings assurance to future stakeholders that governance is considered a priority within the business and processes are continuing to improve to support strategy.
Internal audit raise findings to management, and together collaborate on feasible agreed actions appropriate to address the risks, control deficiencies, and process improvements identified by the root cause, which internal audit track until management has completed them. These are shared with the Audit Committee, Senior Leadership Team, and other key stakeholders as appropriate.
This supports formalising ways of working and provides an overview of end-to-end operations, which in turn can strengthen corporate governance, promoting transparency of information and a culture to follow processes and procedures outlined as best for the business. As a result, management could make better decisions which could enhancing the likelihood of achieving strategic objectives.
The difference between internal audit and process improvement function
Internal audit is different from a process improvement function, although there are similarities. An Internal audit function could be seen as more effective than a process improvement function because with the former the management team is responsible for improving the processes and controls within their remit as opposed to the process improvement function being responsible. As a third line activity, bias is removed.
Having management responsible for completing the remediation actions enables accountability and support top-down, embedding the controls more effectively and minimalizing resistance for change. In turn, it is a more effective approach to change management and process improvement.
An internal audit function can provide assurance to senior management and stakeholders that the controls in the business, are designed effectively and operate efficiently to enable businesses to achieve their strategic objectives.
| Internal audit function | Process improvement function | |
| Who is responsible or making improvements | The management team | The management team and/or the process improvement function |
| IIA define line activity | Third line activity | Second line activity |
| Reports to | The Audit Committee Chair and the senior leadership team | The senior leadership team |
The purpose and benefits of an internal audit function
Internal audit combines audit, consultancy, and advisory skills to add value to businesses, by identifying synergies, cost savings, and asset safeguarding.
Internal audit’s ability to provide consultancy and advisory services to businesses can be more cost effective than outsourcing and has the benefit that internal audit is familiar with the business operations and ways of working to provide tailored recommendations.
The internal audit function has relationships across the business and could be able to access information faster, as confidentiality and sharing of information is already outlined and agreed in the Internal Audit Charter. This should be assessed against whether the internal audit function has the appropriate skills to support on projects and engagements, liability and influence of office politics and culture on the consultancy and advisory work required.
Internal audit enhances quality control by providing an additional layer of review for management where necessary, which is independent, objective, and unbiased. This could be beneficial, particularly with financial controls, as improvements can be identified and remediated in advance of external audit or allow external audit to reply on the work performed by internal audit; potentially reducing their scope of work and cost and improving the integrity of financial reporting.
Tailor internal audit for your business
Internal audit can be structured to accommodate budget, flexibility, complexity, and scale of operations within the business. This can be addressed by either having an in-house, co-sourced, or outsourced internal audit function.
In-house is when the internal audit function are employees of the company. A co-source arrangement is when the internal audit function is in house but are support by an external company; usually for when subject matter expertise is required for specific/complex audits which cannot be performed in-house. An outsourced agreement is when the internal audit function is performed by an external company.
Overall, internal audit adds value to operations and supports the strategic objectives of the business and should not be looked as a compliance burden, instead as a trusted advisor collaborating and supporting the business to achieve their strategic objectives.
Summary of the benefits of an internal audit
- Gives assurance to key stakeholders that controls and designed effectively and are operating efficiently
- Unbiased objective assessment on the control environment and recommended improvements
- Potential reduction of risk and documented evidence of process improvement through action tracking
- Drives accountability within the management team to make improvements in a timely manner
- Strengthens corporate governance and promotes transparency of information and a culture to follow processes and procedures outlined as best for the business
- Supports transparency of information to inform and enhance decision making