Change is a feature of doing business, but managing it successfully can be complex. This guide outlines how internal audit can help project managers implement changes by adopting good practices throughout the project life cycle.

Amid finite resources and budgets, it is critical that organisations focus on changes that offer the highest value when faced with many project requests. Once identified, the second challenge is to complete the projects successfully. 

Given its broad skill set, internal audit is well placed to provide independent, objective and value-adding oversight of major projects and assess their health and viability. A flexible approach will be needed, taking into account the nature of the individual projects.

Teams involved in these projects may be using a traditional ‘waterfall’ approach with its structured sequence of key activities and stages, or a more agile methodology, where activities are completed in shorter and more intense timeframes. Either way, the criteria for completion should be clearly defined at each point of the project life cycle.

Below, we highlight factors that will help keep internal audit’s role relevant and provide an outline of practices to apply to help project teams succeed. The principles and practices we set out in our guide are scalable and can be implemented in a proportionate way to fit an organisation’s size.

• ICAEW faculty members can download the full-length guide.

Factors to keep internal audit relevant:

• Internal audit must have a technical appreciation of both traditional (waterfall) and agile approaches to ensure it can help spot issues and challenge project managers at the right points in the project life cycle.
• Speed is essential. Internal audit needs to be comfortable giving views and opinions in a fast-moving environment.
• Internal audit must work with project teams, not against them. Ensure all stakeholders understand internal audit’s role and the scope of its assurance work.
• Internal audit should participate throughout the project’s life cycle.
• Internal audit must make practical and realistic recommendations.
• Every project is unique and so internal audit needs to give its view of ‘what good looks like’.

Establishing good practices

Set out terms of reference and build team rapport

Internal audit should seek to embed itself in the project by attending regular progress and update meetings.

Identify risks, mitigate and plan for contingencies

Internal audit’s scope and remit mean that it is in a unique position to get a sense of whether there is a problem and what needs to be corrected.

Progress reviews

Internal audit can provide insights and assurance after each milestone. The main stakeholders and project members should be invited to contribute to the milestone reviews.

Real-time reviews

Real-time audits will show the project team how it will be assessed post-implementation, so it can address potential mistakes.

Related topics

How do you audit a robot? 
Guidance for internal auditors on how to provide assurance over the key risks involved in implementing robotic process automation (RPA).

How to audit culture
This practical guide outlines the eight steps to follow to conduct a successful internal audit of culture.

How to audit the cloud
Guidance on how to conduct an effective cloud audit with a focus on cloud security, operational resilience, supplier management and legal and regulatory compliance.