We are often asked for advice about setting up a new internal audit function, or indeed about revamping an existing one. Is there a best practice way of managing internal audit for particular types of organisation?
In response the institute’s Policy and Technical Team has done some research on the different models and published it on our website. In our report, Models of internal audit, we look at six main delivery models and outline the advantages and challenges of each.
We use practical case studies based on interviews with the heads of internal audit at TfL, BT Group, Mid-Kent Internal Audit Partnership, the Irish Department for Public Expenditure and Reform, the University Internal Audit Consortium, the Mersey Internal Audit Agency, the Civil Aviation Authority and Baker Tilley.
So, which is the best model?
Unsurprisingly our conclusion is horses for courses. There is no right or wrong way to deliver internal audit. Organisations need to be free to choose what works for them according to the nature of what they do, how the organisation is structured, the way processes operate, their financial circumstances and the risks to their strategic objectives. We hope that the menu of options on offer in our paper will help organisations to ask the right questions about their needs, and decide what will work for them.
We were, however, able to draw some general conclusions from the research. The first is that organisations care about and value internal audit. They spend valuable time considering how to develop and improve their own particular models. This is not just about keeping costs down, although that is important. It is about maximising the efficiency and effectiveness of professional practice – choosing a model that offers objective opinions, assurance and a range of experience and skills that positively impacts the way the organisation delivers success. The research also reveals that the profile of internal audit is being raised, creating higher expectations, new pressures and competition, and that it would not be surprising if new models were to emerge in future.
We identified a number of the common attributes emerging from the study that can be used to measure success in any service delivery model of internal audit operation, such as a structure that promotes independence and objectivity, knowledge of the organisation, its markets and risks, and expertise in areas such as IT and contracts.
So how you structure your internal audit does not appear to be as important as how it is able to operate and what it does in practice. Again, this is not a surprising conclusion as it is the global standards that count, not how you apply them in detail.
I hope you find the report useful, both in looking at your own function, but also in your discussions with stakeholders, especially audit committees, about how your operation compares with others and what reform or fine tuning could bring in practice.