Heads of Internal Audit Benchmarking Report – Internal Audit Strategic Plans
Heads of Internal Audit Benchmarking Report
Internal audit strategic plans
Introduction
This short report provides a summary of results for the IIA’s survey on
internal audit strategic plans. The aim of the survey was to establish
whether internal audit activities are preparing strategic plans, what is
included and how the consultation and approval process operates.
The results include answers from 152 members provided during the 22 day
period 13 August 2012 to 3 September 2012. To get an overview of
organisations that respondents operate in, general questions around industry
sectors, size of audit teams and audit charters were asked. The split between
private and public sector organisations is 61% and 39% respectively, which is a
higher response than normal from the public sector. (For most IIA surveys the
private: public sector division is normally 75%:25%)
The largest groups responding to the survey are central government, local
government and insurance, combined these represent 35% of the total. The
majority of respondents have audit teams between 1and 10 members (72%)
and 95% have internal audit charters. We also note that most heads of internal
audit report functionally to the audit committee although there are some who
report to the CEO of Finance director.
Background
Guidance has recently been published by IIA Global (Developing the Internal
Audit Strategic Plan Practice Guide) and IIA UK and Ireland (Top tips preparing
an Internal Audit Strategy) on internal strategic plans. Therefore, it seemed
timely to undertake a survey to gain an understanding of whether internal audit
activities have a strategic plan in place. IIA Global within the executive
summary of their guidances states:
“For internal audit to remain relevant, it should adapt to changing expectations
and maintain alignment with the organisation’s objectives. The internal audit
strategy is fundamental to remaining relevant – playing an important role in
achieving the balance between cost and value, while making meaningful
contributions to the organisations overall governance, risk management, and
internal controls.
A systematic and structured process can be used to develop the internal audit
strategic plan, helping to enable the internal audit activity to achieve its vision
and mission.”
The guidance also recommends that CAE’s review their strategic plan to check
for:
October 2012

Changes in the organisation’s strategy.

Degree of the organisation’s growth and assessment of organisational
maturity.

Degree to which the organisation and its senior management rely upon
the internal audit activity’s independent assessment and/or support
regarding the management of organisational risks.

Significant change in the availability of the internal audit activity’s
resources.

Significant change in laws and/or significant changes to organisational
policies and procedures.
1
The IIA - leading the profession of internal audit.
Heads of Internal Audit Benchmarking Report – Internal Audit Strategic Plans
Strategic planning

Degree of changes in the organisation’s control environment

Key changes in an organisation’s leadership team and board of director
composition.

Evaluation of how the internal audit activity has qualitatively or
quantitatively delivered on this strategic plan.

Results of internal/external assessments of the internal audit activity.
A key objective of our survey was therefore to identify whether strategic
planning is taking place. A total of 76%, over three quarters of respondents
have a strategic internal audit plan. Within the remaining 24% half intend to
write a strategy within the current or next year. Only 11 out of the 152 said that
they were not going to prepare an internal audit strategic plan in the future or
were unsure as to whether they would be doing this. We looked to see if there
was any correlation to the sector, size of the activity and whether they had
audit charters. It was shown to be a mix of sectors and sizes of audit teams
and they all had audit charters in place.
Some of the reasons given for not having internal audit strategic plans in place
are:

Focus is on the 1 year tactical plan

Information recorded in more than one document

Rapidly changing environment

New to the role.
These figures are telling us that the majority of internal audit activities are
taking a long term view of their objectives and priorities. We have also looked
at the nature and content of these strategic plans.
Preparing an internal audit stategic plan
Recent IIA Global guidance on developing the internal audit strategic plan
advises that the chief audit executive should consider IPPF (International
Professional Practices Framework) when developing the internal audit strategic
plan. Of the respondents to this question 58% stated that IPPF were
considered.
Global guidance also advises that understanding both internal and external
stakeholder expectations and needs is a critical step in developing the plan.
The audit committee, senior management and external auditors where
highlighted in the survey as the main consultation contacts.
A wide range of information is incorporated within internal audit strategic plans
with the top three being: reference to corporate risk registers 90%; key
priorities for assurance 84%; and coordination with other assurance providers
74%. The ranking of these three shows that knowledge of the corporate risks
and priorities for assurance is the key focus of internal audit activities, which
conforms to the International Professional Practice Framework (IPPF). It would
also appear that most CAEs are aligning resources and priorities through
coordination of work with other risk and assurance providers.
October 2012
2
The IIA - leading the profession of internal audit.
Heads of Internal Audit Benchmarking Report – Internal Audit Strategic Plans
Information included in internal audit strategic plan
Reference to corporate risks
Key priorities for assurance
Co‐ordination with other…
Changes to IA resources
Key performance indicators
IA Vision
IA Mission Statement
Changes in IA methodology
Quality measures
Internal audit risk register
Key priorities for consultancy
Impact of professional practice
SWOT analysis
Financial forecast
Other (please specify)
PEST analysis
No.'s
0
20
40
60
80
100
Both KPIs and quality measures are highly scored for being incorporated in the
internal audit strategic plan. To ensure that the strategic plan produces the
right results it is important to monitor its execution and impact through the use
of performance goals. Out of the 13 options in the survey for monitoring
progress towards achieving plans over 50% included percentage of audit plan
completed, recommendations accepted/implemented, surveys and feedback
from both the board/audit committee/senior management and audited
departments, and timely closure of audit issues
Other items mentioned that are included within Internal Audit Strategy Plans
are:
Internal audit strategic plan approval
October 2012

Key systems

Organisational changes

Key areas for improvement
IIA Global guidance states that final approval of the plan should be obtained
from the board. Of the 99 responses to this question over half have the plan
approved by the audit committee and 38% have it approved by the board, chief
executive or a combination of committees.
3
The IIA - leading the profession of internal audit.
Heads of Internal Audit Benchmarking Report – Internal Audit Strategic Plans
Review and update
To remain relevant the internal audit strategic plan needs to be reviewed
periodically to take account of the organisation’s changing risk profile, as
required by the 2013 International Standards. This might include significant
changes in the law regulatory requirements or organisational policies and
procedures. The survey shows that the majority of internal audit activities are
undertaking strategic plan updates on an annual basis (71%). A further 23% of
respondents are undertaking this at least every 2-3 years. This shows that
internal audit strategic plans are kept current and relevant.
Conclusions
The survey shows that there is:

A high level of commitment by heads of internal audit to prepare, review
and update internal audit strategic plans;

Consultation at a senior level with management, the audit committee,
board members and external audit;

A wide range of information included in internal audit strategic plans;

Approval at a high level via the audit committee or a combination of the
audit committee, board, chief executive officer;

KPIs and quality measures are in place to monitor progress towards
achieving the plan.
Whilst this is reassuring we cannot become complacent in what we do but look
towards guidance and information available to improve. In addition to
guidance mentioned above examples of further information can be found using
the following links:
Ernst & Young: http://www.ey.com/GL/en/Services/Advisory/The-future-ofinternal-audit-is-now---Develop-a-well-aligned-internal-audit-strategy
Ernst & Young
http://images.forbes.com/forbesinsights/StudyPDFs/Unlocking_Strategic_Value
ofInternal_Audit.pdf
Q Finance: Aligning the Internal Audit Function with Strategic Objectives
October 2012
4
The IIA - leading the profession of internal audit.
+HDGVRI,QWHUQDO$XGLW%HQFKPDUNLQJ5HSRUW±,QWHUQDO$XGLW6WUDWHJLF3ODQV
&KDUWHUHG,QVWLWXWHRI,QWHUQDO$XGLWRUV
&KDUWHUHG,QVWLWXWHRI,QWHUQDO$XGLWRUV7KH,,$LVWKHRQO\ERG\IRFXVHG
H[FOXVLYHO\RQLQWHUQDODXGLWLQJDQGZHDUHSDVVLRQDWHDERXWVXSSRUWLQJ
SURPRWLQJDQGWUDLQLQJWKHSURIHVVLRQDOVZKRZRUNLQLW:HKDYHEHHQOHDGLQJ
WKHSURIHVVLRQRILQWHUQDODXGLWLQJIRURYHU\HDUV
7KH,,$SOD\VDQDFWLYHUROHLQWKHSXEOLFDUHQDEXLOGLQJDZDUHQHVVRILQWHUQDO
DXGLWLQJSURPRWLQJPHPEHUV¶LQWHUHVWVDQGFKDOOHQJLQJRUJDQLVDWLRQVWRUHDFK
WKHKLJKHVWVWDQGDUGVRIFRUSRUDWHJRYHUQDQFH
2XUInternational StandardsDQGCode of EthicsXQLWHDJOREDOFRPPXQLW\RI
LQWHUQDODXGLWRUVLQFRXQWULHV
:HDUHFRPPLWWHGWRHQKDQFLQJWKHUHFRJQLWLRQDQGSURIHVVLRQDOLVPRILQWHUQDO
DXGLWLQWKH8.DQG,UHODQGWKURXJK
'\QDPLFOHDGHUVKLSRIWKHSURIHVVLRQZKLFKPD[LPLVHVWKHUHSXWDWLRQ
DQGLQIOXHQFHRIRXUPHPEHUVERWKLQGLYLGXDOO\DQGFROOHFWLYHO\
6HWWLQJSHUIRUPDQFHEHQFKPDUNVDQGSURPRWLQJSURIHVVLRQDOLQWHJULW\
WKURXJKour InternationalStandards DQGCode of Ethics
&RQWLQXDOO\GHYHORSLQJRXUTXDOLILFDWLRQVVRWKDWWKHLUKLJKTXDOLW\DQG
UHSXWDWLRQLVPDLQWDLQHG
3URYLGLQJWHFKQLFDOUHVRXUFHVQHWZRUNLQJRSSRUWXQLWLHVDQGVXSSRUWWR
RXUPHPEHUVWKURXJKRXWWKHLUFDUHHUV
0DLQWDLQLQJRXUSRVLWLRQDVWKHPDUNHWOHDGHULQLQWHUQDODXGLWWUDLQLQJ
$ERXW+HDGVRI,QWHUQDO$XGLW
EHQFKPDUNLQJUHSRUWV
7KH,,$UHFRJQLVHVWKDWKHDGVRILQWHUQDODXGLWQHHGVSHFLDOLVWLQIRUPDWLRQDQG
VXSSRUWWRKHOSWKHPUHVSRQGWRWKHGHPDQGVRIDFRPSHWLWLYHDQGLQFUHDVLQJO\
UHJXODWHGEXVLQHVVFOLPDWH
7KH+HDGVRI,QWHUQDO$XGLW6HUYLFHLVDQH[FOXVLYHVHUYLFHGHVLJQHG
VSHFLILFDOO\IRUWKHOHDGHUVRIWKHSURIHVVLRQWRNHHSWKHPXSWRGDWHSURYLGH
QHWZRUNLQJRSSRUWXQLWLHVZLWKOLNHPLQGHGSURIHVVLRQDOVDQGWRGLVFXVV
VXFFHVVHVDQGFRQFHUQVLQFRQILGHQFHZLWKWKHLUSHHUV2WKHUVHUYLFHVLQFOXGH
DFFHVVWRWHFKQLFDOXSGDWHVDPRQWKO\HEXOOHWLQDSURJUDPPHRIIRUXP
PHHWLQJVDQGVSHFLILFDOO\FRPPLVVLRQHGUHVHDUFK
7KHEHQFKPDUNLQJUHSRUWVDUHGHVLJQHGWRKHOSPHPEHUVPDNHWKHPRVWRIWKH
6HUYLFH¶VQHWZRUNLQJRSSRUWXQLWLHV6HUYLFHPHPEHUVFDQSRVHDTXHVWLRQWR
RWKHUPHPEHUVWRKHOSWKHPLGHQWLI\EHVWSUDFWLFHRQDSDUWLFXODULVVXH
4XHVWLRQVIRUFRQVLGHUDWLRQFDQEHHPDLOHGWRFKULVEDNHU#LLDRUJXNRU
WHFKQLFDO#LLDRUJXN
'LVFODLPHU
7KLVPDWHULDOLVQRWLQWHQGHGWRSURYLGHDGHILQLWLYHDQVZHUWRDGGUHVVLQJ
VSHFLILFLQGLYLGXDOFLUFXPVWDQFHVDQGDVVXFKLVLQWHQGHGWREHXVHGRQO\DVD
JXLGH7KH,,$UHFRPPHQGVWKDW\RXDOZD\VVHHNLQGHSHQGHQWH[SHUWDGYLFH
UHODWLQJGLUHFWO\WRDQ\VSHFLILFVLWXDWLRQ7KH,,$DFFHSWVQRUHVSRQVLELOLW\IRU
DQ\RQHSODFLQJVROHUHOLDQFHRQWKLVJXLGDQFH
ZZZLLDRUJXN
&KDUWHUHG,QVWLWXWHRI,QWHUQDO$XGLWRUV
$EEHYLOOH0HZV&ODSKDP3DUN5RDG/RQGRQ6:%;
7HO)D[(PDLOWHFKQLFDO#LLDRUJXN
‹2FWREHU