E
Q
Internal Audit — Adding Value To Your Company
Is Your Audit Plan Keeping Pace With Your Business?
Liam McCaul – Partner, Risk Advisory Services
Duncan Edwards
e
q
Objectives
To consider four questions:




Why do we need to demonstrate the value of
internal audit?
What do we mean by ‘value’?
What are the key drivers that deliver internal audit value?
How do we measure value?
e
q
Why do we need to demonstrate the value of
internal audit?




Internal audit now higher up the boardroom agenda.
Commercial pressures to derive the maximum benefit from
all resources employed.
Greater corporate governance focus.
The objective to ‘add value’ is now explicit in the IIA’s
Standards for the Professional Practice of Internal Auditing.
e
q
Definition of Internal Audit
“Internal auditing is an independent, objective assurance and
consulting activity designed to add value and improve an
organisation’s operations. It helps an organisation accomplish
its objectives by bringing a systematic, disciplined approach to
evaluate and improve the effectiveness of risk management,
control and governance processes.”
Institute of Internal Auditors UK and Ireland
e
q
What do we mean by ‘value’?
“Things only have the value that we give them”
Molière
e
q
Stakeholder expectations



Who are your principal stakeholders?
- Audit Committee
- Executive Management
- Line Management
- Customers
- Regulators (including External Auditors)
How do they value internal audit?
Are you sure that is still what they want?
“Since events such as Worldcom and Enron, and the subsequent legislative and
regulatory changes, key stakeholders in most organisations, such as the Board
and the Audit Committee, have different expectations of their internal audit
function.”
‘Finding Your Level – Internal Audit Benchmarking Survey’ (Ernst & Young)
e
q
What do we mean by ‘value’?
“The most valuable thing an internal audit function can provide is
independent assurance on the effectiveness of controls over risk”
Simon D’Arcy - President of the Institute of Internal Auditors 2007
e
q
The “Pendulum Effect”
Has the Pendulum Swung too Far?
Drivers
Corporate
Scandals
Management
Expectations
Internal Audit
RISK
STRATEGIC
OPERATIONAL
COMPLIANCE
FINANCIAL
Approach
Consultative
Assurance
Skills
Innovative/Collaborative
Technical/Execution
e
q
Regulatory
Change
‘The Value Agenda’


IIA Survey of Heads of Internal Audit, CEOs, CFOs and
Audit Committee Chairs.
Sought responses on a range of issues related to the value
generated by internal audit including:
- how and where internal audit adds value?
- how value is measured and demonstrated?
e
q
The Value Agenda – Sources of Value
“Which aspect of internal audit’s role is of primary importance
in terms of value to the business?”
1. Assurance that major business risks are being managed
appropriately (72%).
2. Assurance that the internal control framework is operating
effectively (68%).
3. Identification of new business risks (41%).
4. Detection and prevention of fraud and irregularities (30%).
5. Improving Business performance by sharing knowledge of best
practices (29%).
6. Use of Knowledge and experience to tackle urgent issues (24%).
e
q
What are the key drivers that deliver internal
audit value?
Purpose
Value
Strategy
Right
Direction
Right
Right
People
people
Properly
Properly
equipped
Equipped
Team/
Team /
Organisation
organisation
structure
structure
Relationship
Relationship
management
Management
process
process
Knowledge
Knowledge
Management
management
Customer/business
interface &
Customer
/ right
behaviours
business interface
Facilitates
Resource
Skills and
And
skills
Skills
development
Development
Operational &
Operational
performance
management
management
Supporting tools
Tools and
& technology
technology
Delivery
IA
methodology &
methodologies
execution
Delivery of
promises
Defines
Provides
Provides
Quality
Support
and
Assurance
development
Efficient and
Delivery
effective
infrastructure
delivery
infrastructure
Leadership/Change Management
e
q
Value to
stakeholder
How do we measure value?
“Everything that can be counted does not necessarily count;
everything that counts cannot necessarily be counted”
Albert Einstein
e
q
How do we measure value?
BADLY!!!
The IIA Survey identified that:
 75% of Heads of Audit are not required to formally
demonstrate the value they deliver.
 Quantitative measures were focused on inputs and process
efficiency rather than outputs and value.
 Qualitative measures were “woolly, subjective and difficult to
pin down.”
e
q
Demonstrating Value – a personal view




A balanced scorecard process is in place for IA.
The measures and KPIs used to measure performance focus on
what is created, not what is input.
A formal monitoring process is in place with the key
stakeholders to validate the scorecard and plan for
improvements.
IA management and staff believe intrinsically in the value
scorecard approach and continually strive to improve
performance beyond agreed targets.
e
q
Demonstrating Value – a personal view

Communication – get the message out and make sure the
‘perception of value’ is in your favour.

There is an effective stakeholder and customer feedback
process. Leading functions will adopt a combination of post audit
survey forms and one to one meetings with key business
management/stakeholders.

The value measures, targets and feedback processes used will
directly focus upon the agreed roles and responsibilities and,
therefore will change as the roles and responsibilities evolve and
change.

Leading functions will open themselves up to independent quality
assurance process. The Institute of Internal Auditors recommend
that this is undertaken at least once every 5 years.
e
q
A Framework for demonstrating value
Stakeholders
Agenda
Value
Drivers
Understand who
your key
stakeholders are
and what they
value
Value Charter
Value
Attributes
Value
measurements
Value
scorecard
Detail the specific
attributes
that are required to
be demonstrated
Detail agreed means
to measure value
delivered. Where
measures are softer,
commitment from
your stakeholders to
help measure the
value delivered is
critical
The Scorecard
should contain
actual examples of
how the value
attributes were
delivered
e
q
Demonstrating Value – ‘hard measures’
Hard measures of the value delivered by internal audit may include:
Description
Unit of measure
Client satisfaction survey results
Ave. scores
€€€
Cost savings or incremental revenue attributable to internal
audit recommendations
Degree of completion of the internal audit plan
% completed
Requests for internal audit input into business projects
No. of requests
Best practice opportunities highlighted/recommended
No. highlighted
Business sponsorship of IA recommendations
% accepted
Time taken to issue final reports
Implemention of IA recommendations
No of days
% Complete
e
q
Adding value to your company
Summary




This is now a requirement of our profession – it is not just
‘nice to have’.
Be clear who your stakeholders are and what they value.
Critique your function – has it the “right direction, right people and
is it properly equipped” to deliver value.
Reporting should be formal, contain qualitative and quantitative
measures and be aligned to your stakeholders’ value drivers.
If there was no formal requirement to have an IA function,
would your organisation still have one?
e
q
A final thought…
“Strive not to be a success, but rather to be of value”
Albert Einstein
e
q
Ernst & Young
www.ey.com/ie/risk
Ernst & Young, Ernst & Young Building, Harcourt Centre, Harcourt Street, Dublin 2.
Is Your Audit Plan Keeping Pace With Your Business?
© 2007 Ernst & Young.
All Rights Reserved.
Ernst & Young is a registered trademark.
Duncan
Edwards
e
q