Internal audit (IA) departments are necessary, yet often they are viewed as stern entities to be complied with, rather than celebrated for the value they create. Among the many things that go unnoticed in their work is the fact that they themselves must undergo an assessment every five years. This external quality assessment, or EQA, is performed by an independent third party to ensure the internal audit function conforms to The Institute of Internal Auditors (The IIA) standards. Some pass with flying colors. Others get a qualified pass and a laundry list of recommendations to work on over the next five years.
Five years ago, just as the internal audit department of a large food manufacturer in the U.S. was due for its EQA, things at the company were in a flux. A new chief audit executive (CAE) was in charge of the department, and with just six months on the job, he welcomed all the help he could get. The department was doing a good job of assessing risks, but improvements were both possible and expected. To this end, the CAE solicited EQA bids from a number of external firms, looking for a bidder that would deliver not just an assessment on conformance to the standard, but provide the IA department with clear and actionable recommendations that would help bring it up to the level that was desired internally. He selected Protiviti to do the job.
In the assessment, the department received a mark of “partially conforms” — acceptable, but not the best for a Fortune 500® company with a century-long history of quality. In large and busy companies, even those with the best intentions, consultant recommendations for improvement often end up on a shelf to get to later, but in this case, the chief auditor took them to heart. Perhaps the reason was the eagerness of the new CAE to do the right thing; perhaps it was the desire to reinvent the internal audit brand, from a “watchdog” department to a strategic partner that can be relied on for strategic advice and improvement opportunities.
In either case, the CAE set out to do the following:
>> Change the perception. To help the department transition from a “finger pointing” to a “value adding” department, internal auditors were trained and encouraged to adopt future auditor principles — not just traditional compliance ones. This resulted in a marked improvement in their reputation inside the company.
>> Audit the auditor. After receiving the EQA score, the internal audit department implemented a more structured audit process, better documentation, and a self-imposed set of quality guidelines to enhance its contributions to the company as a whole. The auditors applied the same scrutiny to their own processes as they did to others and were better able to empathize with the auditing process as seen by the rest of the company.
>> Understand the root causes of problems on the business side. In addition to identifying where problems occur, the internal audit team sought to understand how and why things broke down so problems could be avoided, or fixed quickly in the future.
>> Improve reporting clarity. To improve the way recommendations were received, the internal audit team made a concerted effort to simplify the language of its reports and summarize recommendations when presenting them to the board. The result was greater understanding, executive buy-in, and faster implementation of internal audit recommendations.
Five years later, on its second EQA, the company received a “generally conforms” internal audit rating — the highest rating. The internal audit department had excelled in its five-year effort. More important, Protiviti noted the extraordinary growth of the internal audit department compared to its competitors and provided it with recommendations for improving even further — a road map for the next five years to help solidify the role of the department as a respected partner within the company.
But the real story here is perhaps a different one: The food manufacturing giant is the latest in a new breed of companies whose internal audit departments purposely have set out to shift from a “policing” role to that of a strategic adviser to the executive board on key decisions. By transforming in this manner, this company’s internal audit department successfully changed its reputation from “to be endured” to “in demand.”
A stakeholder recently remarked, “Our internal audit function has gone from being a good department to being a great department.” A constructive external quality assessment, best-practice recommendations and a chief auditor with a future auditor mindset and a desire for continuous improvement can take the credit for that.