When identifying the one factor that makes their internal audit functions relevant – or provides the most potential in delivering on the goal of relevance – the top choice among CAEs and internal audit leaders and professionals is high-impact reporting. While this finding punctuates the importance of impactful communications, there is more to the high-impact reporting story that internal audit leaders must recognise.
Which one of the following areas do you believe contributes MOST to making an internal audit function relevant?
What our research reveals
- Across all organisation types and internal audit maturity levels, using high-impact reporting to deliver and communicate value from and through internal audit’s activities stands out as the greatest contributor to what makes internal audit relevant in organisations.
- Within lower-maturity internal audit functions, there is greater need to upskill teams in high-impact reporting, and broader communication, capabilities.
Reporting excellence hinges on the quality, timeliness and optimisation of most, if not all, activities and processes throughout the audit lifecycle.
First, high-impact reports are not achieved through a single process. Instead, reporting excellence hinges on the quality, timeliness and optimisation of most, if not all, activities and processes throughout the audit lifecycle – including risk assessment, scoping/planning, project status, audit committee reporting, and issue follow-up and validation. High-impact reporting is about timeliness, as well as both form and content, customising the reporting communication to the audience to ensure stakeholders ranging from control operators to executives and board members have the information they need, when they need it, to allow for quick and quality analysis and decision-making. Increasingly, we are seeing reporting formats that heavily leverage data – these create more dynamic ways of interacting with report data and other content.
Second, high-impact reporting should extend beyond audit reports to all other internal audit communication touchpoints, including planning memos, status checkpoints, advisory and consulting activities, audit committee decks, executive summaries, and risk assessment reporting. Internal audit groups with leading reporting capabilities also call on the foundational enablers of high-impact reporting – relevance, risk-centeredness, conciseness and insightfulness – in their verbal communications with stakeholders throughout their organizations.
- Relevant reporting and communications require deep considerations of multiple stakeholder groups and customized messages and communication modes that address the unique needs of each of those groups and are provided timely to allow for analysis and decision making.
- Risk-informed reporting and communications require internal audit to be dialed into those risks – and objectives – that are important to the organisation. Dynamic risk assessments can be used to gain insights into these risks, which often link to the execution of the organization’s business strategy, operations, compliance activities and financial goals, enabling internal audit to audit at the speed of risk
- Concise reporting and communications require internal audit groups to rethink the way their messages are developed and delivered – with a mindset of “How do I say more, with less?” and “What are the absolutely critical pieces of information we must communicate?” These reassessments generate innovations that make better use of data and visual appeal, which helps get messages to key stakeholders quicker and more clearly.
- Insightful reporting and communications do more than inform executives and other stakeholders of what they already know by conveying new perspectives, analyses and suggestions. Generating fresh insights requires new approaches and tools throughout the internal audit lifecycle, including advanced automation, dynamic risk assessments, agile audit techniques and process mining, together with appropriate data access and governance.
Digitally proficient, Next-Generation Internal Audit groups are more likely to create high-impact reports. These leaders are also more likely to apply the four high-impact reporting enablers throughout the audit cycle. Making risk assessment activities insightful requires asking what the assessment is telling us that is new or has changed in a notable way, for example. If reporting is to be risk-informed at the audit committee level, audit leaders must continually ask whether those reports align to the organisation’s most critical risks and provide the risk insight that audit committee members require.
The bottom line: Our research shows that internal audit leaders should prioritise developing impactful communications to elevate their relevance in the organisation.
Explore the results of our research
Survey Methodology and Demographics
Protiviti conducted its global 2023 Next-Generation Internal Audit Survey online from November through December 2022. More than 550 internal audit leaders and professionals (n = 573) completed the survey questionnaire, two-thirds of whom reported as a CAE or Audit Director.