Healthcare high achiever finds a new path to internal audit excellence

Finding Opportunities for Strategic Gains

When a new chief audit executive (CAE) came on board at the healthcare nonprofit company, she knew she was assuming responsibility for a leading-class internal audit organisation that sought to drive value back into the business. She wanted to identify opportunities to improve audit operations further and ensure  that  her  department was not only an example of excellence within the organisation but a leader in internal audit practices across all industries. She was aware the audit function was more advanced in some areas than others, and wanted clarity: Where were the greatest opportunities for strategic gains in their internal audit approach?

The CAE embraced Protiviti’s next-generation internal audit (IA) framework as an effective tool to assess how her department could become more agile and take advantage of new technologies.  The  next-gen  internal audit framework acknowledges the changes organisations face: increased regulation, need for heightened levels of governance and control, higher stakeholder expectations and the imperative to provide assurance using the most current and relevant data. It is a flexible model that supports audit transformation with the right technology, resources and methodology  and  encourages  innovations in audit governance and infrastructure. Adopting the next-gen framework can help to facilitate an agile audit approach through the use of advanced analytics, intelligent process automation and other cutting-edge technologies. These advantages are particularly relevant to healthcare, which is under constantly increasing regulatory and financial pressures.

Adopting a Framework for Success

The next-gen IA framework encompasses 12 components across three areas: governance, methodology and enabling technology.

• Governance includes defining a strategic vision, developing an organisational structure that supports flexible coverage, and sourcing and retaining talent by employing new, flexible resource models. It also aligns enterprise assurance across the three-lines model: management control (the first line), the various risk, control and compliance oversight functions established by management (the second line), and independent assurance (the third line).
• Methodology includes taking a dynamic approach to risk assessment and emphasises continuous and real-time review of business processes through data monitoring. It drives an organisation towards high-impact reporting to deliver relevant and timely insights. By promoting an agile audit approach, next-gen IA supports more flexible audit plans focused on adding value.
• Enabling technology includes leveraging robotic process automation to replace repetitive human-computer interactions, and advanced analytics to deliver proactive and effective assurance. In addition, process mining can be used to uncover deviations, weaknesses and delays in internal systems, while machine learning  and  artificial  intelligence  can  help detect predictive patterns in data.

Adopting a Framework for Success

The next-gen IA framework encompasses 12 components across three areas: governance, methodology and enabling technology.

• Governance includes defining a strategic vision, developing an organisational structure that supports flexible coverage, and sourcing and retaining talent by employing new, flexible resource models. It also aligns enterprise assurance across the three-lines model: management control (the first line), the various risk, control and compliance oversight functions established by management (the second line), and independent assurance (the third line).
• Methodology includes taking a dynamic approach to risk assessment and emphasises continuous and real-time review of business processes through data monitoring. It drives an organisation towards high-impact reporting to deliver relevant and timely insights. By promoting an agile audit approach, next-gen IA supports more flexible audit plans focused on adding value.
• Enabling technology includes leveraging robotic process automation to replace repetitive human-computer interactions, and advanced analytics to deliver proactive and effective assurance. In addition, process mining can be used to uncover deviations, weaknesses and delays in internal systems, while machine learning  and  artificial  intelligence  can  help detect predictive patterns in data.

Next-Gen Gap Assessment and Benchmarking

The CAE asked the Protiviti team to perform a capability maturity assessment leveraging the Protiviti next-gen IA model, including the development of a road map of initiatives to drive an increased level of maturity and value back to the organisation. The CAE sought measurement of her department’s maturity within each next-gen IA component and a comparison to healthcare industry peers. She also pressed for comparisons to top-performing internal audit organisations from the financial services industry, which tends to be a leader in internal audit operational excellence.

To facilitate the assessment, the CAE supplied past deliverables like committee charters, external quality assessments and audit reports to enable a thorough understanding of the IA group’s current state. Stakeholders in the organisation were key partners in formulating observations and recommendations for improvement, as well as assessing the investment of capital and effort to implement potential solutions. The effort culminated in planning specific actions and initiatives into a road map of improvements to increase maturity.

Near term:

• Governance initiatives included an updated statement of strategic vision with greater focus on delivery of value, efficiency and stakeholder relationships.
• Talent management enhancements included rotation of resources to compensate for scarce skill sets, and recognition programmes to encourage critical cultural behaviors.
• Methodology enhancements included enriching the content and timeliness of current audit reports.

Long term (over a three-year horizon):

• Enabling technology initiatives included expanding capabilities in data and analytics and leveraging the enterprise’s existing technology investment to build RPA and AI capabilities for internal audit.
• Methodology enhancements included enhancing audit processes with Agile concepts.
• Other methodology enhancements included developing continuous monitoring activities for top risk areas to take advantage of investments in analytics and other applications reporting capabilities and to provide increased value back to the business.
• Training initiatives included understanding of next-gen concepts and innovative thinking, and leveraging learnings from peer institutions to accelerate progress.

The Benefit of Foresight

The road map was completed just prior to the onset of the coronavirus pandemic. By the time the organisation was feeling the pandemic’s effects, IA had already achieved significant improvements in data analytics, risk assessment, and audit reporting. The effort proved especially timely in two areas:

• The talent pool near the client’s headquarters was neither abundant nor diverse. A remote workforce mentality, adopted recently by the client to adjust to the pandemic, enabled a broader recruiting effort — just in time to leverage the gains in next-gen IA methodology.
• As the enterprise began to feel the pandemic’s impacts, a more agile risk assessment and planning approach helped adjust existing audits based on risk prioritisation and readiness to undertake the work, with a focus on audit value.

Our client’s drive to improve operations led them to explore next-gen IA methodologies and tools, which led to just-in-time changes to processes, positioning the healthcare nonprofit organisation to perform well in unforeseen pandemic conditions. When circumstances permit, the road map will enable rapid resumption of their quest for audit excellence.

The Benefit of Foresight

The road map was completed just prior to the onset of the coronavirus pandemic. By the time the organisation was feeling the pandemic’s effects, IA had already achieved significant improvements in data analytics, risk assessment, and audit reporting. The effort proved especially timely in two areas:

• The talent pool near the client’s headquarters was neither abundant nor diverse. A remote workforce mentality, adopted recently by the client to adjust to the pandemic, enabled a broader recruiting effort — just in time to leverage the gains in next-gen IA methodology.
• As the enterprise began to feel the pandemic’s impacts, a more agile risk assessment and planning approach helped adjust existing audits based on risk prioritisation and readiness to undertake the work, with a focus on audit value.

Our client’s drive to improve operations led them to explore next-gen IA methodologies and tools, which led to just-in-time changes to processes, positioning the healthcare nonprofit organisation to perform well in unforeseen pandemic conditions. When circumstances permit, the road map will enable rapid resumption of their quest for audit excellence.