Internal Audit--Finding a better way.

• Author: Ruff, Jennifer

Audit does not need to be a scary word. Auditors have dual functions--providing process-driven assurance and offering consultation or an advisory role on elements of a corporation. In this article, the author explains how internal audits work within Parliament's unique context and why the advisory function opens the door to collaborative efforts to improve this institution for Members of Parliament, staff and the public-at-large.

First impressions

Odds are when you hear the word audit, you cringe. At home, it definitely does not conjure up a positive image and can cause an instant headache. Similarly, in the workplace, the mention of an internal audit can cause suspicion, anxiety or concern. As a function, internal audit is often viewed as a policing activity that looks to find fault or wrongdoing, creating a sense of intrusion with little or no value for those involved. Clients of audit engagements can be left with a sense of being investigated or put under the microscope, and some even feel as if their jobs are on the line.

The discipline of internal audit has struggled with this image for years and efforts have been made to better describe and define its activities and outcomes by putting a focus on results and relevance. In the process, auditors have become trusted advisors for management in the quest for effectiveness and efficiency. But, as there is often a focus on compliance, negative feelings associated with judgment and investigation have proven difficult to overcome and they often overshadow the valuable work done under the umbrella of audit.

The audit challenge

To better understand the challenge in successfully delivering the audit function it is first important to highlight that internal audit consists of two types of activities, assurance activities and advisory activities. Assurance activities are those engagements that examine controls and processes to look for compliance with a standard or expected result in order to give assurance to management, or other stakeholders, that those controls are functioning as expected. Generally, controls exist to protect the organization from fraud or mistakes that could have a negative financial, operational or reputational impact on the organization.

Assurance activities are those for which internal audit is better known. They are the more traditional, process-driven, formal engagements that result in mandatory reporting to senior management, Boards of Directors and often outside stakeholders. These types of engagements also require that a formal action plan be developed by management to address the findings of internal audit and follow-up is conducted by audit to ensure that these action plans are implemented.

The second, and lesser recognized, set of activities that audit undertakes are consulting, or advisory, activities. These engagements are much less formal and typically only involve responding directly to the client involved. Advisory activities can include many different types of support or guidance and can range from quite informal to more standardized examinations. Advisory work can include things such as process mapping, benchmarking, risk assessments, gaps analyses, lessons learned exercises, and professional advice. Advisory work can address activities and processes other than just risk and internal controls and, in essence, can be leveraged to examine any element of the organization. The nature of these advisory activities allows us to take a more service or client-driven perspective.

While examining compliance and controls through assurance activities is important and has its place in sound management of any organization, it does not have to be the sole focus. The challenge facing our audit function is to find the best balance of assurance and advisory activities to effectively support the House of Commons Administration, but also to increase trust and impact. As we look to address this challenge and improve the delivery of our services, I feel that it is the advisory side of internal audit that offers the best value for our organization. Progress has already been...