What is successful internal audit? By what clear criteria can the success or otherwise of internal audit be decided and defined? Well it sort of rather depends on what you think internal audit’s key role is. Is it to provide audits? To provide assurance? To assess risk? To ensure clients manage risk?
In a ‘thin value’ version of internal audit, (thanks to Umair Haque for the term) internal audit is simply there to provide audit. Look at most externally provided versions of internal audit and this is what is measured. How much of the audit plan is done? How many days of audit have been provided? If you are lucky some wider measures are considered, like the grade of staff doing the work or the speed at which outputs are produced. But there is little assessment of the quality of the outputs. It is also a myopic approach to audit (see my previous post on ‘audit myopia’).
If one adds a little thickness to the conceptualisation of internal audit success one can consider that the output of internal audit should be assurance. So then one would assess audit successful on the basis of how much, how high quality, the assurance provided is. This feels no more satisfactory than assessing internal audit as producing audit. Again it is a measure of production and outputs, not results.
So, thicken the conceptualisation of value a little further, then we get to internal audit’s role to assess risk. Here the measure is how accurate, how prescient and how high quality the risk assessment is. Again it is a producer measure of success. As internal audit standards would make clear it is not the responsibility of the internal audit function to manage risk. So, therefore, is the measure of the performance of internal audit just the accurate assessment of risk only?
Finally, really broaden internal audit’s value proposition and you get to internal audit’s role to more successfully enable their clients’ risk management processes. Here audit standards would stay that internal audit’s success could only be measured vicariously by this measure. This is true given audit independence should be maintained. Would I as an auditor want to be measured by the success of my clients? Well, yes, but only vicariously.
So then any broad conceptualisation of internal audit value creates issues of ascription to internal audit and narrow the conceptualisation to a point where is it fully ascribed to internal audit, it creates issues of making it meaningful. I would therefore want to consider internal audit on all measures, both thin and thick. Any professional service has issues of what they deliver and what they are accountable, but not responsible, for. Internal audit has this and a layer of professional independence to consider. This puts any measure of success that is meaningful from a client perspective to require at least some element of vicarious responsibility ascribed to internal audit.
I do not believe internal audit is simply a producer and should be measured on producer measures only, neither do I think the outputs are easily and directly measured for internal audit. We are, and should be independent, but we should also be vicariously responsible for our clients’ success. Good internal audit is independent and yet dependent. It is this small measure of vicarious dependence that makes internal audit successful in my view. What do you think?