Here’s an interesting question. What’s enough internal audit? Every internal audit contract I’ve ever seen has been driven by historical client precedent, financial resources available, numbers of staff available etc. Never has the CAE ever admitted to having too little resource to form their annual opinion. But what is too little internal audit or too much, and how should it be measured?
Most internal audit measures are measures of quantity, normally input quantity. I assume this is because it is easy to measure. The other reason is that the majority of smaller organisations consider that they are too small to have an in-house team and thus buy from professional services firms. These professionals are mainly non internal audit qualified accountants with a unified model of internal audit driven by days. Why days? Well that is the unit being sold. ‘What is the day rate?’ is the purchasing cry. Buying internal audit based on days and cost is, however, like buying a car on the basis of how much metal it contains. Why not measure how internal audit ‘drives’ or even how the brand ‘feels’. To my knowledge there is no internal audit provider brand. Yes the big four professional services firms give some assurance over quality, but this is heavily borrowed from their other service lines, not particularly through distinguished internal audit provision.
The other question about proportionality and quantity of audit is when delivering internal audit findings. I am often being challenged – this is not a management priority, it does not really need to be sorted in the greater scheme of things. I have tried in my career to work for, and with, clients that aim to be ‘world class’. Being world class means everything is good. Not just the front end. A world class car has every last little detail right. World class shoes are beautifully made from the best materials. World class bags differentiate with every last stitch. So I think it is for all organisations.
So I try to make internal audit reports that hold the relevant management team to those standards. Yes – it should be perfect right up to the point the marginal return exceeds the marginal benefit in my view. Also yes – internal audit is detailed and demanding. Quite right for any organisation that wants to be world class. The slap dash ‘it’ll do management team’ is in the realm of issue, not risk, management.
So is there a systematic problem with scale? Larger clients can always argue that every single element of their complex businesses is small in the greater scheme of things. So argue internal audit’s views are over the top. Similarly smaller clients always argue that they are too small to do things properly, because their overheads will not fund it. Again internal audit is over the top. I think internal audit should demand excellence, no matter the size of client. Computerisation and low costs of manufacturing have brought costs of doings things down so that all organisations can do things properly if they really want. Moral and ethical corporate responsibility should mean all businesses should pay the full cost of their business activity, including environmental and regulatory costs.
Perhaps the real challenge for internal audit is to sell the benefits to all organisations of good governance and that is the real problem with the lack of scale purchasing of internal audit. Governing bodies are notoriously bad at even seeing the work done by internal audit (normally hidden under an audit committee shield) let alone having an independent view over how much they really want or need. The wrong people in the main buy internal audit too – management. Only the really savvy management teams, in my experience, see the benefit of good governance, for it protects and enhances for the future, not the current, and that is a difficult message to sell as benefit.
So in my view, and I would say this, internal audit is woefully under resourced in most organisations for the demands and tasks placed upon it. So the answer to my question is you need more than you currently have. Perhaps we as a profession also need to get better at articulating how thin our annual opinions really are.