To answer this question, we must first decide why we have an internal audit function. What value does it provide for any organization?
My answer is that:
An effective internal audit function provides the risk-based assurance, advice, and insight[1] that leadership needs for success[2].
Adding to that:
- “Risk-based” refers to a focus on the more significant risks to the achievement of enterprise objectives[3].
- “Risk-based” implies that internal audit does not waste its limited resources providing assurance on sources of risk that don’t matter to leadership because they have minimal, if any, effect on the likelihood of achieving enterprise objectives.
- Assurance, advice, and insight are actionable[4] and delivered when they are needed[5], with appropriate speed. They are relevant, business-practical[6], and deliver what leadership needs to know when they need to know.
- Internal audit is focused on the risks of today and tomorrow[7].
- The function is agile, able to change direction and focus as risk and/or the business change[8].
- Information provided is concise and readily consumed and acted upon.
- An effective, quality internal audit function listens and learns. For example, it listens to management when assessing risk and considering responses to control weaknesses.
- Works well with others, such as other…
