Can you innovate your internal audit?

Is your internal audit department focused on the right target? Ask yourself some tough questions.

Many senior executives are taking a hard look at their internal audit expenditures, given the increasing pressure on corporate earnings and the need to slash their overhead expenses. The question they're asking is simple: "Are we getting the maximum value relative to our costs?"

At too many companies, the answer is "no."

Almost every major company across the United States employs an internal audit staff, with some departments numbering in the hundreds. The companies typically established the functions in the 1970s to improve their internal financial control environment. Since then, advances in information technology have meant more reliable control systems. As a result, time-consuming, routine testing often is less beneficial--often unnecessary. But, in some cases, the investments in computer technology coupled with computer audit techniques haven't translated into less auditing and fewer people.

So companies are struggling with the question of what they should be doing about internal audit. Business as usual, even incremental change, isn't good enough in these competitive times. With so much work that adds little value to the control environment or--more important--to bottom-line results, you need a more radical approach.

A QUALITY QUIZ 

What is the audit function currently doing in your firm? Before you can make any recommendations on redirecting your internal auditors, you need to review the function's existing role and responsibilities. More and more major companies, such as Anheuser-Busch, PepsiCo, Chase Manhattan Bank, Quantum Chemical, W. R. Grace and Southwest Bell, are examining what's going on and why.

Answer the following questions to give yourself a basis for making the changes you need to have an audit function that helps your company work more productively, efficiently and competitively.

* Does your internal audit department strengthen your company's system of internal controls and performance measures?

Internal audit is a primary resource supporting your company's overall internal control environment by providing an oversight function. The department should properly measure and evaluate risk and allocate the audit effort in the appropriate areas. It should produce cost-saving ideas to make the process more efficient and improve control, and it should serve as a key personnel resource to other departments and units of the company.

* How does your internal audit department compare to operational and organizational benchmarks of departments of similar size in scope of activity, cost-effectiveness, stature within the organization and staff size and experience?

Many companies use benchmarking to search for the best practices--those that lead to superior performance--within their industries. When you benchmark, you're determining what you must do to become a leader by studying the existing leaders. Not only must your internal audit department identify any gap in performance between its operation and that of the leaders; it must also forecast how rapidly the leaders are improving. Otherwise, your company may improve but still fall further behind.

* Does your internal audit department communicate effectively with management and the audit committee?

Internal auditors should be skilled in dealing with people and in communicating effectively. The reporting processes you establish must effectively communicate the results of the audit work to each of the internal audit department's "customer groups," including the audit committee, senior management, operating management and the external auditors.

* Is your internal audit department part of the management team, and does it generate cost-saving and process improvement ideas to help the organization achieve its goals?

An important aspect of this is whether the internal audit department is properly focused to meet the company's needs not only for today but for tomorrow. The department needs to address the changes in the business on an ongoing basis as a result of technology, diversification, organizational restructuring and new laws and regulations. In this way, internal audit is better able to adapt to future changes that affect your company and to give you meaningful ideas for improvement.

* Does your internal audit department use state-of-the-art audit tools and techniques for maximum effectiveness and efficiency?

As companies become more dependent on computerized information systems (CIS), developing, continually monitoring and periodically assessing the controls over these systems become more important and, in many cases, critical to your business success.

Conducting a quality assurance review will help you evaluate how good your internal audit department is at addressing CIS and applying advanced technologies. After all, automating manual procedures and mechanizing information systems impact your business operations and, in turn, the audit procedures you require.

Key points to examine in this area include CIS audit management, the technical and audit abilities of your CIS audit personnel, and the degree and quality of the interaction with information systems personnel. Successfully applying these technologies in the internal audit environment is a critical link to increasing your audit effectiveness and productivity.

SOUND FAMILIAR?

Over the last few years, quality assurance reviews of internal audit departments have turned up some common flaws in the way departments work.

First, there's often a lack of clear understanding among management and the audit committee regarding what the internal audit function is really doing. The expectations invariably exceed the reality, or the perceived audit effort varies from the work the department actually performs.

Second, companies often don't properly allocate audit resources to high-risk areas. The risk assessment process is often weak and doesn't relate to the real business and financial issues affecting the company.

Third, management often isn't getting what it considers to be substantive recommendations and observations from the internal audit department's reports.

Fourth, the level of reporting is sometimes either too detailed or not detailed enough for the different parties on the receiving end of this information. Management often thinks the department--which is in a unique position of seeing all aspects of company operations--doesn't share with the rest of the organization the best practices and good ideas it observes.

Finally, internal audit departments frequently lack the appropriate mix and skills of auditors. And the human resources goals are undefined. Companies often have no clear strategy for staff rotation and are indecisive about whether the department should be staffed by junior people who often simply document financial information or professionals who are qualified to ask questions and make value-enhancing recommendations.

Obviously, you have to implement solutions to the problems you identify in your quality assurance review. Though the problems will vary from company to company, you can follow these general guidelines to improve the impact internal audit has on your corporate bottom line.

* Make internal audit a part of your corporate management structure. By understanding management's perceptions and concerns, internal audit can be an asset in meeting your strategic challenges. One way to make sure that internal audit is "in the loop" is to have the function report to the CEO or the president instead of to the CFO. This organizational change will also give the function more of an operational focus.

* Encourage proactive participation in the process of improving productivity and delivering a high-quality product. It's time to get the auditors out of the back rooms and on to the front lines. You have to scrap the traditional charge for your internal auditors to collect data in favor of a new mission: to interpret the data and make suggestions for continuous improvements.

One way to get internal audit involved is through benchmarking, as discussed earlier. The internal audit department can assist you in this process by collecting and analyzing data. Then, because of their broad and in-depth knowledge of various corporate functions, your internal audit professionals can team up with management to implement the improvements identified as a result of the benchmarking process.

* Move toward operational auditing. This is a logical extension of the previous objective. Internal audit can and should play a prominent role in studying your operating practices and then eliminating errors, irregularities and redundancies.

* Employ the right kind of people. You're changing the game, so you might have to change the players, too. You'll still need people with financial and accounting backgrounds, but they need to have more diverse skills to perform operational auditing and provide business advisory-type services. Many companies make the mistake of changing the role of the function to fit the people they've hired, rather than vice versa. You'll need to move away from entry-level people and toward rising stars capable of interpreting information and making sound recommendations.

THE CHAMPIONS

Where will the efforts of internal audit departments be focused in the 1990s? Here are some examples of how companies are using their internal auditors to become more competitive.

Total Quality Management--TQM presents a dual opportunity for internal audit. At one Fortune 50 company that made a major commitment to TQM, the internal audit department implemented the concepts internally by measuring itself against established quality objectives; committing to performance contracts with its "customers," including the audit committee, corporate management, operating management, the external auditors and other groups to whom it supplies its services; and establishing quality control teams to define and implement quality improvement techniques.

Of equal importance, the internal audit department is making a significant contribution to the companywide TQM initiative. Because of its independence from the day-to-day management process, internal audit helps operating management establish the objectives and measurements integral to TQM. Subsequently, the department assists management in evaluating the success of the process by examining the effectiveness and integrity of the results.

Evaluation of Critical Success Factors--A major health care provider with more than 50 locations uses its internal audit function to evaluate the critical success factors for each of the firm's units. Each of the independent hospitals provides similar services in its geographical market.

Critical success factors, such as the number of occupied beds/days per month and the number of administrative staff per 100 beds, are common throughout the system. However, since each unit is located in a unique geographical market, each has specific features that aren't systemwide. For example, only some units have extensive offsite support facilities such as 24-hour emergency centers or outpatient surgical facilities. Each of these represents significant commitments of capital--and therefore are critical success factors applicable only to those units.

By assisting management in identifying and quantifying these factors and then evaluating the reporting of the data, internal audit has become a primary agent of change. It makes sure productivity continues to improve department by department and companywide.

Asset Utilization Reviews--A Fortune 50 multinational company operates under a highly decentralized philosophy. Its premise is that corporate management entrusts local unit management with a portfolio of assets--including people, capital and technology. Approximately 75 percent of the internal audit time is spent on analyzing and evaluating how these assets are currently employed. The company encourages auditors, during the course of their work, to question and evaluate all aspects of the business and the use of resources.

Such a process might be viewed as "second guessing" local management. But the results of the audit process are retained at the local level and not reported to upper management unless a major control or reporting issue arises. Thus, the company's operating management views internal audit reviews as an opportunity to reevaluate its strategies and programs to make sure it's using its assets effectively and ultimately improving profitability and productivity.

Capital Expenditures Reviews--A regulated utility company in a rapidly growing market has an enormous capital budget. The internal audit staff includes professionals with audit, engineering, legal and human resources backgrounds. A major function of the department is to review all the major capital projects and contracts to verify the company pays only for appropriate charges. Problems the internal auditors are looking for include excessive administrative charges, overbillings for change orders, duplicate billings, recoveries of penalty charges and charges for items included in the primary contract fee. The company has documented cost savings and recoveries amounting to more than 300 percent of the total audit budget, making the internal audit department one of the firm's most "profitable" units.

Joint Venture Audits--A company with major joint venture investments in the oil and gas exploration and production business has established a group within its audit function that spends 100 percent of its time reviewing the financial reports for compliance with the provisions of the joint venture agreements. The group also assists in audits of joint ventures where the company is the operator/manager. So far, internal audit is generating annual cost recoveries that exceed the total cost of the audit function.

Also, to spread the risk of loss, the company frequently establishes joint ventures in natural resource businesses. In the agreements, one partner company is identified as the principal operator/manager of the joint venture. The typical contract also provides the right of audit to the other partner or partners.

Due-Diligence Reviews--A major regional bank holding company, which has grown dramatically over the past five years through acquisition, uses its director of internal audit to coordinate due-diligence work on proposed acquisitions. The director is responsible for establishing the review team, ensuring that all required work is completed on time and serving as the focal point for communications between the companies. The bank holding company selected internal audit because it has a uniquely independent position in the bank.

This structure also helps establish good rapport with the acquiree. Issues can be discussed and problems resolved, frequently without involving other members of management to whom managers of the acquiree may subsequently report.

In-house Project Support and Consulting--A major manufacturing company uses its internal audit group for in-house project support and consulting. Project teams often request the group's assistance because of the professional competence and independence it brings to the team. The internal auditors also come to the projects without biases or preestablished goals.

Recent projects by the internal auditors include evaluating a significant acquisition, evaluating the viability of building a new production facility and assisting human resources in quantifying the costs and benefits of a downsizing project for a major division.

Afterwards, internal audit does post-project reviews to objectively determine whether the project met its goals.

Mr. Vondra is an audit partner with Price Waterhouse in Dayton and Cincinnati, Ohio, and Mr. Schueler is national director of internal audit consulting services with Price Waterhouse in Chicago, Illinois.

ONE STORY: PLAYING TUG OF WAR 

The chairman of a large midwestern utility wanted to perform a quality assurance review of the company's corporate audit function. Over recent years, the 15-person department had been transitioning from performing financial audits of internal controls and evaluating compliance with corporate policy to more operational auditing. Top management saw a need for an even greater shift in this direction. But the skill sets of the auditors hadn't kept pace with the changing needs of management. Unable to fill the strategic role management envisioned, the department continued doing routine, compliance-oriented tests of transactions--tests that added minimal value to the company.

How could internal audit better serve the needs of the company? The corporate officers and audit committee members wanted internal audit activities to contribute more to the bottom line and felt the department should be measured by its ability to enhance profits, reduce costs and improve corporatewide processes and procedures.

Financial management, on the other hand, had a more measured response: It was concerned with internal controls. Financial professionals felt that any shift further away from compliance or control reviews should first be discussed with the external auditor, who relied heavily on the work of the internal audit department to keep fees low. But the money that financial management saved in external audit fees was dwarfed by the value it could be creating by attending to the broader needs of management. The group argued that the appropriate split between operational and financial auditing was 50/50.

Operational management wanted an 80/20 split in its favor--a ratio more in line with many progressive and efficient companies.

The company finally decided to refocus its resources to provide benchmarking services. Management closed the gap between the existing and desired skill levels within the department by redeploying high-quality professionals from strategic planning and other areas in the company to give the internal audit function appropriate strategic and technical guidance. The firm decided that benchmarking wouldn't be limited to utility companies, cutting instead across industry boundaries. Why not emulate the best company at processing bills, rather than just the best utility companies?

Near the end of the restructuring, the chairman wondered if the company gravitated toward more operational auditing, would that cause a problem meeting the requirements established by the Institute of Internal Auditors? The answer is no. Unlike medicine or law, no official standards prevent an internal audit department from doing whatever management desires. Clearly, in today's increasingly competitive environment, management wants the function to, above all, boost its bottom line.