Unlocking Value Through Internal Audit.

Fierce competition for new markets and highly speculative forays into e-commerce exemplify today's business environment, as many companies invest heavily in reengineering strategies to help unlock new sources of corporate wealth. Surprisingly, many of these organizations fail to include internal audit in those efforts.

Despite tremendous changes in the world of internal audit, many organizations continue to view it more as a function for internal control rather than as a tool for creating value. Yet, internal audit can play a key role in creating real corporate value by helping firms effectively institute change and mine untapped internal resources.

Firms with especially strong internal audit functions -- industry leaders that actively leverage their resources to achieve superior results -- display a consistent set of attributes, regardless of how they approach the function. These common characteristics include:

* Demonstrating leadership at executive and stakeholder levels.

* Constructively revisiting outdated perceptions and expectations of internal audit.

* Pinpointing and clarifying specific activities that derive value from the function.

* Aligning and focusing internal audit capabilities and processes.

* Continuously measuring and evaluating results.

While the primary focus of internal audit functions varies significantly from one organization to another, it's clear that the leading practitioners concentrate on activities known to add value, and their internal audit groups tend to excel at those activities.

Bridging the Expectation Gap

Internal audit is often viewed as a non-core business process. Research conducted by the Institute of Internal Auditors (IIA) confirms that there is an "expectation gap" between how stakeholders view the potential of internal audit and what most internal audit functions can actually deliver. To effectively address this gap, organizations need to take a fresh look at internal audit and agree on its ultimate value. However, agreement can be difficult for several reasons:

* Diversity among stakeholders. While executive management and the audit committee are certainly the function's most significant stakeholders, others commonly include a broad array of constituents, such as the board of directors, operating management, external auditors and regulators. For internal audit to create value, all stakeholders must work together to identify and prioritize expectations.

* Definition of "value." Everyone in an organization expects "value" from its business processes, yet because of the broad scope of internal audit activities, the function often lacks a clear understanding of what value it's supposed to achieve. Therefore, an organization needs to clarify how it expects internal audit to generate value and stimulate high performance.

* Static skill sets. It can be very difficult for staff to maintain high levels of proficiency in risk management and internal audit if these skills can become quickly outdated. Organizations need to focus on keeping their staffs' skill sets current. Once the value expectations of internal audit are clarified, a corporation can rationalize and adjust the area's resources and capabilities so it has the tools it needs. Without clarification, performance measurement becomes subjective and only marginally useful.

Methodology Adds Value

To improve internal audit analysis, firms should consider employing a methodology that takes into account the various stakeholders, as well as the function's key relationships with other risk management functions within the organization.

This methodology should clarify stakeholder value expectations, align resources and processes and measure performance, then create value by aligning core internal audit processes to fulfill these expectations. Comprehensive alignment, it has been found, is critical for adding value through internal audit. PricewaterhouseCoopers' research and relationships with firms with leading internal audit functions indicate that alignment constitutes the ultimate best practice in internal audit.

The methodology should cover three critical areas: value identification, value creation and measuring and maintaining performance.

Value Identification

It's essential that an organization's stakeholders clearly define their expectations of internal audit and how they believe the function can create value. Too often, these key players' expectations have changed and are misunderstood. This is a particularly important issue when organizations have new management teams and/or new audit committee directors whose expectations may differ significantly from those of the previous management. In such situations, internal audit may grow seriously out of touch with these new leaders.

To resolve such expectation gaps, internal audit departments can conduct in-depth discussions to assess stakeholders' expectations and learn how they believe organizational value can be created. Although key "value drivers" will vary among organizations, they may include areas such as ensuring the ability of the company to survive catastrophic events, furnishing staff for special projects or ensuring that violations of laws or regulations are eliminated, identified or corrected.

What's more, some firms are working to identify less traditional value drivers for internal audit. These can range from helping management implement controls related to new technologies to working with human resource functions to develop management talent for the company as a whole.

Naturally, many companies will continue to rely on more traditional internal audit value drivers such as identifying business process improvements, conducting due diligence prior to mergers and providing highly specialized risk management expertise. But irrespective of particular value drivers, it's imperative for every organization to clearly identify and prioritize the specific activities that it believes will create significant value.

Value Creation

To move from merely identifying value drivers to value creation, an organization needs to pursue a systematic process. First, it must identify the gaps between current business processes and those processes that will create value. Internal audit should perform an objective analysis of its core processes, measuring them against stakeholder expectations and value drivers. Each core process should be analyzed in terms of its current performance levels, capabilities, tools and skill requirements. This analysis should identify missing processes and activities deemed essential for success.

Secondly, a corporation needs to develop a strategic plan to close any identified gaps. The plan should encompass long-term strategies for the four core internal audit processes: organization, human resources, working practices and reporting and communications.

1. Organization -- The old hierarchical model has given way to a variety of models that give internal audit significant flexibility. Many of these models are structured to facilitate close communication and interaction between internal audit and other business units. However, in an era of globalization, internal audit must find ways to overcome the wide geographic dispersion that hinders effective communication at many companies.

2. Human Resources -- This is a critical area in the search for value creation, and the breadth and depth of skills needed to achieve internal audit objectives can he significant. As a result, skill inventories, career models, sourcing strategies and training are among the areas that organizations need to consider to ensure that their internal audit functions have qualified staff.

Clearly, there should be a core value driver that addresses this human resource aspect. Some companies create value by encouraging long-term internal audit careers, while others view internal audit as a key area for management development. Regardless of the approach, organizations must articulate how they expect their human resource efforts to contribute to their success.

3. Working Practices - Many firms have equipped their internal audit functions with sophisticated technology and tools. It's important to remember that technology is an enabler - not a value driver. Organizations that tend to view technology as a "silver bullet" are often disappointed with the results.

Another key component of effective working practices is risk-assessment methodology, which must relate to its overall risk-management processes.

4. Reporting and Communications - Internal audit can add significant value in the area of communications and reporting. Today's stakeholders want quick, concise communications and reporting, and PowerPoint and similar tools can give internal auditors valuable, effective alternatives to written reports. In addition, internal audit must be prepared to communicate continuously with management across a broad range of topics, not just specific audit projects.

Performance Measurement and Maintenance

It's often been said, "What gets measured, gets done." This is as true for internal audit as it is for many other business functions; vague expectations that cannot be quantified will undermine internal audit's ability to create value. Internal audit needs to measure its performance against a clear set of objectives, and it needs the tools to objectively assess its own performance. In addition, it should have the opportunity to demonstrate its achievements to the organization.

The measurement process should begin as soon as internal audit has implemented a strategic plan. As many firms have found, a "balanced scorecard" can be an effective tool for measuring internal audit performance. The balanced scorecard concept is quite straightforward: Focus on more than just the usual numbers, and identify and balance the numbers with other critical objectives, such as people or human resource goals.

Scorecards should measure areas that relate directly to an organization's desired value drivers. Furthermore, specific activities and measurement points should be developed within each category.

Structuring Change

Reshaping the function will be a significant challenge at many companies, but such change is often essential for an organization to effectively align its internal audit priorities with those of key stakeholders. Companies should consider their transition plans and timeframes, as well as their communications guidelines. In addition, they need to ensure that they have built effective change management practices into the transition processes.

For its part, internal audit should determine whether external resources might help overcome gaps during this transition. Often, significant change can be achieved more rapidly with the assistance of outside parties.

Here are four key questions to consider during the transition process:

1. How much time and investment is the company willing to incur to achieve its desired values?

2. Are there leaders on the current internal audit staff who can implement the new vision and expectations?

3. Are the desired contributions from internal audit so important that they mandate rapid change?

4. Can the organization change the internal audit function more gradually, possibly over a period of years?

Once these issues are addressed, an organization is typically in position to explore alternative ways to deliver value through internal audit. While today's environment is seemingly the most challenging ever faced by internal auditors, it's clear that some high-performing auditors are meeting this challenge. The comprehensive processes and approaches described above can help organizations develop and sustain highperforming audit functions.

Jenny Weingardt is a partner with PricewaterhouseCoopers responsible for the Canadian Internal Audit Services practice. She specializes in the energy and government sectors.