How do internal auditors add value?

Characteristics common to top-rated audit shops help to shed light on the nebulous concept of adding value.

THE DEFINITION OF “VALUE ADDED” CAN VARY considerably from one audit department to the next. For many practitioners, this phrase describes audit work that helps management improve the business, rather than assignments that simply verify compliance with policies and procedures. For others, the opposite meaning may apply. I remember, for example, asking a wise internal auditor to describe his department's innovative, value-added audit practices. Rather than discussing his own department, the auditor helped to broaden my understanding of adding value by saying, “Remember … what adds the most value in a country where, for instance, corruption is prevalent, is compliance auditing.”

The type of work or services that constitute value-added practice, then, is largely situation specific. What adds the most value for one organization, or even one area within an organization, might be a waste of resources somewhere else. Hence, the influence of individual circumstances gives rise to the question, “How can auditors identify the practices that will add the most value given their own specific situation?”

An obvious answer is, “Ask your stakeholders.” Many auditors seem to have taken this approach, as evidenced by a recent survey conducted by The Institute of Internal Auditors (IIA) titled, “Value Added Services of Internal Auditing”. The results show that 52 percent of surveyed internal auditors had gone through a major “reinvention” to add more value and that, within this segment, 95 percent gathered verbal and/or written input from one or more of their major stakeholder groups.

Soliciting input from stakeholders, however, is only part of the answer. If we rely solely on stakeholders to decide what types of services would add the most value, we limit ourselves to their knowledge of internal audit practices. But stakeholders are only aware of what they've seen us accomplish in the past. Given the major advances in our profession during the last decade, stakeholders' expectations are likely far lower than they should be. For this reason, auditors need to raise stakeholders' expectations by telling them – or, better, showing them – how much value we can add.

At the same time, we cannot adopt an exciting new practice without adapting it to the organization's culture and the stakeholders' needs. Some audit departments that tried control self- assessment workshops, for example, failed miserably. Either workshops couldn't be made to fit the organization's culture, or the auditors neglected to do the careful planning and tailoring needed to ensure the success of such programs.

Although what constitutes value-added activity will vary based on many factors, there are some general rules that apply across the board. Based on more than io years of researching internal audit best practices, I've identified four factors that can help auditors determine what will add the most value to their organization:

–