Where to put your internal auditors?

Imagine the following theoretical scenario: you have an organization which has a significant number of different activities. It looks a lot like a typical Japanese supercompany, with diverse activities across the entire activity spectrum, not necessarily related to one another. You have one audit committee you need to report to. Where do you put your auditors and how do you ensure they remain as objective and as relevant as possible?

Physical localization of the audit team

Your team or part of your team needs to be as close as possible to the actual operations. Just visiting audit teams are not really enough to develop a thorough understanding of the activities if the width of activities is very large. Being there makes sense for two reasons:

• First, your auditors will have their finger on the pulse of the management team responsible for that activity. They need to be able to interact, both formally and informally, on a regular basis, with the accountable people in the organization;
• But not only that … just being able to tap into the discussions on the workfloor allows an auditor to quickly pick up on important issues. Note, this is not being the Gestapo at all. After all, our role is to provide reasonable assurance and advice.

Local team sizes

It really doesn’t pay to have just one person present, who interacts with the organization and calls in semi-external support when audits need to be done. That would be like getting married and having your friend taking your wife out for date night. While ad hoc support in specialized aspects is important, note that the trust which is so essential in tapping into the vein of an organization is quickly lost if responsibilities of auditing are outsourced. And while you may argue that calling in support from a central team is not outsourcing, trust me, it is in the eyes of the auditee. If it is not their trusted team, it’s “someone else”.

Loading the team members and cross-training

Of course, it does not make sense to have full teams with overlapping competencies and too much time on their hands present at all locations. Rather, on the contrary, it makes sense to have specialized people available within the organization to ensure that all specific audit issues can be dealt with. There are two models here:

• Model 1 proposes a centralized audit service where specialized competencies, such as IT audit skills or governance audit skills or multiple use skills such as public sector budget skills are present. While this may make sense from a theoretical point of view, I don’t believe this is the best possible solution. After all, you get resources which are in essence idle unless they are being called in for specific assignments. The usage of these resources will traditionally be lower than the usage of other, dedicated resources. Their depth of knowledge will be traditionally lower as well;
• Model 2 proposes embedding expertise, specialized competencies, in the teams themselves. While available for a specific audit, these auditors are planned and used as traditional auditors if not required to exercise their traditional skills. If the planning system is developed well, this should allow for better planification.

Honestly, I’ve seen a number of “expertise” cells in different organizations. As long as they are not actively deployed in the field to engage in work and develop their understanding, their advices remain theoretical. They may be well written, but they make little to no sense.

What should be centralized?

Ideally, planning of the specialized resources should be dealt with at a central level. Exchanges of approaches and methodology is relevant as well. People can be rotated between teams during the early years of their employment as internal auditors, to develop a broad view, but need to be dedicated to one organization at one time. This creates an engagement and a responsibility which will be lacking if you are one step removed. Appointment and rotation of audit directors can be centralized as well. However, audit execution responsibility needs to remain decentralized.

In conclusion

Where to put your auditors is an important decision which, if not well considered, may cost you a lot more than just idle resources. Failing to properly position your people can lead to loss of confidence in your capability to execute an audit and jeopardize the timely execution of the audit plan.