Manage the internal audit function

Manage a function that can deliver useful work

The internal audit function needs a clear direction, capable people, appropriate methods and resources. A strategy explains how it will support organisational needs over time. The audit plan translates priorities into proposed engagements. The detailed work programme guides one engagement.

Confusing these levels can produce activity without direction. Finishing every engagement in an old plan does not prove that the function has responded to a major change in the business.

Case: a move to digital services

A service organisation is closing branches and expanding online delivery. Its audit team has strong branch-process experience but limited capability in access management, data flows and third-party technology.

The chief audit executive should assess how the changed business affects assurance needs, identify capability gaps and consider development, recruitment or specialist support. Simply replacing branch names with system names in the old plan would not address the change.

Resource decisions

A useful resource discussion connects proposed coverage with the people, time and tools required. Explain significant gaps and alternatives in terms of the effect on assurance.

Resource issue	Question to resolve
Skills gap	What competence is needed and how can it be obtained?
Staff shortage	Which priorities can be delivered and what coverage is deferred?
Technology purchase	What work will the tool improve, and can the team use it effectively?
External provider	Are scope, competence, objectivity, deliverables and review arrangements suitable?

Outsourcing a task does not remove the need to understand and evaluate the work received. Agree access to the evidence and how questions or deficiencies will be resolved.

Maintain useful methodologies

Methods should give staff enough direction to work consistently while allowing justified professional judgment. A checklist designed for a small manual process may be unsuitable for a high-volume automated service.

Review methods when risks, technology, professional requirements or experience show that they need to change. Communicate revisions and support their use through training and supervision.

Relationships and communication

Regular discussions with the board and senior management help the function understand priorities and explain its work. Informal communication can surface emerging issues, while formal reporting records significant matters and decisions.

Constructive relationships should support candid challenge. Dependence on favourable feedback from the managers being audited can make it harder to communicate difficult findings.

Performance and behaviour

Rewarding only speed may encourage superficial testing. Rewarding only finding counts may encourage exaggeration. A useful set of measures considers quality, coverage of significant risks, timeliness, professional conduct and stakeholder usefulness.

Training plans should address actual needs. An attendance record alone does not show that a person can apply a new skill.

Self-check

Is the annual audit plan the same as the audit strategy? No. They operate at different levels of direction and detail.

Can a provider's reputation replace review of their work? No. Assess whether the particular work is suitable for the intended reliance.

How should a budget gap be explained? Show its effect on the proposed work, the risks left uncovered and realistic alternatives.

This chapter introduces the operations domain in the current CIA syllabus.