Are You Delivering Value?

In August 2010, The IIA defined "Value Proposition" for internal audit as providing an organization three core elements of value: assurance, insight, and objectivity. In 2011, The IIA conducted research to determine how well internal audit delivers on the new value proposition.  The results of this research are found in the report Insight: Delivering Value to Stakeholders[1].

The research shows that while many internal audit teams believe they are delivering on the value proposition, their primary audit customers  (the Board/Audit Committee and executives), have mixed results on how well they are delivering on the value proposition, especially when focusing on the core element of insight.

The IIA defined "insight" as "an end product or result from internal audit's assurance and consulting work. Insight can involve 'connecting the dots' (i.e., identifying the entity-level root causes of control concerns, emerging risks, or significant opportunities to improve the entity's governance process) to deliver value-added results to key internal audit stakeholders. Providing Insight may require many IA activities to improve their overall capability, staff competencies, and audit process/practices."

Board members are more aligned with internal audit's self-assessment on their delivery of value while executives provide a less favorable picture especially when discussing the "Insight" portion of the value proposition.  How can that be?

The answer is found in the information each group needs to be successful.  Since the board is not involved in the day-to-day operations of the organization, they value assurance on internal controls and risk management. Executives however believe that same assurance is the minimum that internal audit should achieve.  Executives want information and/or new ideas on how the organization can achieve its objectives or address issues.  According to the report, most internal audit teams deliver the assurance on controls that the board wants, but fewer deliver the information and ideas that can improve the organization from the executives' point of view, especially in achieving its objectives. 

The report highlights the importance of setting clear expectations with stakeholders.  Internal audit must understand their stakeholders' expectations of internal audit in order to take the necessary steps to meet those expectations.  In addition to this, Risk Based Integrated Auditing ^TM (RBIA) prescribes meeting with executives and the board on a regular basis to understand their key concerns (or "what keeps them up at night") and use this information as a starting point to understanding the key risks to the organization.

Never forget that value is determined by the customer.  So if your audit customers believe that insight is just as important as assurance and objectivity, then you must expand your audit teams' focus to provide insight to the organization.

We would love to hear how you believe your audit team is delivering on their value proposition and what steps you have taken to assure you are meeting both the board and executives' needs. Click here to share your self-assessment.