Often you are hired as an "interim pawn" after the departure of the Head of Audit and before the arrival of the new head of the department. With the tightness in the current market, this can easily be 3-4 months apart. As an 'interim pause' you are often expected to keep an eye on the store and not necessarily make (major) changes. As an office active in internal audit, but undoubtedly also as an independent interim professional, the ambition in such a role is to mean more to the organization than just minding the store.
More and more companies are starting with internal audit, so there is a good chance that the Internal Audit department you will be working for is fairly new and has only existed for a few years. In a short period of existence it is often not possible to set up a mature Internal Audit department. As an experienced interim audit professional, you can add a lot of value by putting the department on the right track to professional maturity. And this without confronting your successor with choices he or she would rather have made differently.
By completing the following steps properly, it is my experience that you can do more for the Internal Audit department and, therefore, for the organization:
Take one or two recently conducted regular audits and go through the entire audit process for this. If there is an audit manual, obviously go through it for this section as well. But as with a regular audit manual, there is often a difference between setup and existence.
Start with the basics: how did the audit planning come about? Were all steps of the audit process completed? How was the standards framework established? Is the report consistent with the evidence? Are there obligatory opinions or are there tailored opinions based on root cause? Is the report readable (do I as management know what to do with it)? Is there a (logical) rating model? Are audit issues recorded and followed up? How are the summary reports to the Audit & Risk Committee (ARC) and so on.
This provides a fairly quick picture of the quality of the audit department's primary process.
An important measure, of course, is also how the auditees, management but also the ARC view the department. What do they think of Internal Audit's products and what do they actually expect from Internal Audit? Are Internal Audit products actually discussed and recommendations followed up? Follow-up of audit issues is also an indicator of quality.
It is important to first review the audit process and its products before talking to stakeholders. This also allows you to better place the comments of the auditees and ARC.
In addition to the guidelines for the audit process (2200-2600), the standards also contain more peripheral guidelines such as the charter, quality and assurance program, consultation with the external auditor and so on. By reviewing these, it is fairly quick to determine what steps still need to be taken in that area. The IIA's ambition model can also support this. It allows you to see where the department is now and where it needs or wants to go.
After these steps, you can compile an overview of points that still need improvement and categorize them by subject: audit process, charter, reporting and so on. You can then prioritize these points and also determine which points you can pick up in your assignment (as coordinated with client) and which points are better left to your successor.
In this process, of course, you also need to pay attention to the more soft side of your assignment. My advice is to pay attention to the following points in your approach:
In this way, you can further help the department and the organization to add more value and you have delivered more than just babysitting, which gives you more satisfaction yourself.
Marc van Heese is a partner at AuditPeople. To talk further: 06-52073162 or Marc.van.heese@auditpeople.nl