What Internal Audit Needs from the Audit Committee

As audit committees work to strengthen how companies approach risk management, corporate reporting, cybersecurity, and other key areas, they are relying on internal audit to provide more value, greater oversight, and better communication about issues of concern.

A new Common Body of Knowledge (CBOK) report from the Institute of Internal Audit provides six steps that audit committees can take to empower internal audit and better leverage the function to meet the organization's goals.

In "Six Audit Committee Imperatives: Enabling Internal Audit to Make a Difference," authors Jim DeLoach, a managing director with Protiviti, and Charlotta Lofstrand Hjelm, a chief internal auditor at a Swedish insurer, offer insights to audit committee members on how best to position internal audit to be at the top of its game.

Three broad themes emerged from the study regarding audit committees. According to the report, audit committees should:

• Enable internal auditors to think more broadly and strategically.
• Encourage internal audit to move beyond assurance.
• Take steps to ensure CAEs and the internal audit function are effectively positioned to deliver to expectations.

The report then identifies six imperatives to support the three broad themes, they include:

1. Provide Perspective by Elevating the CAE's Stature
"When audit committees think about their expectations of internal audit, they should also consider how the CAE and the function itself are positioned to deliver on those expectations. Access and perspective have always been keys to positioning. Such access has typically been attained through direct reporting to the audit committee and the C-suite," the report's authors wrote. "But beyond these reporting lines, internal audit can benefit from a big-picture perspective to prioritize and address competing organizational demands.

2. Assist the CAE with Aligning Stakeholder Expectations
"The audit committee should work with the CAE to ensure that internal audit performance is being measured consistent with how the board and management evaluate performance. Disconnects should be addressed timely so that the two are fully aligned. Keep in mind that this alignment is facilitated when the CAE is present at the appropriate board and management meetings," the report states.

3. Encourage Thinking Beyond the Scope
"Audit committees should encourage internal auditors to think beyond the scope of the audit plan. The big-picture perspective of the first imperative and the strategic thinking suggested in the fifth imperative contribute to and enable this behavior. The mandate to think more broadly is not an either/or proposition," the report states. "The CAE needs to challenge the audit team to "connect the dots" by thinking about the implications of audit findings across the organization so that audit communications are responsive to a business context that is broader than the boundaries set by the audit plan."

4. Direct Internal Auditors to Perform More Than Assurance Work
"Internal audit need not be limited to assurance. In today's era of slower economic growth, a high premium is placed on operational effectiveness and efficiency. Survey respondents picked up on this point, as nearly 3 out of 4 recommended that internal audit consult and advise on business process improvements."

5. Put Strategic Risks on the Table
"Two out of three board members believe internal audit should have a more active role in connection with assessing and evaluating the organization's strategic risks," the authors wrote. "Many board members seem to share this view." They say that the study identifies specific avenues designated by board members for internal audit to improve its role in assessing and responding to strategic risks facing the organization.

6. Prioritize High-Quality, Effective Communications
Effective communications enable the audit committee to work with internal audit leaders to better under-stand the internal audit process. To this end, directors should become more familiar with The IIA's International Standards for the Professional Practice of Internal Auditing, which is part of the International Professional Practices Framework (IPPF).