Internal Audit Strategic Planning: A Blueprint for Your Value Creation Roadmap
In permacrisis, risks are a moving target and organizational goals can turn on a dime. Where our organizations are now isn’t where they’ll need or want to be in three to five years. That’s exactly why internal audit strategic plans have become so critical. They are a key mechanism by which we can create roadmaps that help us support our organizations in getting where they need to go.
I am a fervent advocate for internal audit strategic planning. Further, the need for an internal audit strategic plan is no longer a matter of debate: Standard 9.2 of The Institute of Internal Auditors’ (IIA’s) Global Internal Audit Standards now mandates that CAEs must develop and implement strategic plans that support their organizations’ strategic objectives and success. So, why are strategic plans so critical? And how can you go about creating one?
The Value of Strategic Planning
When facing skepticism about the value of strategic planning, I’ve often shared a piece of advice attributed to hockey legend Wayne Gretzky: “Skate to where the puck is going to be, not where it has been.” If you fail to look strategically toward the future — asking yourself where you need to be, versus where you are now — you simply don’t know where you’re going. Which brings me to another favorite quote: “If you don’t know where you’re going, you’ll end up somewhere else” (Yogi Berra).
Skeptics often cite risk volatility, suggesting that effective strategic planning is impossible in such an uncertain environment. I submit that it’s precisely because risk is so volatile that we need strategic plans. After all, strategic plans aren’t there to provide the answers. They exist to help you ask the right questions, assess your options for responding, get everyone on the same page, and proceed accordingly. Complacency is not a strategy.
I embraced strategic planning 30+ years ago as a new CAE. Internal audit’s future was deeply uncertain in my organization, and strategic planning enabled us to understand the changes needed to better serve the organization moving forward. In the years since, I’ve used strategic planning every time I’ve been a CAE or CEO, making plans three to five years out and refreshing them annually to ensure they’re still relevant to the organization’s direction.
A Blueprint for Strategic Plan Development
The graphic and discussion below outline my basic process. The IIA’s practice guide offers additional guidance, as does Gartner’s One-Page Audit Strategic Plan template.
1. Revalidate Stakeholder Needs to Develop Strategic Vision Inputs
As shown, the process necessarily begins with revalidating not only who your stakeholders are, but if and how their needs and expectations for internal audit have changed. This exercise readies you to devise internal audit’s strategic vision, which is fed by four primary inputs:
- Mission. Articulate your mission to match your revalidated understanding of your stakeholders and their needs/expectations.
- Values. Define your values, brainstorming as needed and ensuring agreement.
- Trends and assumptions. Identify common trends and assumptions about the future.
- SWOT analysis. Assess key strengths, weaknesses, opportunities, and threats.
2. Forge the Vision Statement — Your “Destination”
Use these inputs to formulate your strategic vision statement. This destination statement articulates where you want to go as an internal audit organization. It should be short, crisp, to the point, and clear to all stakeholders. For example, at one organization, we stated our intent to “illuminate today’s challenges and tomorrow’s opportunities;” at another, we sought “to be the premier source of information for organization’s decision makers.”
3. Plan Your Route
Your vision statement is the large red “X” you mark on your roadmap to represent your intended destination. Once you know your destination, you can strategize how you’ll get there:
- Perform gap analysis. What must change to enable you to reach your destination?
- Formulate goals. What goals will support a successful journey?
- Develop objectives. What strategic objectives will help you achieve the goals?
- Identify critical success factors. What will you track to monitor your success?
This process is actually fairly intuitive. Returning to our trip analogy: If we’ve reached agreement on a destination, the next step is answering basic questions about our journey. For example, which turns will we take on our route? Which will we strategically avoid? How fast do we need to travel to arrive on time? What obstacles along the road could prevent us from reaching our destination? With your destination in mind, you’re able to ask the right questions to help you plan a strategic path forward.
A Roadmap to Value Creation and Realization
By agreeing upon a shared destination and working together to anticipate the path required to reach it, you gain consensus, band together for the journey, and keep people from unwittingly straying off the path.
Ensuring internal audit’s ongoing relevance in this changed world — as well as our survival as a preferred source of risk management assurance and advice — requires us to intentionally move beyond pure value protection to creating, enhancing, and realizing value. Strategic planning provides the roadmap that will help us get there.
Richard Chambers, CIA, CRMA, CFE, CGAP, is the CEO of Richard F. Chambers & Associates, a global advisory firm for internal audit professionals, and also serves as Senior Advisor, Risk and Audit at AuditBoard. Previously, he served for over a decade as the president and CEO of The Institute of Internal Auditors (IIA). Connect with Richard on LinkedIn.
