Leveraging the Standards During Budget Discussions: Making the Case for Investing in Internal Audit

I recently talked with a colleague whose organisation demanded a 50% cut in the internal audit budget inside four months. There was no discussion about how this might affect assurance and advice on risks and controls. It was viewed solely as a necessary efficiency gain.

This kind of “silent cutting” is nothing new and we should expect — even welcome — tough conversations with our CFOs about costs versus value and return on investment. Having to justify our spend is a necessary part of transparency and accountability.

Nor are we alone in being expected to do more with less. I have always liked this modern proverb: No matter how little Blu Tack you use to mount a poster, you can always do it with half as much.

The same is often assumed of auditing.

But when finance directors make these decisions without input from the CAE, it means we are not truly valued. Many CAEs have limited say in their budgets — by the time it gets to the board or audit committee for approval, it is often already a done deal. It can pose a real threat to our independence if choices about the services we deliver are determined, at least in part, by constraints on resources rather than by organisational objectives, risks, and priorities.

Just as the Global Internal Audit Standards (GIAS) are about to become mandatory, I thought it would be timely to see what practical insights they can offer on addressing resource shortages. In my view, being responsive and responsible while continuously educating our stakeholders is the key both to making a success of the Standards and to securing the required budgets to implement them.

What the Standards Say

The Standards hold the board responsible for enabling the independence of the internal audit function (Principle 7). This should mean we are free to discharge our responsibilities without interference. The CAE is expected to obtain the quantity and quality of resources needed to satisfy the charter and audit plan and must inform the board of the impact of any shortfalls (GIAS 8.2). In turn, the board is expected to “engage with senior management and the chief audit executive on remedying the situation if the resources are determined to be insufficient”.

However, “essential conditions” such as this are not mandatory – it would be impractical and inappropriate for internal auditing standards to place obligations on boards and senior management. Instead, they act like enabling principles that can be considered on a “comply or explain” basis (although this phrase is not used). If the CAE believes the absence of an essential condition means the internal audit function cannot conform with the Standards, then this must be documented.

However, having documented the situation, what further recourse does the CAE have? I believe the new Standards hold the secret — but first let us consider the harmful impact of resource shortages.

Impact of Resourcing Shortfalls

Regular readers of my articles will know I am very much in favour of zero-based budgeting, justifying our requirements by the ever-changing needs of the organisation rather than being driven by the desire to keep our auditors gainfully employed. If we can make savings through leaner, more agile, and smarter working practices, I am all for it. 

Even so, there is a point at which budgetary cuts can only lead to reductions in coverage, diminution of expertise, hurried work, and superficial findings, thus degrading the value of what we do, eroding trust with our stakeholders and potentially precipitating a downward spiral of more cuts and further drop-offs in quality. Auditors (the good ones) will become disenchanted and leave, we will not be able to provide valuable assurance and timely advice, and we will no longer be seen as the organisation’s trusted advisor.

Leveraging the Standards to Make the Case for Internal Audit

Fortunately, the increased emphasis in the Standards on strategy, quality, and performance as well as the requirements for extensive dialogue with the board and senior management provide us with the perfect opportunity to make our case. If we want to be taken seriously as an investment rather than an overhead, we must demonstrate our value in more ways than saying we delivered the planned engagements on time, as I have written previously.

1. We should leverage the Standards to start a dialogue with the board and senior management about our purpose, positioning, priorities, planning, programming, and performance (Standard 11.1). Being able to argue for the necessary resources begins with meaningful engagement and trusting relationships. The IIA has issued some great resources to support these conversations.
2. We need to discuss our strategic plan with stakeholders. It is not just a long version audit plan. It must include “a vision, strategic objectives and supporting initiatives for the internal audit function” (Standard 9.2), focusing on what is important to our clients.
3. When developing a budget proposal, we must not think only in terms of headcount and the number of days we plan to deliver. We should question everything we do – structure, balance of experiences, opportunities for upskilling, insourcing/outsourcing options, use of guest auditors, technology (including AI), and more. In fact, technology is a key element and is the sole focus of Standard 10.3.
4. Discussions around the essential conditions are a chance to demonstrate that we are committed to both conformance and performance by continuously innovating. Our metrics should reflect this by including inputs, outputs, and outcomes. (Standard 12.2 includes a list of 11 possible measures.)

Final Thoughts

This approach is transparent. If our individual engagements, audit plans, and long-term strategies are visibly aligned with the priorities of the organisation and based on the desire for improvement, this is likely to drive positive and meaningful engagement with senior management (including the CFO) and the board. Being able to show progress in real time against a range of metrics through dynamic dashboards, also helps because it demonstrates to our stakeholders that we are actively engaged in achieving organisational successes. I wish you the best of luck with implementation of the Standards, and hope that you seize this opportunity to communicate your value.