Understanding the Internal Audit Value Chain to Enhance Performance

As internal auditors, we are experts at analysing process design, policy implementation, and project execution. We readily grasp the big picture and identify potential improvements to organisational governance, risk management, and internal control. However, we are less good at applying these same skills to our own work. We know how to conduct a value-for-money audit, but use only rudimentary measures of our own economy, efficiency, and effectiveness.

If we want to be credible and be seen as trusted advisors rather than just an overhead, then we must lead by example. In one of Aesop’s fables, by issuing the following challenge, an astute fox exposes the deceit of the wrinkled and blotchy frog who claims he can cure any ailment: “If you are so talented, I say, physician, heal thyself.” 

I want to share some of our experiences at SWAP that have led us to a deeper appreciation of our performance. It starts with a critical analysis of the internal audit value chain which supports honest and meaningful dialogue with the audit committee about the best use we can make of our resources.

This is part of our journey of continuous improvement. When Dave Brailsford was hired as performance director of British Cycling in 2003, Britain had only won one cycling Olympic medal and had never won the Tour de France. Brailsford pioneered the principle of marginal gains: by making small — sometimes apparently insignificant  — improvements to everything (seats, diet, grease, training schedules, clothing, tyres), he transformed the team into the pre-eminent force in cycling.

This is my vision for internal auditing, and this article concludes with practical steps you can take along this same journey.

Audit Risk and the Internal Audit Value Chain

We don’t really talk about audit risk in the same way as external auditors do. Like all goal-oriented activity, internal auditing is susceptible to the effect of uncertainty. Risks can impact the timeliness, quality, relevance, and overall value of our work. We manage audit risk through controls like adherence to professional standards, risk-based planning, continuous stakeholder engagement, auditor training, and supervision, but we can be much more incisive with greater scrutiny.

Internal audit has its own value chain. Starting with our purpose, we transform inputs to generate outputs, outcomes, and impacts. Our ability to identify, evaluate, and manage audit risks can be greatly enhanced through a more analytical understanding of this cycle.

Economy – minimising the costs of our inputs, ensuring sufficiency, timeliness, competency, due care, and professionalism of inputs for the best price.

Efficiency – optimising our outputs in relation to our inputs, ensuring reliability, relevance, and quality.

Effectiveness – achieving or exceeding our objectives, ensuring our work supports organisational success and innovation.

Absorption Costing 

Key to this analysis is the ability to consider the true costs of inputs. We are accustomed to thinking in terms of auditor days as our unit of input, but this is a very blunt measure. For one thing, not all audit days are made equal. At SWAP we have a day rate for auditors according to their grade, experience, and expertise. 

However, sole focus on audit days ignores the other inputs, such as supervision, training, IT, and office overheads. Absorption costing enables us to identify the true cost of our work. We apportion all input costs to units of output. The indirect costs must be calculated in aggregate for the year and then apportioned to outputs based on expected volumes of activity. The simplest method is to spread costs equally by dividing by total chargeable staff hours. Variances inevitably occur due to differences in prices and volumes of activity and they form an important part of our analysis. 

Benefits of a More Tactical Approach

In the absence of a sound understanding of the value chain, our resource planning is a vague process at best. But by harnessing a deeper, richer appreciation of our operations, we can:

• Quantify the value we generate (ROI).
• Create meaningful, measurable KPIs for internal audit performance.
• Manage our resources more efficiently through better planning and prioritisation. 
• Determine the most appropriate resourcing models (in-sourcing, co-sourcing, guest auditors, full-time/part-time mix, etc.) based on robust cost-benefit analysis. 
• Identify bottlenecks and make improvements. 
• Enhance our approach to quality assurance.
• Have meaningful conversations with the audit committee about budgets.

In my experience, the client appreciates the transparency and opportunity of such discussions. We also have an obligation to enable the audit committee to exercise diligent oversight of the internal audit function, in accordance with the Standards.

A traditional response to budget cuts where the organization or client is prepared to pay less has often been to over-promise by continuing to meet expectations on audit days, but consequently under-delivering on quality or real added value. Audit work that is formulaic yields superficial results and delivers only generalized recommendations.

Exposing ourselves to closer scrutiny and engaging in open conversations about resources takes a certain amount of courage, but fortune favours the brave. Greater value is generated through honesty, transparency, and objectivity in how we evaluate our inputs in relation to our purpose and ultimate impacts.

Tech-Enabled Visibility Into Efficiency 

Technology is a capacity multiplier, and we can utilise tools to help us monitor and evaluate the audit value chain. From the moment we are “audit ready,” we can start measuring our speed of delivery compared with plans and budgets. Connected platforms like AuditBoard can show us live results for individual audits and in aggregate. Users can interrogate the data by audit, auditor, month, audit type, status, risk, and so on, and can then drill down for further detail and comparisons.

Such a dashboard can be usefully shared with the client. After the engagement is concluded, we can seek feedback. Did we deliver good value? Were the outputs delivered economically and efficiently? Where could we have improved the process? Were there any avoidable bottlenecks? Did we get the scope right at the start? Did we work well with functional staff and managers during the audit? Where is there room for improvement in our internal audit value chain?

If you’re not thinking about potential efficiency gains, someone else will do it for you. Our responsibility is to deliver the best services we can — rather than assuming a defensive posture to simply protect jobs. Sometimes we may be over-resourced or lack sufficient flexibility or have shortages in key expertise. We should never reflexively fill a vacancy as soon as it becomes open. Inevitably, there is less wiggle room with smaller teams, and many CAEs may feel they are significantly under-resourced. However, that only makes acute awareness of the value chain even more critical. Regardless of size, we have a finite budget and we must use it wisely to maximise our impact.

5 Ways to Analyse Internal Audit Performance

Achieving and employing greater insights on our performance is a continuous journey. I encourage you to:

1. Evaluate all aspects of internal audit performance.
2. Be transparent with the client and seek their feedback.
3. Be brave in your conversations with the audit committee.
4. Be prepared to make all possible improvements no matter how slender.
5. Make use of technology to scale up the benefit.

Among the many hats we must wear is performance manager for internal auditing, and we need to bring our A-game. No one knows our value chain better than we do. We must dismantle and reassemble it repeatedly in our quest for those marginal gains – before resourcing decisions are made for us.