Internal audit that adds value, not paperwork

A recurring pattern in our assurance work: an internal audit function is fully staffed, delivers its annual plan, and yet no one on the executive team can name a decision it changed. The function is busy and peripheral at once.

The cause is rarely competence. It is design. Below are the four design choices that separate internal audit functions that matter from those that generate paperwork.

Choice one: build the plan from risk, not from history

Many annual plans are last year's plan with dates changed. A risk-based plan starts from the enterprise risk register and the business strategy, then asks a blunt question of each candidate audit: if this control failed completely, would it change our results, our licence to operate or our reputation?

Areas that fail that test can be covered by continuous monitoring or rotated to a three-year cycle. Freed capacity goes to the risks that actually move the numbers — revenue assurance, third-party spend, cyber access, project delivery, regulatory reporting.

Refresh the plan at least twice a year. A twelve-month fixed plan cannot respond to an acquisition, a system migration or a new regulation.

Choice two: audit the process end to end, not the department

Risk concentrates at the handover points between functions — where sales passes to credit, procurement passes to payables, engineering passes to finance. Departmental audits systematically miss these seams because each department can demonstrate its own compliance.

Scope audits along a process: order to cash, procure to pay, hire to retire, project inception to capitalisation. The findings are usually more uncomfortable and considerably more useful.

Choice three: make evidence continuous where you can

Sampling twenty purchase orders tells you about twenty purchase orders. Where data is accessible, test the full population with scripted analytics: duplicate payments, suppliers sharing bank details with employees, approvals outside authority limits, journal entries posted at unusual times, credit notes concentrated in the final week of a period.

Full-population testing changes the conversation with management. It moves from "we found three exceptions" to "this pattern accounts for 4.2 per cent of spend and here is the list."

Choice four: report in management actions, not findings

A finding describes the past. An action changes the future. Every report item should carry a named owner, an agreed date and a stated business consequence if it is not done. Items without an owner should not appear in the report at all — they belong in a conversation.

For the audit committee, three pages are usually enough: what changed in the risk profile, what management committed to, and what remains overdue. Detail belongs in appendices.

Independence is a structural question

Internal audit reports functionally to the audit committee and administratively to the chief executive. Where the function reports to the finance director alone, its ability to challenge financial reporting is compromised regardless of individual integrity. Where the same team designs controls and then audits them, the assurance is circular.

Small organisations that cannot justify a full function have options: a co-sourced arrangement, an outsourced function with an internal coordinator, or a rotating programme of targeted reviews. The structure matters less than the reporting line and the mandate.

A simple maturity test

Ask five questions of your function:

1. Can it name a management decision it changed in the last twelve months?
2. Does its plan differ materially from last year's?
3. Does it test populations or only samples?
4. Is the overdue-actions list shrinking?
5. Does the audit committee meet the head of internal audit without management present?

Three or fewer affirmative answers usually indicates the function is delivering compliance rather than assurance.

Getting there

The transition normally takes two planning cycles. The first cycle re-bases the plan on risk and introduces data analytics on one or two processes. The second embeds continuous monitoring and rebuilds committee reporting. Attempting both at once tends to overload a small team and produce neither.

Our audit and assurance practice supports internal audit set-up, co-sourcing, quality assessments and control reviews for organisations across financial services, energy, telecoms and the public sector.