Key nine (9) tips for Internal Audit to act as a catalyst for improved organizational productivity and performance

With the due passage of Time, Internal Audit has grown to become a key player for Organizations in bringing key positive changes. Entities with good governance and performance-oriented culture are putting Internal Audit function as key advisors (although being 3rd line of defense) since they provide objective, factual and independent overview on company activities. However, the definition of ‘adding value’ by IA is still largely vague and interpreted differently by various IA professionals. I believe that besides IA focus on Improving Internal control system and overall GRC controls throughout the organization, such efforts should also translate into something tangible and quantitative.

But the question is, how does IA can really contribute in helping companies achieve sustainable growth? Isn’t IA responsible for commenting only on the internal control system and not seem as contributors towards company performance and profitability? In my professional opinion, if IA efforts indirectly do not bring any positive changes which cannot be quantified, then it seems such IA function may need to re-focus on the below key factors:

1.       Communication is key: Being a good listener to Auditee concerns always help. Audit is not only analytical, risk- based and/or process oriented, it also has a psychological aspect. Management inaction can be persuaded towards audit acceptance if the issue can be properly explained and how it may affect the business.

2.       Keep it simple: Avoid complicating business processes just to suggest controls over already implemented controls. Also, magnifying issues without proper perspective will only draw the ire of management and will affect the overall audit acceptance on the observations raised. Don’t recommend something which doesn’t seem practical (such as neglecting cost vs benefit aspect for a suggested control).

3.       Auditing is a journey, not a race: Align your audit strategy (3 to 5 years) with the company strategy. One of key IA strategy is provide a good mix of audit and consultancy services (70-80% audit & 30-20% consultancy). Most of the time, management is not capable of designing and implementing basic controls where IA can help in control implementation (with recommended safeguards).

4.       Objective reporting: Reporting to CEO, top executive and AC with relevant and actionable data will ensure timely action is taken by management. Risk based reporting fosters preventive action. Always support your points with hard facts and lots of data analysis. If a key issue comes to IA attention, it can be highlighted officially via observation memos rather than waiting to highlight it in upcoming planned audit engagements.

5.       Quick wins: During audit risk assessment and IA execution, quick fixes and low hanging fruits should also be addressed for management immediate action. Such actions also work as a compensating control for other areas.

6.       Time management: Align your audit efforts with approved IA plan and management expectations. During engagements, avoid spending too much time on mundane issues which look important but consume too much time (aka rabbit holes) and ensure effective utilization of time and resources.

7.       Risk oriented mindset: IA’s focus should not be to limit/minimize risks but to ensure management has effective risk management practice against company objectives. Proper risk categorizations/taxonomy (Financial, Operational, Strategic, etc.) should be defined and timely updated for top management/Board review. Moreover, almost every organization requires GRC support to a certain extent but most don’t have such function present. This doesn’t mean GRC risk and relevant activities (along with their controls) does not exist in the organization or cannot be reviewed by IA.

8.       Utilization of Technological tools: Equip yourself with technological tools and try to use automation in your work to achieve work efficiency and reliability. Moreover, continuous reading and research (relevant to your organization) helps you keep abreast of recent advancements and developments.

9.       Team work makes the dream work: A good IA function is always a team player. Effective collaboration with team and stakeholders, brainstorming sessions for designing scope, risk assessment or others ideas will improve your audit output. This also fosters unity and improve morale amongst team members, leading to overall improved departmental performance.

Since joining Leejam on Dec 2021, our IA team has worked collaboratively with the management as their effective business partners to bring massive transformation and optimization for the business. Under senior management’s renewed strategy and direction by the prestigious Audit Committee, IA was able to support Leejam management to achieve record breaking results (as of Dec-23) making them one of the best performers on Tadawul. Leejam has now transformed into a group company with a vision to lead the sports industry. The Leejam annual AC reports (one of the most comprehensive AC reports available for stakeholder review on Saudi exchange) is also a testament how Leejam IA function worked tirelessly to provide coverage over different risks, business functions and activities with the required assurance while focusing on key business areas. Overall, it’s an inspirational feeling to be part of the Leejam Family!