Build a next-generation internal audit organizational structure

As internal audit functions adapt, evolve, and transform to respond to emerging risks and challenges facing their organizations, finance professionals need to think about what the organizational structure of an audit organization looks like. powerful new generation internal audit. A traditional internal audit hierarchy breeds a traditional approach, which may not attract and retain top talent. But as new approaches and methodologies are adopted in the practice of internal auditing, the organizational structure to support them can and should be very different.

Additionally, as organizations continue to employ more digital capabilities and ecosystem partners as part of their broader transformation initiatives, defining and building an organization that can support this new environment are essential to good governance. This means ensuring that auditors have the tools, capabilities and skills to meet the different and growing expectations of stakeholders. This article will review some of the key considerations for internal auditing.

Flatter, thinner, faster

One of the first questions to arise in discussions of organizational structure is staff size: for example, “How many auditors do we need?” But it’s no longer about the number of full-time employees. As audit functions adopt new methodologies, the organizational structures required will be very different.

Among these approaches, next-generation internal audit groups are developing and leveraging flexible resource models to access needed skills, experience, and capabilities. This requires resourcing models that differ from traditional approaches and extend beyond the walls of internal audit to encompass the entire enterprise, partners, and vendors. Furthermore, in terms of skills and experience, the structure of the next generation internal audit department must support the efficiency and effectiveness of an audit function in the face of emerging risks.

Additionally, next-generation internal audit shops tend to have flatter organizations with more flexible matrix structures and teams of auditors spanning multiple legal entities, geographies, and risks. Resources that were primarily focused on testing part of the audit scope during the previous audit may find themselves leading the next audit. This level of flexibility in roles encourages a culture that is less hierarchical and more aligned with the younger generation, while providing new challenges that can help retain top talent and future leaders. The reporting lines and responsibilities of audit and support teams are increasingly designed to facilitate agile audit methodologies. Ultimately, the size and scope of the internal audit function will also depend on technology, risk coverage, organizational hierarchies, and the extent to which the business can use flexible resources, such as third.

Set the right course

Rather than a standard model, the optimal structure for any internal audit organization should be determined by the types of audits and services performed. An internal audit function with more senior people performing a greater proportion of advisory and consulting work for the business – as well as focusing on agile auditing, dynamic risk assessments and other auditing practices next-gen internal audit – is more likely to be flat than one that performs a significant amount of traditional sample-based audits. Traditional workshops tend to use testing and documentation techniques that require more people to do time-consuming fieldwork and then pass it up the chain of command.

Another structural factor is the level of business compliance-related activity. Organizations that are heavily regulated (e.g. financial services) or that need to do a lot of Sarbanes-Oxley (SOX) compliance work will have additional workflows and infrastructure dedicated to these deliverables. These organizations may need to maintain a more traditional hierarchical organizational structure due to regulatory expectations and the practical aspects of the work they perform.

Industry best practices also come into play. In the financial services industry, for example, it is increasingly common for internal audit functions, especially in larger institutions, to have professional practice groups (PPG) responsible for defining strategy, priorities, methodologies, policies, standards and procedures. The most effective PPGs take a systems approach, developing a detailed understanding of the entire audit lifecycle, from governance and methodology to resources and technology, while ensuring the function fulfills its obligations. and operate as efficiently as possible.

Do more with greater efficiency and agility

Only after developing a clear picture of the overall objectives of the internal audit function can the internal audit manager (CAE) determine the resource levels needed to achieve them. Internal audit strategy was covered in a previous column, outlining the importance of thinking strategically and setting strategic goals. Aligning an appropriate organizational structure is key to successfully achieving strategic goals.

Historically, the scope of work to be performed determined the number of additional auditors needed to perform that work. Today, especially for internal audit functions striving to align with best practices, there are proven approaches that allow CAEs to achieve higher levels of accuracy, productivity and efficiency to achieve their primary goals, including automation and resource flexibility.

Automating. Over the past decade, according to research conducted by Protiviti (the author’s firm), most internal audit functions have slowly improved their use of advanced audit technologies. In our opinion, now is the time to explore the possibilities of using technologies such as process automation, continuous monitoring, data visualization, artificial intelligence, machine learning and process automation. robotics. These and other technologies are increasingly being used to streamline internal audit workflows and eliminate tedious and time-consuming tasks. They also generate dashboards that can be used to provide real-time risk and compliance insights, allowing auditors to focus their efforts where they can add more value.

Flexible resources. As noted above, next-generation internal audit groups are developing and leveraging variable resource models to become agile and access skill sets and capabilities as needed; resource flexibility is essential. Partnering with third-party subject matter experts to supplement internal audit staff is increasingly common. Internal audit groups can fill skill gaps quickly, often requiring deep and specialized technical expertise, while supplementing internal resources during time-consuming projects with critical deadlines.

Strategic direction

The structure of an internal audit department reflects its strategic direction. Departments with more traditional audit governance methodologies, technologies, and techniques will typically maintain a traditional, hierarchical internal audit structure. Next-generation internal audit functions with a culture of adopting best practices have flattened their organizations, becoming more flexible and agile. They are more likely to take advantage of a strategic matrix that allows auditors to work faster and more efficiently across legal entities, risk areas and geographic boundaries. To accomplish all of this in a timely manner, they are more likely to use new technologies and employ a more flexible approach to staffing the function with a mix of full-time staff, variable resources, and third-party experts.

Thinking strategically about how the internal audit department is structured and being open to challenging the status quo is a critical part of delivering value and achieving organizational goals, especially in dynamic and transformative business environments. By determining and building the right structure from the start, internal audit functions will set the stage for current and future success.

David Lehmann, CPA, is managing director of the internal audit financial advisory firm of Protiviti, based in New York, NY