Business Ethics Journal Article

APRIL 2020 39INTERNAL AUDITOR

oard and management stakeholders want internal audit to demonstrate greater business acumen. They want auditors to have a broad understanding of the organization, as well as anticipate how to help the organization achieve its objectives.

That means auditors need to see beyond their area of expertise and responsibility. They must be agile to act proac- tively and congruently with the organization’s way of doing business. By recognizing these expectations, internal audit can show that the department is an excellent place to develop business acumen.

FIT BUSINESS NEEDS Organizations expect all senior managers to have the busi- ness acumen to lead their areas of responsibility and support broader organizational success. Managers should be able to anticipate and act on ways to add value to the organization and its stakeholders.

Likewise, internal audit needs to identify the best ways for the function to develop business acumen that fits the organization’s needs. It can’t take a one-size-fits-all approach,

B

Internal audit can incorporate elements of the Balanced Scorecard approach to build its ability to anticipate and meet the organization’s needs.

Audit With

Basil Orsini

Acumen

BUSINESS ACUMEN

-S TR

IZ H

- /

SH U

TT ER

ST O

CK .C

O M

AUDIT WITH ACUMEN

APRIL 2020

though, because business acumen will vary by industry, type of business, and the kind of service a business unit pro- vides. For example, internal audit will require different aspects of business acumen than business lines, such as sales and production, or support ser- vices such as fi nance and security.

Moreover, internal audit’s assur- ance role in relation to other assurance roles within the organization impacts the kind of business acumen it needs. Developing business acumen can enhance internal audit’s risk-based

coverage of the organization’s main lines of business, as well as the fi rst two lines of defense.

In developing business acumen, internal audit should not be seen as narrowly focused rule-followers who avoid innovation and taking risks. Chief audit executives (CAEs) should ensure the audit staff understands the capabilities of the organization’s fi rst two lines of assurance, as well as the business’ main products and services.

Their strategy for establishing business acumen should involve human resource activities, such as hiring, promotions, and career planning, as well as profes- sional development activities.

ENABLED BY THE STANDARDS Internal audit’s use of business acumen must reinforce, and not compromise, auditors’ professional competence. The International Standards for the Profes- sional Practice of Internal Auditing place great importance on risk-based plan- ning — multiyear, annual, and engage- ment — to ensure that services are strategic and add value. Having busi- ness acumen enables internal audit to proactively plan and adapt all forms of audit activity to anticipate the organiza- tion’s assurance needs. This capability goes far beyond simply repeating cycli- cal coverage or responding to senior management requests.

There is no trade-off between demonstrating business acumen and conforming to the Standards. On the contrary, internal audit can build busi- ness acumen on a sound understanding and innovative implementation of the Standards and associated guidance.

CAEs have used a variety of meth- ods and approaches to attune their staff to the business needs of their organiza- tions. The examples in the boxes that begin on page 41 demonstrate how business acumen can work in internal

Internal audit can build business acumen on a strong understanding and implementation of the Standards.

40 INTERNAL AUDITOR

TO COMMENT on this article, EMAIL the author at [email protected]

GOVERNANCE

These examples can improve mutual understanding, enhance business capabilities, and strengthen relationships at the governance level of the organization: » Have the CAE actively participate in regular meetings of the audit com-

mittee operational governing body. » Assign individual audit managers to each of the major lines of business

as account managers. » Build the internal audit universe on top of the organization’s strate-

gic objectives. » Conduct organizationwide internal audits in support of key corporate

activities such as internal communications.

audit. These examples are based on four perspectives adapted from the Bal- anced Scorecard strategic planning and management tool: governance, client, internal processes, and innovation and learning. The boxes substitute gov- ernance for the Balanced Scorecard’s fi nance measure. CAEs should plan, track, and report to the board and management on initiatives in each of these areas.

INTERNAL AUDIT’S ACUMEN CAEs are likely undertaking some or many of these initiatives, as well as some others. To get the attention and mutual understanding needed, annual internal

CLIENT

These examples can improve mutual understanding, improve business capabilities, and strengthen relationships with the organization’s busi- ness units: » Base multiyear, annual audit, and engagement plans on the organization’s

corporate and business risk profi les. » Include strategic upside risks of opportunities and strengths in annual

internal audit plans to complement the traditional focus on key downside risks of weaknesses and threats.

» Reinforce the role of other internal assurance functions (second line of defense), such as risk management and fi nancial control, by auditing their processes.

» Invite business units to link the timing of audit engagements to their busi- ness information needs, such as in support of future fi nancial approval submissions for major initiatives or new programs.

» Provide information on assessment criteria well in advance of an audit engagement when there are known shortcomings, to enable managers to take corrective action before the audit.

Business acumen is one of the top three skills CAEs focus on when recruiting, but 39% say it is very diffi cult to recruit effectively, according to the 2018 North American Pulse of Internal Audit.

41INTERNAL AUDITORAPRIL 2020

APRIL 2020

INTERNAL PROCESSES

These internal audit processes can improve mutual understanding and business capabilities, as well as strengthen client relationships throughout the organization: » Report more deeply on audit fi ndings by avoiding a narrow-minded approach to audit issues.

For example, reports should discuss the broader implications and possibilities of fi ndings, such as their impact on broader business objectives. Internal audit also should show how fi ndings link to implications for other business purposes and recommend reducing ineffi cient internal controls.

» Submit periodic status reports on the internal audit plan’s implementation and adjust them dur- ing the year to better address emerging business assurance needs.

» Issue periodic reports on signifi cant operational risks based on analyses of internal audit fi nd- ings within the organization or across the industry.

» Offer to provide consulting and research services in conjunction with individual engagements. » Invite internal audit team members to meet the audit committee and observe its discussion of

their individual engagements.

audit plans and year-end reports should include a formal strategy on investments in building staff capabilities to better respond to the emerging needs of the organization. This approach can foster productive discussions and improved understandings with management and the audit committee.

BASIL ORSINI, CIA, CGAP, CRMA, CFE,

is a recently retired internal auditor from

the Government of Canada in Ottawa.

43INTERNAL AUDITOR

INNOVATION AND LEARNING

These examples of innovation and learning can improve mutual under-standing, enhance business capabilities, and strengthen relationships: » Assign talented employees from other business units to short-term

engagements within internal audit. This practice can develop those employees, as well as bring their insight to audit staff members.

» Send talented internal auditors on developmental, nonaudit assignments within business units. This practice can help those auditors build business acumen and pass their knowledge to the teams with whom they work.

» Bring internal auditors from fi eld offi ces to work at headquarters. » Train new managers on internal audit’s role and areas of expertise such as

management control and risk management. » Participate in professional associations other than internal audit, such as

risk management, IT, security, and fraud prevention. Such groups can help auditors keep abreast of leading practices and share lessons learned with audit colleagues.

Knowledge of the organization and its risks and industry-specifi c knowledge are among the business acumen attributes spelled out in The IIA’s Global Internal Audit Competency Framework.

Copyright of Internal Auditor is the property of Internal Auditor and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use.