Seven things you (probably) don’t know about internal auditing

As internal auditors we are often asked: “What exactly do you do?” There are lots of misunderstandings about the role. Often confused with external auditors and compliance, internal auditors look at what is really happening and provide insight from the evidence. We improve processes by finding the pinch points and bottlenecks in an organisation based upon what the data says is happening.  What does that actually mean we do day to day?

Here are seven things you might not know.

1. It does not mean accounting

When most people think about audit, it’s all about accounting and finance. But internal audit covers a very different range of subjects. As a general rule, external auditors look at the financial aspects of the organisation while internal auditing covers everything else. Internal auditors look at how processes and policies operate within organisations so they can find ways to maximise efficiency, good governance and reduce risk.   

It’s all about identifying issues and taking care of risks before they cause major problems for the organisation.

One of our members put it succinctly some years back: internal audit is a bit like going to your GP. They can check you over, give you some good advice on how to fix things before they become big crises. They will also refer you to a specialist if you need additional help.  

I head up a team, predominantly of engineers, looking after the internal audit of operational risks relevant to the mining industry. Internal audit is a process and differing perspectives and backgrounds provide similar benefits to having a diverse team. Our team has people from non-accounting backgrounds who are significantly well regarded in the organisation. Our culture makes it a highly desirable place to work within the company and has been a key driver of talent acquisition and retention.

2. It offers a bird’s eye view of an organisation

Working in internal audit means that you have access to virtually every part of operations. You will need to learn how each department works, what value they should be delivering to the organisation, and how each department works in tandem with the others. 

This also means you will rarely be stuck in a cubicle doing the same thing every day. Working for a national or international firm may involve frequent travel to other offices and sites. This kind of experience is invaluable for career development as you gain a far greater understanding of the organisation than those focused on just one area.

Internal audit gives you a great understanding of high-level organisational topics. Your interaction with senior stakeholders and others in positions of power provides significant organisational influence, unparalleled by other roles.

3. It delivers direct access to senior management

When conducting internal audits, you will need to work directly with the senior management in the departments you are auditing. This means you will be working with leaders across the spectrum of the organisation. If your goal is to raise your profile, increase your network and build better business relationships, then this offers the ideal opportunity. You will be able to demonstrate your skills and experience directly to the people who make decisions in your organisation.

During COVID we paused our audits of procurement to let them focus on securing our supply chains. Instead, we did a piece of data analytics on travel and expense management and developed a dashboard that highlighted anomalies in process and where some controls were being bypassed or not working as intended, plus provided some insights on data quality issues. Management has since embraced this dashboard, adopting it for use in continuous controls monitoring in procurement and broadening its scope to include other areas, such as delegation of authority compliance.

4. It’s who the board relies on

It is best practice that internal auditors report to either the audit committee or directly to the board.

In Australia, the ASX Corporate Governance Principles and Recommendations mentions internal audit a number of times. It says the board of a listed entity should receive reports from internal audit on how adequately the organisation is managing risk. 

The principles point out that the internal audit function can help a listed entity by bringing a systematic, disciplined approach to evaluating and continually improving the effectiveness of its risk management and internal control processes.

If a listed entity has an internal audit function, the head of that function should be suitably qualified and have a direct reporting line to the board or to the board audit committee to bring the requisite degree of skill, independence and objectivity to the role.

If a listed entity does not have an internal audit function, the board or audit committee should review periodically whether there is a need for such a function.

5. It priorities communication skills

Internal auditing is an information service. Its primary task is to tell the board and management what is really happening. It then tries to help the organisation improve its processes.

Sitting down and talking with different departments in your organisation will be of paramount importance. Articulating your observations and presenting them in a way that is thorough, easily understood and useful is just as important as the analysis itself. If you hand over a 300-page report, for example, is anyone actually going to read it? It’s far better that you can give clear and concise feedback that is then backed up by research.

Communication skills are the most important skills to being an auditor. Our position and role are to communicate and influence. We are the organisational radar that helps operations steer in the appropriate direction. Many audit actions and outcomes have resulted in significant organisational change, including the focus on societal outcomes and expectations.

Critical skills forming part of an internal auditor’s toolkit include influencing, dealing with boards, audit committees and management.

Writing and public speaking are also essential. When I started in this industry, I was terrified of public speaking. But recently I spoke at a conference to hundreds of people.

6. It’s becoming increasingly important

With the push for organisations to become more environmentally and socially responsible, regulators and industry bodies are continuously creating new guidelines and rules that must be followed. Increasingly, it is becoming the role of the internal auditor to make sure these are put into practice. This means the internal audit profession is becoming a driving force in shaping strategy and operations.

There is always a new issue or regulation to take into account, so it’s pretty rare you will ever do the exact same audit twice. This variety means you are always learning new skills and have to stay on top of changes in regulation.

7. It’s not the organisation’s police force

As a presenter at one of our conferences recently articulated perfectly, “I saw internal audit as my best friends — they could catch me before I fell, as they could see things I couldn’t.”  Internal audit is not about catching people out or keeping score of mistakes, it’s about working with the teams in your organisations to help ensure they do the best possible job.

Peter Jones is chief executive of the Institute of Internal Auditors.