Behind the Tick: What Can Your Internal Audit Really Do for You?
Internal Audit for the Wrong Reasons
With Internal audit now becoming a requirement, businesses sometimes hire audit staff purely to be able to tick that box, with no further idea what to do with them.
Many auditors find they are just reproducing external audits, and while that might help when the external auditors came to visit, it doesn’t provide much in the way of valuable information for the business.
An internal audit should be a constructive exercise designed to determine the extent to which a management system is complying with its own procedures and practices. An internal audit can also identify improvements to the business processes and help with internal communications.
What Are Internal Audits?
Although internal audits are usually conducted by company employees, there has been a rise in external specialists being hired for the sole purpose of auditing. Just as you outsource your legal or financial roles you can also outsource audit roles.
Your internal audit is the most important of all audits. It lets a business look at its own systems, procedures and activities to decide if they are right for the business and whether staff are actually following them.
It provides management with information on whether their quality standards are being met, whether the system is as efficient and as effective as it should be and whether improvements are needed.
Also they can provide a line of communication throughout the company and be a great motivator.
What Internal Audits Are Used for
The criteria for Internal audits is usually the business’s own policies, procedures and work instructions.
You are not looking to audit directly against a particular external standard during an internal audit, basically duplicating what a third party auditor would do; instead you are ensuring that your own policies and procedures are being used correctly in the day-to-day tasks.
Providing the company's internal documents have been developed in line with all the external compliance requirements, and reference the appropriate standards, your external requirements should be covered. However, an understanding of the standards and requirements does help to provide a basis as to what the documentation should include.
Audits Don't Need to be Feared
Most standards and codes require audits. Audits should be seen as a benefit to the company, rather than chore or an imposition.
An audit is used to gather information which is then reviewed and reported on. This report will often discuss the need for improvement or corrective actions.
But an audit is not a witch hunt to place blame on an individual staff member or a particular area of the business. Audits should be conducted in a positive and transparent manner. Your auditor should make you and your staff feel at ease and confident about the audit, rather than fearful.
Your auditor needs to work with you to make sure your audit works for you, while still staying independent and objective about any information they have found.
What a Good Audit Can Do
- Confirm if documented procedures are being followed
- Provide accurate information on the effectiveness of current procedures
- Assist with the development of continuous improvement plans
- Identify where changes to procedures are needed
- Improve awareness and understanding of process requirements
- Help minimise risk
- Improve work place safety
- Improve internal communication
- Confirm positive work practices
- Provide information to help increase the sales of your products or services
- Let you make more informed decisions to help your business grow
Internal Audit Schedules and Scopes
As we have established that you are not wanting to just tick a box, you actually want to put your Internal audits to good use, your audit schedule should be based on risk assessments that you complete. Which areas of your business are showing they need extra attention at the moment? Which areas would you like more information about how they are really doing?
You also need to review your available resources when setting your audit schedule. How many audits can you realistically complete in a year? How many should you be doing? Are you able to complete enough audits to make you feel comfortable you are meeting your external requirements as well as finding the information that you actually need?
Just as you need to prioritise when creating the annual audit schedule it is also a large part in developing the scope of the audits. The scope sets out what is actually going to be looked at in the individual audit. Given the potential size of the areas and processes to be audited it is critical to know where your attention is needed most.
Things to Consider
When creating your audit schedules and audit scopes you need to look at the following:
- Recently completed risk assessments
- Information relating to possible financial, product andsupply impacts
- Quality of internal controls: Are they as strong as you believe they should be? Are they being used?
- Any customer complaints received
- Degree of change or stability: Has there been a large changeover of staff? Have the same staff been in the department since it started?
- Results of the last audit engagement and any corrective actions listed: Have they all been acted on?
- Discussions with staff at all levels about any areas they feel need attention
- Are any special skills or knowledge required to complete the audit?
It Is Your Audit
Ultimately—regardless of who conducts the internal audit, internal staff or external contractors—it is your audit, and you need to know what information you are wanting to look at.
Audits can be as simple or as complicated as you like. And remember, you are the only one who really knows what information is valuable to you.
If you want to find out why one area of your business always appears to do better than others, or what is the most popular day for your staff to have a day off, an internal audit can help you find that out.
Please note: The above article is not intended to be used as stand-alone audit advice.
© 2017 Katrina McKenzie