The Institute of Internal Auditors (IIA) requires an External Quality Assessment Review (EQAR) at least every five years for the Internal Audit Activity (IAA). As part of the review, assessors examine the internal audit activity and evaluate their conformance with the IIA standards. Additionally, areas of success and opportunities for performance enhancement are identified. When working with clients, we’ve found it most helpful to break down the performance evaluation into the following distinct areas: planning, people, metrics, and tools. Upon doing so, we’ve gathered several noteworthy observations for each performance area. Today’s area of focus is tools.
Tools Observations
We generally see IAAs with an excellent audit plan and then fail to achieve their plan due to several common pitfalls. An IAA can have a meticulously designed, managed, and monitored set of procedures, but without the right tools to support the work activities, fewer internal audits are accomplished, the time taken to complete an audit is extended, or the depth and breadth of the review is limited. We have seen IAAs be hesitant to adopt new tools and technologies. However, this is as a great opportunity to deliver more to the organization and it should be done with greater frequency. It is important to leverage tools and technology to optimize the value that IAA can bring and allow the team to focus on what is important. An IAA needs to know that their performance is top of class and without tools that is hard to accomplish.
1) Tools Do Not Exist
From our reviews we see that regardless of the size of the funtion, there is still a significant reliance on, and comfort level for, manual processes versus tools and technologies. Few have data analytic or data mining tools. Few have flowchart or process mapping tools. Few have tools to support the remediation of open findings and are reliant on spread sheets for much of the work activity. These are all key activities within the IAA that would benefit from the consistency, efficiency, and automation that tools and technologies provide. Often cited as reasons not to acquire are cost, license fees, or too complicated to master.
The following questions should be considered:
- Could the IAA benefit from working more quickly, accurately,consistently, and efficiently through the use of automated tools?
- What internal audit activities could benefit from the use of additional tools and how does that impact the value to the organization?
- Can you reduce the administrative burden and redirect the time and efforts to auditee-facing activities?
- Can you use tools to increase customer and key stakeholder satisfaction?
2) Insufficient Use of Available Tools
From our reviews, we also see the lack of use of acquired tools and/or the tools being used sporadically and not across all internal audit resources and/or geographies. Often cited is the time that it will take to understand and fully utilize the capabilities provided within the tool, or that the module is not available in certain geographies.
The following questions should be considered:
- Are all of your tools being used? Where they are not used, could they be?
- Are the tools and technologies accessible to all internal audit resources and across all geographies?
- What internal audit activities can benefit from the use of the underutilized tools available?
- How can the tools be further utilized beyond today’s use and utilization?
- Could morale and/or efficiency be improved with the use of the tools in more areas of the internal audit activity?
3) Maximizing the Use of Available Tools
While many internal auditors have increased their use of tools over the last decade or so, many still do not take full advantage of the opportunities that the technology presents. Various Institute of Internal Auditors’ studies show that over 50% of Chief Audit Executives self-report that they fail to use or optimize the appropriate level of technology available to them. Careful consideration of additional functionality is therefore essential – both for current and future needs.
The following questions should be considered:
- Does your function have the right mix of tools and technology to support your quantitative, qualitative, and strategic metrics?
- What is valued in your organization and can tools help you achieve more value?
- Do you have the optimal range of tools that support the value you provide to the business or efficiency in performing quality engagements?
- Do you have a metadata standard for calculating consistent metrics across multiple years?
Many IAAs measure the percentage of the audit plan they complete during the year, and all of the above can increase the amount of internal audit coverage.
Examples of Common IAA Tools
Each IAA should tailor the tools that are needed based on the size and complexity of the internal audit activity. Below is a list of tools to consider implementing for your IAA:
- Automated or electronic workpapers
- Data mining tools
- Automated tools for data analytics and continuous real time auditing and monitoring
- Automated tools for remediation and open findings tracking
- Process flow software
- Integrated internal audit workflow
- Scheduling tools
How MorganFranklin Can Help
We work with our clients to provide an independent validation of the Internal Audit Activity and identification of opportunities to increase effectiveness, improve processes, and enhance credibility. Our methodology is built around complete support and encompasses benchmarking, best practices, templates, and tools to support business goals. To learn more about MorganFranklin’s EQAR, contact our experts below.
