Board briefing: When should an organisation establish an internal audit activity?
We believe that an effective internal audit activity is essential to the success of an organisation. To help board members and senior managers decide about the need for internal audit we have put together a short list of questions. If you answer YES to one or more of the following questions there is a greater likelihood that you will need internal audit now rather than in the future.
Questions
- Do you operate in a sector or operating environment where there is a legal, regulatory or funding requirement to establish an internal audit activity?
- Does the organisation provide services to other organisations that stipulate the need for internal audit as part of contractual conditions?
- Does the board feel there is a lack of independent assurance on the effective operation of risk management and risk mitigation, particularly the adequacy and effectiveness of controls?
- Does the board feel there is a lack or shortage of assurance from activities within the organisation, for example, from other assurance functions such as risk management, security, compliance, health and safety?
- Are controls within the organisation known to be, or believed to be, poorly designed or ineffective?
- Have you recently experienced major problems that have damaged the reputation of the organisation, in particular projects that have overrun, higher levels of customer complaints, financial loss through error or fraud or failure to comply with contractual conditions?
- Does your organisation anticipate major growth or downsizing, increased complexity and/or major changes in the near future, thereby creating additional pressure on operations and controls?
- Is management information considered to be weak, inaccurate or poor?
- Does the operation have an overseas presence whereby assurance on the global activity needs to be obtained?
There is no right or wrong method to the delivery of internal audit, simply options, including:
- In-house full time or part time
- Outsourced to an external service provider
- Joining an internal audit consortia
- Co-sourcing with an external service provider
Before making a decision about the need and extent of internal audit and the approach to adopt we recommend that boards and senior managers should consider the areas where independent assurance is most needed, the issues and problems that have occurred and the likelihood of change that is occurring in the organisation. In short, considering the risks the organisation faces and current levels assurance will help you decide how much internal audit activity may be needed and how to best to obtain it.
If you answer 'yes' to one or more of the above questions and would like further guidance, please feel free to email the resources team for advice.
Download PDF