What is an internal audit strategy document and how valuable is it?
A blog by our EQA review team | 21 August 2017
“Would you tell me, please, which way I ought to go from here?”
“That depends a good deal on where you want to get to,” said the Cheshire cat.
“I don’t much care where –” said Alice.
“Then it doesn’t matter which way you go,” said the Cat.
— From Alice in Wonderland, by Lewis Carroll
“The essence of strategy is choosing what not to do.” —Michael Porter
There is no formal requirement within the IPPF for internal audit to have a strategy document, although Standards 1300 - 1320, which set out the requirements around the Quality Assurance and Improvement Programme, provide a golden opportunity for functions to take a good look at what they do and how they do it.
Creating a strategy document serves a number of useful functions:
Firstly it helps demonstrate that the internal audit function understands the organisation’s strategy, creating a link between the two documents as well as considering its potential impact on the department, particularly in terms of future resourcing and skills.
Secondly, the mere act of writing (and agreeing) a strategy can be a useful opportunity to bring members of the internal audit function together to brainstorm and clarify what the department stands for, what it considers to be its Unique Selling Proposition (e.g. when compared with a compliance or control function) and “put flesh on the bones” of the audit charter/terms of reference.
Finally, as noted by Professor Porter (above), a strategy document can also be used to clarify the function’s role and help educate stakeholders. Expectations of internal audit vary enormously across organisations, often depending on the previous experiences and personal preferences of the senior management team and audit committee.
It does not have to be a long and complicated document, a short and focused strategy is more likely to get the attention it deserves. Keep it simple with emphasis upon:
- The value internal audit provides to the organisation
- Key objectives and priorities, related to risks
- Specific projects and involvement in change
- Major developments in internal audit practice
- The resources needed to deliver the strategy
Refer to specific parts of the IPPF at appropriate points in your strategy i.e. the Definition of Internal Audit, Core Principles, Code of Ethics and International Standards as this will help to underline your professional approach.
A standard format or template is likely to be used by other business units and departments in the organisation – using this will not only save time but should also meet expectations.
One final thing, plan the way the strategy will be communicated to stakeholders by using a range of different methods.
Further reading
Top tips for preparing an internal audit strategy
