The Purpose of Internal Audit

Internal audit (and external audit), as a business function can seem to serve different purposes based on one’s perspective. For the board, it may seem to serve as a process to review what management is doing and how, and for management, it may seem to be an intrusive process designed to confirm things that are already being performed by catching errors and holding people accountable.

But what is the main purpose of internal audit? Why is it important?

According to the IIA (Institute of Internal Auditors): Internal auditing is an independent, objective assurance, and consulting activity designed to add value and improve an organization’s operations.

Exactly! Now we know.

But in all seriousness, I think that the main purpose of an internal audit is frequently hidden in technical definitions like the one above. And by simplifying the definition for clarity, we can better understand why internal auditing can be so valuable:

Internal audit’s purpose is to make things (processes), better.

Internal audit is about having a third party (the auditor), evaluate something (financials or processes), against specific criteria (i.e. expectations when reviewing controls). What is not articulated is that the ultimate goal (in my opinion), for either process is to make things better. This is done by:

1. Reviewing items and comparing them to the expectation (Were the right things done?)
2. Identifying exceptions (“That doesn’t look correct; there could be a problem.”)
3. Evaluating exceptions (“This is incorrect because…someone needs training, or someone is acting badly.”)
4. Fixing any errors that can be fixed
5. Recommending improvements to avoid exceptions in the future (making the process better), and helping to mature processes and auditability

The purpose of the review is to make things better; to review and then improve. The role of the auditor is to act as an independent party: management decided to do things one way, and the question is whether the independent party (the auditor), agrees with the approach. Does the process meet the objectives? Can you support (justify), your reasons for doing it that way? And if not, a discussion between management and the auditor should occur to develop agreement in perspective and approach. Why? To make things better. Easier. More effective.

I think that this perspective (audits as a tool to make things better), benefits everyone as it sets a purpose to the activity (the audit), that it is about something bigger than just an evaluation, checklist, or monitoring. It then becomes a process for change, betterment, and better outcomes. Transparency and accountability are key characteristics of audits, and I encourage auditees to respectfully ask questions and challenge your auditors on their work and findings. If the auditor cannot explain something to you or convince you of their viewpoint, there is an issue somewhere with perspective or communication, and you should seek clarification so that everyone is on the same page…to make the process better. That is part of the auditor’s role (transparency), and they should be willing to work to bring everyone to the same page. Maybe they are right…maybe you are right…maybe the right answer is somewhere in between…together we can find it.

By working on audits together with this principle (i.e. how do we make the process better based on the evaluation”), instead of positions (“I am [management/the auditor] and I know best”), audits can fulfill the opportunity they represent: to objectively evaluate what is done, determine if the processes are doing what is expected and needed, and make changes to improve where there is opportunity.

By not making the audit a fight, but a shared process for improvement, the approach becomes “we” instead of “us and them.” As a result, auditors and auditees can work together to find the best solution overall as a team, which will only lead to better ideas, results, and a better auditing experience.

What Next?

Why talk about this purpose?

Internal audit’s purpose is to make things (processes), better.

In my experience most auditees don’t have an accurate sense of why audits occur, their value, and why the auditees’ participation is so important to the success of the process. If auditors (both financial and internal), share this message with their clients from the start and auditees learn this purpose as well, then auditors and auditees can work together to evaluate, find issues, fix them, improve processes, and make things better. The alternate approach where auditors are viewed as accusers or interrogators (to some degree), only creates and builds a gap between the groups which doesn’t help anyone, and frankly hinders and undermines the process. Whether we collaborate as a team or struggle in a contest of wills, the purpose is the same, but the results will be vastly different.

I propose that whether you are an auditor or auditee that we declare and share this purpose of audits first. We can still maintain professional skepticism, require verification of assertions, and follow the standards, but we must remember that to serve the audit mission best, we must create an atmosphere that is open to change. I think this purpose helps to achieve that goal.

Please contact Sam BowerCraft to learn more about the internal audit services at McKonly & Asbury, and how we can work with you to make things better.