ADDING VALUE TO THE ORGANIZATION

Question and Answer Recommendations

December 2009

i
DISCLAIMER

Copyright © 2009 by The Institute of Internal Auditors‟ (IIA‟s) Global Audit Information Network (GAIN)
located at 247 Maitland Ave., Altamonte Springs, FL 32701, U.S.A. All rights reserved. Published in the
United States of America.

Except for the purposes intended by this publication, readers of this document may not reproduce,
redistribute, display, rent, lend, resell, commercially exploit, or adapt the statistical and other data
contained herein without the permission of GAIN.

ABOUT THIS DOCUMENT

As part of its services, The IIA‟s Audit Executive Center will be publishing a series of Question and Answer
(Q&A) reports to provide an easy-to-read summary of information on an issue of importance to IIA
members. Answers will be provided for internal audit practitioners by practitioners.

The information included in all Q&As is general in nature and is not intended to address any particular
individual, internal audit activity, or organization. The objective of this document is to share information
and other internal audit practices. However, no individual, internal audit activity, or organization should act
on the information provided in this document without appropriate consultation or examination.

ii
TABLE OF CONTENTS

Disclaimer.........................................................................................................................................................ii

About This Document .......................................................................................................................................ii

How Can CAEs Ensure Internal Audit Efforts Add Value? .............................................................................. 1

Adding Value Should Be Part of Every Internal Audit Process ........................................................................ 2

Measuring Added Value Is a Quantitative and Qualitative Process................................................................. 4

Word-of-Mouth Marketing Is Best .................................................................................................................... 6

Opportunities for Adding Value Are Created ................................................................................................... 7

iii
HOW CAN CAES ENSURE INTERNAL AUDIT EFFORTS ADD VALUE?

The September 2009 issue of IIA Insight featured a question-and-answer session in which IIA President
and CEO Richard Chambers, CIA, CCSA, CGAP, offers insight on how internal auditors can continue
adding value during challenging economic times. According to Chambers, when the economic crisis hit in
2008 there was a dramatic shift from an almost exclusive focus on financial controls and auditing of
financial risks that was predominant between 2003 and 2007.

As Chambers continues, many CAEs are looking at ways they can demonstrate the value that their
stakeholders are seeking, particularly as it pertains to helping the organization better manage risks.
Consequently, internal auditors must have a deeper understanding of the business and processes that
make the organization successful to assess the effectiveness of operational risks and controls.

Besides the IIA Insight interview with Chambers, several posts on InternalAuditorOnline.org1 discuss the
topic of what it means to add value, and an article published in the April 2009 issue of Internal Auditor
magazine2 addresses this subject as well. To continue the dialogue on ways internal auditors can add
value to their organization, three practitioners were interviewed representing internal audit activities of
different staff sizes, resources, and industry sectors:

James Hansen, Principal Auditor, City of Colorado Springs

Industry: Government/Nonprofit
Company type: State government
Internal audit staff size: 14 internal auditors
Mike Jacka, CIA, CPCU, CLU, CPA, Senior Audit Manager, Farmers Insurance Group
Industry: Insurance
Company type: Private
Internal audit staff size: 150 internal auditors
Eric Lundin, CIA, CSFA, CPA, CFIRS, Vice President & General Auditor, Home Federal Bank
Industry: Financial Services and Banking
Company type: Public
Internal audit staff size: 4 internal auditors

Before CAEs establish how their internal audit activity will add value to the organization, they need to
define what adding value means. Doing so will ensure internal audit efforts are specifically tailored to meet
the organization‟s high risks and pressing needs. Once defined, CAEs should keep in mind the following
four key points, as revealed throughout the interviews:

1. Adding value should be a part of every internal audit process.

2. Measuring an internal audit activity‟s added value is a quantitative and qualitative process.
3. When marketing an internal audit activity‟s added value, word-of-mouth references are best.
4. Opportunities for adding value are created — the process for adding value is the same
regardless of an internal audit activity‟s staff size.

Following is a summary of the key recommendations and thoughts collected from the three interviews on
what it means to add value as internal audit practitioners.
1
The posts are featured on From the Mind of Mike Jacka: “What Is This Thing Called Value-add?,” “Value-add (Part Deux),” and
“Value-add (Part Deux and a Half).”
2
Internal Auditor (August 2009), Back to Basics: “Delivering Audit Value” by Eric Lundin, pp. 18–19

1
ADDING VALUE SHOULD BE PART OF EVERY INTERNAL AUDIT PROCESS
All interviewees agreed that adding value is part of the regular course of an audit as long as internal
auditors properly perform their work. This entails going above and beyond the assurance provided;
developing audit plans that are specifically tailored to meet the organization‟s high risks and pressing
needs; monitoring the current risk landscape for any changes that might impact the organization; and
ensuring the goals of all functions, units, or departments are aligned to meet the business‟ strategic vision.

Are there particular organizational areas

or processes in which internal auditors
should add value?
James Hansen
“When internal auditors do their homework
upfront to really understand each business
function, there really shouldn‟t be any area in
which they can‟t add value.
“As auditors we have the luxury of stepping back
and asking, „What controls should be in place?‟
„How efficient is this process?‟ So there shouldn‟t
be any place in an organization where internal
auditors shouldn‟t add value.
“A lot of times, different business units don‟t think
about why they perform a particular task, such
as filling out a form; they just do it. Then we
come in and ask them questions that get them
thinking about their processes: „What is the
purpose of the form? Who uses the form? Is
there a better way to accomplish the purpose?‟
We can step back and examine the efficiency of
the process and recommend improvements,
which I think should be a part of the audit.
Determining Value During the
Risk Assessment Process
According to James Hansen, internal audit activities
provide a unique opportunity to look for ways to add
value during the risk assessment process. “In many
internal audit departments, the audit schedule is done
so far in advance that by the time you get to a
particular internal audit, it is necessary to take a fresh
look at the value the audit might bring,” Hansen
explains. “As a result, internal auditors need to
determine whether or not the audit might still be
valuable before it is performed or if there’s something
in an area of higher importance to the organization
that should be audited.”
To determine whether an audit is still valuable,
Hansen’s group holds a preliminary understanding
session prior to the audit, in which they ask the client if
anything has changed since the time the audit was
originally planned. This enables the internal auditor to
get an overview of the area or process that will be
examined and determine if it is still a high-risk item.
“One of the business functions in our organization that
does cash handling has had problems in the past. As
a result, we were told to audit them every year,”
Hansen recounts. “To fix the problem, the business
function implemented a new system, and our auditors
spent a lot of time during the implementation process
ensuring the proper controls were built into the tool.
This enabled the auditors to know which controls were
in place and their particular function.”

A year later, when Hansen’s group came back to audit

“Besides stepping back and examining a
process, it is necessary to build relationships
with your clients. By building relationships you
can have access to more areas of the
organization. We often get invited to attend
business meetings that we wouldn‟t even know
about. This enables us to acquire information we
can later use in preparing for the audit. Better understanding is a key to internal auditing adding value to
the organization.”
the system, they only had to obtain evidence as to
whether or not the controls were still in place.
“Because a full-blown audit of the system was not
performed, we were able to concentrate on other
areas within the business function where our insight
provided more value,” says Hansen.

2
 Mike Jacka
“The first thing you need to do is define what you mean by adding value. In our organization, adding value
means going above and beyond the assurance we provide as internal auditors. In particular, this might
pertain to streamlining a business process or bringing different units together that are performing the same
work but don‟t realize they are. Other times, the value we add is at a high strategic level. For example, we
perform audits that are more strategy-oriented by looking at how well particular department objectives
align with the company‟s overall strategy.”

Eric Lundin
“Sometimes internal auditors fail to see what the organization needs. However, if we do our jobs correctly,
we add value as part of the regular course of our audit work. To ensure we add value, internal audit
activities need to do a proper risk rating that identifies the high risk audit areas in the organization. This
risk rating is then used to develop the yearly audit program. Once the audit is completed, properly written
reports must be submitted to the audit committee that focus on those high risks and state whether or not
the controls are working as intended.

“In addition, auditors need to monitor changing risks and communicate with peers and colleagues to find
out what these changes are. For instance, 10 years ago information security wasn‟t a big risk, but now it
is. However, if an organization is using an audit work plan that was developed 10 years ago, is the internal
audit activity adding any value to the organization by not looking at information security? It most likely
is not.

“Another way to add value is by being judicious in the way we use audit resources, including the way we
allocate our time throughout the year. Therefore, if I spent 50 hours auditing a petty cash transaction to
find out it was off by 10 cents, did I add any value to the organization? What if I could have spent those
same 50 hours auditing a high-risk function, a different risk, or a new risk? This, in my opinion, is a better
use of an internal auditor‟s time and adds more value to the organization.”

3
MEASURING ADDED VALUE IS A QUANTITATIVE AND QUALITATIVE PROCESS
To measure the internal audit activity‟s added value, interviewees take a quantitative and qualitative
approach. Whenever possible, interviewees try to determine the dollar amount saved through the
implementation of a particular recommendation or the number of findings throughout the course of the
audit investigation. On the other hand, qualitative measurements include establishing relationships with
auditees, which enables the internal auditor to tailor the audit to the real needs of the business, or
determining the level of customer satisfaction.

How should an internal audit activity’s added value be measured?

James Hansen
“We try to demonstrate the value of our audit program by quantifying the savings garnered from our
recommendations whenever possible. If you can do that, that‟s great. Recently, one of our clients asked
us to look at a bill from a contractor. After we went through it, we were able to save the client $110,000.

“However, a key factor in being an effective internal audit department that adds value is to build a
relationship with those you audit. When you establish relationships with your clients, you are able to
acquire information you normally wouldn‟t have access to, which ultimately helps when planning your
audit work.

“We performed an audit in a department in which we identified initial findings. However, the department
had significant regulatory deadlines and did not have enough staff to implement the recommended
structure, so we were hired as consultants to facilitate the development of the infrastructure and reporting
tools. Some would argue that we compromised our independence, but in this particular case, we felt that it
was critical to get the project management and reporting tools in place immediately.

“We understood that even though we could not come back and audit the tools, we could independently
assess whether they were properly using the tools. Even though I can‟t quantify what we were doing, we
added value by stepping beyond the original scope of our planned work.

“In addition, there‟s the customer satisfaction aspect of internal audit work. Determining the level of
customer satisfaction is a great way to measure added value if you can‟t quantify it in terms of dollar
savings. You can send customers a satisfaction survey to determine any added value, although the client
first needs to understand the work that you do.

“We also keep track of any informal feedback we receive. Because of the relationship we have with our
clients, I know immediately if we have added value or not. They usually tell us they appreciate our work,
but many times they make a special effort to let our CAE know.”

4
 Mike Jacka
“Measuring can be both quantitative and qualitative. For instance, many companies try to keep track of the
dollar amount saved by implementing a particular recommendation. In our organization, we provide
information on any dollar savings and the assurance we provide in the audit report. Therefore, whenever
we go above and beyond in our assurance work, we include this in the executive summary of our report
without appearing self-aggrandizing. We also share this information with the audit committee.”

Eric Lundin
“We use both quantitative and qualitative methods to determine our added value to the organization.
Operationally and financially we are sometimes able to quantify our added value, but some operational
and most compliance issues are measured qualitatively.”

5
WORD-OF-MOUTH MARKETING IS BEST
Marketing the value internal auditors add to an organization is best done by letting others speak on behalf
of the internal audit activity. To this end, it is essential to cultivate relationships with auditees who in turn
will speak to others about the ways internal auditors have helped them improve a particular business
function or process. In addition, marketing can be done by including information about the internal audit
activity in brochures that are then distributed in relationship management meetings with business
executives. Finally, the audit report can be used as a marketing tool that demonstrates the value internal
auditors add through their work. The key is to write audit findings in a way that are positive and illustrate
how recommendations, if implemented, can enhance the function or process under examination.

Should internal audit activities market the value they bring to an organization?

James Hansen
“Internal audit activities should do a little bit of marketing if they are not getting the recognition or access to
organizational areas they need. But if you are doing your job right, other people will do the marketing for
you — word-of-mouth marketing is more effective than promoting the value you add on your own. For
instance, one of the functions that we audit was nervous at first about using internal auditors. However, we
got several requests for help from them because we built relationships with other functional managers who
spoke to them about the work we do.”

Mike Jacka
“The answer is an emphatic yes because auditing is nothing more than marketing when it‟s done right. I
am a firm believer in the marketing of the internal audit department. However, if all you are writing down in
the audit report is numbers and dollar savings to demonstrate your value, you won‟t be able to promote
your work effectively.

“To market the internal audit activity you need to demonstrate the types of work you can do to enhance the
organization. This information can be written in audit reports and audit committee write-ups. You can also
include this information in brochures you can distribute during relationship management meetings with
executives to help explain the types of things you can do for them.

“Finally, word-of-mouth recommendations are another great way to market your value.
In our organization, we have executives selling our value to other executives who then ask us for help.”

Eric Lundin
“Marketing the internal audit activity is a combination of two things. First, you need to continuously
communicate with the audit committee and business managers about the work that you do. Second, you
need to take the right approach in writing your audit reports and findings. In other words, rather than taking
a negative approach to explain findings, you take a positive approach. For example, rather than simply
reporting deficiencies or negative findings, we also comment on whether the process under review is
managing the high-risk activity well or incorporate positive comments regarding the controls that are
operating effectively and efficiently.”

6
OPPORTUNITIES FOR ADDING VALUE ARE CREATED
Overall, adding value is a mindset that should be part of the entire internal audit process. Although smaller
internal audit activities might have a harder time performing audits or consulting work that enables them to
add value to the organization, by implementing a risk-based approach to their work, internal auditors will
be able to review the company areas, functions, or processes that need them most. Thus, opportunities for
performing internal audits that add value to the organization exist regardless of the size of the internal
audit activity and its resources.

Is the process for adding value the same regardless of internal audit staff size?

James Hansen
“It might be a little bit easier for a larger internal audit activity to add value. This is because a large group
has more resources and time to engage in activities that help add value to the organization. However, the
process for adding value is the same; a smaller internal audit activity simply might have to carve off a bit of
time each year to do something that is not traditional, such as sitting down with a business unit and finding
out what their key risks are.”

Mike Jacka
“Adding value is a mindset that should a part of the entire internal audit process. For instance, adding
value is not an actual line item in our individual goals and objectives form, but it is a performance
expectation. We also include a description of any type of activity in which we added value in the
performance review. Therefore, even a small audit department should be able to add value.”

Eric Lundin
“I don‟t see any difference. I work in a small audit department, and in my case, it‟s almost easier because I
have a direct reporting relationship to a senior executive. However, ultimately what it comes back to is risk.
Should I spend the same amount of time auditing something that is a low risk to the organization
compared to something that is a high risk? The answer is no, and most internal auditors would give the
same response. It also boils down to being judicious in the way we use our resources by continually
asking ourselves, „What value are we adding through our consulting or assurance work?‟ Answering these
two questions will help any internal audit activity regardless of size position itself in a way that continuously
adds value to the organization.”

7
8