How do you get the most out of your review?

Each year, Internal Audit should be undertaking a self-assessment of its own effectiveness and, to meet International Internal Audit Standards, an external review should be undertaken at least once every five years.  Quite apart from meeting the standards, commissioning an external review brings an outside perspective on the effectiveness of a key source of assurance for the board and audit committee.  To get the most out of your external review, there are five main things to think about.

1. Think through your objectives

You may be looking for confirmation that internal audit's work is robust and it is making the right impact.   But, at other times, there may be particular areas of internal audit's work that could benefit from an external perspective and specific suggestions for improvement (e.g. how can reporting to the Audit Committee be improved?), or there may be specific areas you want specific assurance (e.g. how does Internal Audit’s annual planning process stack up with best practice?).  When commissioning a review, make sure you’ve thought through your objectives and these are clearly communicated to your reviewer.

2. When to do it

Timing isn’t just about getting an internal audit review done every five years.  View this as a minimum period to commission a review.  Given the pace of change in the external environment and with regulation developments, a more timely review may be become appropriate.  Likewise, there may be changes in business model or major changes to Internal Audit itself, and the board and audit committee may benefit from an external review of Internal Audit before the five years are up, for example to help gauge how a restructuredaudit team is progressing.

3. Make sure you’re ready

There’s a lot you can do to prepare for an external review.  Forward-thinking audit functions will have a clear plan of how their effectiveness reviews are to be conducted over a cycle, and how this will be done.  They should also be clear about where they are in their improvement journey, with an action plan and milestones.  And, before the external review gets underway, make sure Internal Audit’s stakeholders are properly briefed and know how they will be involved.

4. Choose the right reviewer

Skills, experience and track record – these are the obvious things to take into account when selecting your reviewer.  But there are a few other things to take into account.  Does your external reviewer bring the right perspective and understand the needs and expectations of Internal Audit’s key stakeholders?  How experienced is your review team and not just their firm?  Will their work be tailored to your needs and circumstances?  Is there good chemistry and does your reviewer ‘get’ your values and culture?  Make sure you meet the review team who will do the work, and use your network to find out what they are like to work with.

5. And finally…

Of course, fees will come into it as well.  But different reviewers bring different experiences, have different approaches, engage with you differently and deliver different insights.  You’ll probably get what you pay for, so it comes back to being clear about what you’re looking for.