Internal auditors can be in the position to make meaningful contributions to the organisations they serve by providing insight into organisational risks and opportunities.

“The value of the internal audit activity is in its ability to provide objective assurance and insight on the effectiveness and efficiency of governance, risk management, and internal control processes,” explains Institute of Internal Auditors Research Foundation (IIARF) Vice President Margie Bastolla, CIA.

A research commissioned by the IIARF identifies five factors as critical enablers of insight delivery:

1. A strong control environment and tone at the top, where executive leadership and operating management are open to improvement recommendations.
2. Clear board and management expectations for value delivery.
3. A reporting relationship that supports the independence of the internal audit function.
4. A competent CAE.
5. An internal audit team with sufficient practical skills as well as industry and organisational knowledge to provide a pragmatic bridge between an audit process and the business management of risk.

The study also revealed a gap between CAEs’ perceptions of how the internal audit activity provides insight versus stakeholders’ perceptions.

Specifically, 66 percent of CAEs indicated their internal audit function “always or frequently” provides insight, whereas only 61 percent of board members believe their organisation’s internal audit function always or frequently provides insight.

That number drops sharply for senior management executives: A mere 38 percent believe their internal auditors always or frequently provide insight.

In the interviews, board members consistently identified the importance of internal auditors having strong information technology (IT) knowledge and experience.

This partially sheds some light on the differences in opinion between board and executive stakeholders regarding internal audit’s actual delivery of insight “frequently” or “always.”

During research interviews, board members expressed they value the assurance on internal controls and risk management that internal auditors provide. They particularly value assurance on IT areas of the organisation where, as board members, they generally have minimal hands-on experience.

Executive stakeholders felt IT assurance, however, does not rise to the level of “insight.” They do view as insight the advice from internal auditing on things such as a new way to approach an issue or a useful recommendation to enhance operations.

Stakeholders expressed that an internal auditor’s lack of operating or general management experience is viewed as a hindrance to providing true organisational insights, and may cause management to reject an internal audit analysis or recommendation.

“You have to be proactive, well-informed, articulate, business- and management-knowledgeable, and sometimes a courageous leader to demonstrate insight delivery to your stakeholders,” says Deloitte & Touche Internal Audit Partner Patricia Miller, CIA, who co-authored the report.