Internal audit can deliver more value: IA groups have the potential to shape Sarbanes-Oxley compliance into a sustainable process and to position their companies to better leverage the significant investment already made in those compliance efforts.

• Author: Campbell, Mary

In most organizations, internal audit (IA) groups are focused solely on their role as an independent reviewer and critical appraiser of the effectiveness of internal controls and the company's overall financial health. Although IA still owns this responsibility, it has new opportunities under the Sarbanes-Oxley Act of 2002 to provide much greater value to the organization.

IA departments have played a significant role in meeting Sarbanes-Oxley Section 404 requirements. Now, they have the potential to shape Sarbanes-Oxley compliance into a sustainable process where business owners shoulder their full responsibility for ownership of business processes and associated controls. Also, IA groups have the opportunity to take on a more strategic role, to position their companies better to leverage the significant investment in compliance, delivering real value to shareholders and management.

Shifting Internal Audit to a Customer-Centric Model

IA departments need to take a customer-centric approach to delivering value. To implement this approach, IA must use some of the same methods that externally-oriented departments utilize, such as:

* Maintaining an open dialog with all business units starting with commencement of their annual strategic planning process and continuing throughout the year;

* Developing an obsession with exceeding and anticipating the needs of business units;

* Investing not only in developing better technology and audit skills for IA resources, but also working to build business understanding and industry specific knowledge; and

* Ensuring a pervasive customer orientation approach, as opposed to the traditional "rule-keeper" role, throughout IA's operations.

The Capability Maturity Model (CMM) in this article shows different components of a measurement model that IA can use to measure the value it delivers to the company. The eight capabilities represent different characteristics of IA's role, depending on its current state.

To better understand each state of capability within a company's IA group, read down through any of the columns in the CMM to get a picture of each capability for an enterprise in that stage. If there is a particular area of interest, read across any row and determine which of the stages your company's IA group is in for that capability.

For example, the Strategy capability under the Improvement Needed state indicates IA's role is not linked to business strategy with a sole focus on testing and field work. Conversely, the Best Practices state reflects more sophistication and additional value delivered, with IA taking on a role as a business partner with broad organizational consensus on this role. This state might also include a proactive IA group providing advice on emerging trends, including setting up a rotational system of...