Mind the gap.

Author:Van Wyk, Anton

Current views of internal audit's role and the value it brings to the organization suggest internal auditors must build on the trust they have with stakeholders, and seek out better ways to add value, if they are to remain viable in a rapidly changing world. Internal audit's purview has increased with the organization's move to integrated thinking and reporting. Auditors must consider the risks involved with the resources the company uses and the relationship the organization has with its specific stakeholders.

There is increased focus worldwide on environmental, social, and corporate governance factors both in investment analysis, as reflected in the United Nations Principles for Responsible Investment, and various investment codes. Boards are forced to assess the limited resources they have available to provide assurance, as well as assistance, as their mandate changes and responsibilities increase. This, along with an increased sensitivity to risk, will drive companies to reconsider internal audit's role and importance. Internal auditors must use this opportunity to gain the confidence of the audit committee, executive management, the board, and, in certain circumstances, regulators.

Internal audit must be engaged, better prepared, and more informed about the resources used and the reasonable needs and interests of its stakeholders. To ensure internal audit remains a crucial part of the organization, auditors must "Mind the Gap" between stakeholder expectations and what they currently are delivering.


Today's internal audit functions need to keep pace with change and manage any credibility gaps. The CAE's team must be resourced to deal with controls involving not only compliance, but also strategy, sustainability, and stakeholder relationships.

The CAE should attend senior management's strategic sessions to share where controls are in place for the organization's proposed strategy and where additional resources are required. By attending these sessions, the CAE can ensure, from inception, that adequate controls are developed. It must never be forgotten that a strategy has to be a controlled one.

As business demands more from internal auditors across the assurance spectrum, internal audit should align itself more strategically with the business's objectives and adapt to these demands with relevant skill sets. The internal audit plan should be risk-based and in line with the organization's short-, medium-, and long-term strategies.

The CAE can then provide a more informed report to the audit committee, a report that enables the committee to better assess the organization's risks...

To continue reading