Because of a scarcity of resources, small audit functions face several risks, including the inability to meet expectations of the board and senior management, failure to achieve objectives, and lack of continuity. But they can develop strategies and use tools to overcome these obstacles, taking advantage of opportunities related to their size.
Work With Stakeholders
Internal auditors in small audit functions should identify departments in their organizations that can add value to internal audit and assist it in leveraging scarce resources--departments such as risk management; compliance; environment, health and safety; security; legal; IT; governance and strategy; resource planning; and quality assurance. Building long-lasting relationships with these areas allows internal audit to be aware of identified risks and understand the processes and controls put in place to mitigate such risks.
Involving experts from other departments on individual engagements brings expertise that internal auditors lack for a specific project (IT, legal, engineering, etc.) and provides the experts with insight about internal audit methods and the types of information internal auditors are looking for. The experts should be independent of the audited area, supervised, and approved financially by management to provide assistance.
Internal audit also may consider asking someone within the organization to review audit work--someone who has knowledge and experience, particularly in governance, risk management, and audit practices, such as a former internal auditor or an employee who is a member of an audit committee in another organization. Documentation of such reviews should be kept.
There also should be cooperation with external auditors, peer reviewers, hired consultants, and regulatory authorities. Even if internal audit work is not used by external auditors or consultants, the chief audit executive (CAE) should keep in touch with them to discuss risks and potential flaws in the system of internal controls, as well as best practices. Knowing the plans and areas to be covered by external reviewers, an internal audit function can reallocate resources to other risk areas. The function may benefit from the findings in those areas addressed by external stakeholders and reviewers when they are interpreted through the prism of the whole organization.
Leveraging the knowledge, experience, and best practices of industry peers and local IIA chapters also can help resolve...