This is a very basic question which bothers every Internal Audit Head. Every Internal Audit Head wants to align IA Strategy with Business Strategy and wants to demonstrate the same to management & process owners. But the question remains How???
Let’s begin with definition of Internal Audit -
· Perform Assurance & Consulting Activities
· To evaluate and improve –
- Internal Control,
- Operational Efficiency and
- Risk Management
· For support of Management and Audit Committee
Every Business Strategy has some "Critical Success Factors" e.g.
· Enhancement of Tie-ups with other companies
· Marketing & Branding
· Curtailing down Customer Order Processing
Each Critical Success Factor of Business Strategy gets directly / indirectly impacted by Governance / Internal Control / Operational Efficiency / Risk Management. There is need to stretch the thinking and identify most relevant area impacting these critical success factors out of Governance / Internal Control / Operational Efficiency / Risk Management.
"Enhancement of Tie-ups with other companies" can be related with Governance as a better governed company will have better chance of tie-up since other company knows that roles & responsibilities are clearly defined & documented; there is zero tolerance to fraud / regulatory non-compliance;
“Marketing & Branding” requires huge expense on and a better Internal Control will ensure that procurement of marketing service is at cost effective by obtaining 3 quotes from vendors etc.
“Curtailing down Customer Order Processing” can be linked to operational efficiency and Internal Audit can participate with management in design level review of automation initiative as part of consulting activity which results in operational efficiency.
This approach may not be perfect but it worked for me in many organizations. Please share your views and comments below.