Internal audit: untapped potential

Internal audit is a key service within public sector organisations. It supports governance processes and risk management by providing assurance, ensuring that public money is being spent well. Yet there is more that internal audit can do to help organisations achieve their goals.

In a time of rapid change, with climate, cybersecurity and financial risks on the horizon, the role of internal audit is crucial. However, the profession also faces significant challenges around resourcing, recruitment and retention of expertise, and reporting lines. There is also a need for a culture shift around perceptions and expectations of the internal audit function.

This report reflects a wide-ranging survey undertaken in 2021 across the public services, including views taken from members of the internal audit profession and audit committees. From this feedback it is evident that while internal audit is currently working effectively, there are areas where it can do more and increase its impact.

Our research also identified requirements for targeted guidance and support, and CIPFA and the Chartered Institute of Internal Auditors (CIIA) will be collaborating to meet those needs.

Internal audit: untapped potential contains recommendations that aim to unleash that potential, and advocates for the value of what internal auditors do. A strong audit profession leads to better public services, for the benefit of everyone.

Engaging with senior management and the
audit committee, while maintaining independence and
objectivity.

Aligning internal audit plans to the organisation's priorities.

Providing timely and meaningful assurance, and communicating it well.

Challenging decisions constructively and helping find solutions.

Responding to emerging risks and changing priorities for the organisation.

• Improve the understanding and expectations of what the internal audit team does.
• Increase strategic coverage of key developing topics such as cybersecurity.
• Move beyond assurance – making more of auditors' capacity to advise, consult and share insights.
• Develop data analytics skills and tools to streamline audit processes.

Resourcing: assessing and expanding team capacity and skills, balancing resources to meet the organisation's requirements, recruitment and continuing development.

Managing audit independence: avoiding extra responsibilities being delegated to the head of internal audit, who should also report into the board and chief executive directly, with a line of communication to the audit committee.

Audit committees: need to provide robust oversight and challenge, and include independent members; they should also assist with audit planning.

Understanding assurance: organisations should take a holistic view, embedding a culture of risk management.

External audit is going through a significant period of disruption, partially due to the impact of the pandemic, and affecting relationships with internal audit teams.

Download the full report