Implementing an internal audit department can be daunting, especially for businesses without prior experience.
“When the ideas are coming, I don’t stop until the ideas stop because that train doesn’t come along all the time.” – Dr. Dre
Annual revenue in $ millions (2021)
Internal Team Member
TL;DR
I was tasked with setting up an internal audit function from scratch for a company that recently went public on the NYSE. When I joined in December 2021, the company had no audit or risk management functions. To ensure the success of our most recent investors, I was determined to create and launch a successful internal audit department. I outlined a comprehensive ten-step approach to crafting an effective one.
Introduction
Section 303A.07 (c) of the NYSE requires a listed company to have an internal audit function to provide management and the audit committee with ongoing assessments of the listed company’s risk management processes and internal control system. Companies implement an internal audit department to increase efficiency and accuracy in their operations, identify areas of potential risk and fraud, evaluate the effectiveness of current systems and processes, and ensure compliance with regulatory requirements.
Scenario
BigBear.ai is an innovative technology firm focused on implementing cutting-edge artificial intelligence (AI). In 2021, BigBear.ai (BBAI) decided to go public on the NYSE and become a publicly traded company. This decision was made to further solidify its position as a leader in AI technology. With no existing audit or risk management functions, BBAI knew it had to act quickly and efficiently to test everything up for its upcoming IPO.
In December 2021, I was welcomed to BBAI with open arms as the founder of its nascent audit department. Building this division from the ground up proved no easy task for a company that had never hosted such risk or compliance functions before!
10 Steps to Build an Internal Audit Department
Here are the 10 steps I took to build BBAI’s internal audit department:
Step 1: Establish authority
As Chief Audit Executive, it was paramount for me to have the authority to lead BBAI’s internal audit program. I secured approval and backing from the Audit Committee and executive leadership to access the necessary information for my responsibilities.
I established the Internal Audit Charter that explicitly explained my duties while simultaneously allowing the committee to demonstrate their appreciation of our independence.
Step 2: Meet the leadership team
I met with each of the executive leadership team members to introduce myself and offer education on what Internal Audit does. I also capitalized on this opportunity by inquiring about BBAI’s culture and if any urgent issues needed examining.
Grasping each individual’s temperament, forming meaningful relationships with key stakeholders, and establishing trustworthy bonds were integral to building the internal audit’s reputation.
Step 3: Meet the external auditors
If anyone knows what a new internal auditor is up against, it’s the external auditors. Once the external auditors affirmed that I wasn’t mistaken in joining BBAI (my first inquiry to them), we delved into the typical topics: present findings, gaps, and vulnerabilities. The external auditors’ input was invaluable, especially for Step 3.
Step 4: Risk assessment
I didn’t jump straight into policies and procedures. Nor did I immediately begin auditing things. I needed to get my bearings down by quickly creating the first risk assessment.
Identify fires – what are the top 5 risks facing BBAI now? What’s the urgency?
Danger ahead – What approaching dates require our immediate attention to ensure preparedness?
Resourcing – Is the existing organizational structure capable of addressing our fires and danger?
By answering these questions, I was able to plot a course that allowed me to build an effective internal audit program.
Step 5: Establishing the organizational structure
The audit department needs to be organized to function effectively. This includes creating roles for individual members, job descriptions, and developing a well-defined organizational structure that clearly outlines how processes will unfold.
However, I determined that the best path forward was for me to take on this project solo. With my past consulting expertise and awareness of potential risks, I felt confident handling it without assistance over the coming months.
SOX Testing and Program Optimization: A Case Study
A new company approached us to manage its Sarbanes-Oxley (SOX) program. We implemented a risk-based approach that established simple, repeatable, documented methodologies.
Areas Where CAEs Would Spend a Budget Increase
can only pick one
- Staff Increase 48%
- Technology 25%
- Compensation 16%
- Professional Development 8%
- Other 3%
Most Helpful Enablers to Increase Internal Audit Maturity
- Technology tools 56%
- Hiring more competent staff 52%
- Support from executive leadership for maturity efforts 38%
- Increased budget for staffing 32%
- Better Professional Development Options 30%
- Increased budget in general 25%
Source: 2022 North American Pulse of Internal Audit
Step 6: Develop policies and procedures
As an internal auditor, I sincerely appreciate policies and procedures. My goal was to create comprehensive guidelines to ensure proper oversight of the department’s auditing activities and adherence to established standards. If I attempted to review department policies without having any of my own available, it would be incredibly embarrassing.
Step 7: Building process documentation
To ensure a comprehensive understanding of BBAI’s critical operations, I asked process owners and 2nd line functions whether they had any existing risk assessments or control inventory documents. Sadly, only some had the necessary resources available. As a result, I spent two months creating process flowcharts. This helped me:
- identify pain points and areas ripe for future optimization efforts
- identifying control gaps
I provided management with a comprehensive gap assessment report, allowing them to begin addressing any issues before being audited.
Step 8: Research audit software
Investing in reliable software is worth every penny! Spending additional hours performing internal audits through Excel may seem cheaper initially, but it is more expensive in the long run. After assessing the various vendors, I made my decision and chose Workiva.
Step 9: Creating the audit plan
I developed an audit plan tailored to BBAI based on the risk assessment and identified gaps. I was still on my own, not having hired any full-time internal auditors. Limited resources meant I had to be smart with my spending. After crunching numbers and evaluating the cost of hiring outside auditors versus internal ones, I presented management with my suggested plan to meet their needs without breaking the bank.
The Audit Committee approved the budget and audit plan.
Step 10: Execute!
With pre-game preparation concluded, it was time to implement the audit plan. I had all the required tools to start auditing like any other established audit department.
Conclusion
Building an internal audit department from scratch is a long and complex process. It can be done, however, with the right plan in place. I successfully created a functioning audit department that met the needs of BBAI despite our limited resources. The experience taught me many valuable lessons on how to use creativity and careful planning to get things done even when resources are tight. My advice for anyone taking on such a project: do your homework, develop a comprehensive plan, and make sure you’re making wise investments. Following this approach will ensure success!
Are you building an internal audit department?
I’d love to hear whether your experience was similar to mine. Let me know in the comments below.
0 Comments