Why does auditing exist? It is important to understand the function the audit department plays in any organization. It is also a classic question new auditors ask when getting started in the profession.
As a manager, you must be able to explain why auditing exists and the function it plays within the firm.
From the IIA Standards, “Internal audit strengthens the organization’s ability to create, protect, and sustain value by providing the board and management with independent, risk-based, and objective assurance”. A succinct explanation, but it is helpful to be able to explain risk across an organization and its impact on the audit function.
This playbook provides a holistic view of risk within an organization. To start, risk occurs when an organization takes on any activities to generate revenue or value. These risk-generating activities could be sales, marketing, or even compliance. To manage risk, a three-line defense model is used. The first line is responsible for risk-generating activities. An example of this would be a wealth management group selling financial products. The first line generates risk through the generation of a financial product. To control the risk, appropriate controls (policies and procedures) are established to mitigate the risk. The second line provides the first line with additional risk mitigation programs. This could include risk and control self-assessment, business continuity plans, and privacy policies. The second line is responsible for risk management and helping the first line implement firm-wide risk management practices. Finally, audit, which is the third line, is responsible for reviewing the controls to ensure that there is no unmitigated risk.
Audits as the third line of defense promote accountability, transparency, fraud detection, risk management, and help support decision making across the firm.
Auditors play a key role in pulling back the curtains for management and creating visibility into first- and second-line programs. Audits provide opportunities for process improvements, control enhancements, or identification of business opportunities.
As audit leaders, It is our responsibility to train auditors to proactively identify risk. Within this book you will learn how to establish effective teams.
The rest of this book will highlight how leaders can use a common playbook to drive highly desired qualities in our teams:
- Proactivity
- High Performance
- Positivity