Articles Logan Wamsley Jan 18, 2024
Internal audit functions must comply with The IIA’s new Global Internal Audit Standards by January 2025. Budget-strapped public sector audit functions will need to convince authorities to provide the funds they need for full conformance.
This month after years of work, The IIA published the new Global Internal Audit Standards. Designed for a new age of risk, the Standards include a variety of changes that clarify internal audit’s ever-expanding role in organizations. Among these changes are the inclusion of recommended practices and evidence of conformance after each standard, with particular emphasis on addressing the nuances related to certain internal audit function sectors, roles, and types. These include advisory services, small audit functions, and the public sector.
Addressing the public sector in the Standards was desperately needed, according to feedback from practitioners. Despite its inclusion, there are concerns about how public sector entities can implement the new Standards. With the January 2025 deadline for full conformance only 12 months away, these concerns risk being heightened if they aren’t addressed.
One concern looming over public sector audit functions is whether they currently have the resources to implement the Standards by the deadline. According to the 2023 North American Pulse of Internal Audit, the U.S. public sector had the lowest percentage of internal audit functions with budget growth (28%) and the lowest percentage of CAEs saying they had a sufficient budget (38%) compared to other sectors.
“A lot of times, public sector auditors don’t have specific control over their financial resources, which affects their ability to decide how they can spend their limited resources,” says Harriet Richardson, former inspector general of San Francisco Bay Area Rapid Transit and member of The IIA’s International Internal Auditing Standards Board. “They have to spend within the budget they’re given, and they don’t necessarily have the ability to ask for more money. In some cases, internal audit is within another agency that sets the budget for the entire organization, so internal audit can only rely on what the agency decides to provide.”
This situation isn’t limited to the U.S. For example, public sector internal audit functions in the UK are experiencing similar resource challenges, especially in local government authorities.
“Internal audit is going through a bad patch at the moment,” says IIA Certification Board Member and Standards advisor Liz Sandwith, managing partner of Sandwith Internal Audit Services in Leeds, UK. “One local authority just told me that its internal audit function budget had been cut by 79%. Local authorities are struggling, and they’re going to be looking at where they can make cuts without potentially impacting the services they deliver to the community.”
To solve the resource dilemma, public sector audit functions need the authorities that control their budgets to buy into internal audit’s value. However, that appeal may be difficult considering the makeup of the public sector leaders in charge of funding.
“Internal auditors in local authorities are going to struggle with this, because a lot of their audit committee members are elected officials,” Sandwith says. “The majority of them probably don’t want to be on an audit committee; they want to be on the planning committee or something they perceive as way more exciting. They think the audit committee is historic and backward with very high turnover.”
Sandwith says the challenge will be for internal audit to encourage elected officials “to see the audit committee as the most exciting, sexiest committee in any organization.”
Obtaining stakeholder buy-in beyond the audit committee might be equally challenging. It will take commitment and strong lines of communication — especially from the CAE — over an extended period. “Things move slow in government,” Richardson says.
Effective communication is a theme built into the Standards and must extend to executive management, elected bodies, the board, and union leadership, Richardson adds. “In the public sector, all this will need a strong CAE to maintain these lines to help them understand what the changes will be, how it’s going to affect how auditors do their work, and how this affects how audit will interact with them,” she says. “To make the January 2025 deadline, this has to happen now.”
It’s a difficult conversation that requires persistence and tenacity, Sandwith says. CAEs will need to provide the audit committee chair all the information he or she needs to understand the Standards, how they fit together, and what internal audit will need. “It’s not just about ticking a box,” she says. “It’s about showing how they can use internal audit within the organization so they can provide a credible, professional service. Without assurance, personal reputation can be at stake.”
The task might be tall, but implementing the new Standards could enhance public sector internal audit functions’ stature substantially. “This is going to be a challenge through 2024,” Sandwith says, “but it is a real opportunity for internal audit to raise the bar.”
At the end of the initial journey, the quality of work provided by internal audit functions in conformance with the new Standards should speak for itself. “In the new Standards, there is more guidance on how to actually do the work,” Richardson says. “That, following conformance, will make audit work far clearer, which will bring with it more credibility.”