Chapter 8
Setting an Audit Strategy
Introduction
The previous chapters of The Essential Guide have reflected the major challenges that face internal auditors as they seek to add value to their employers. The ‘value-add’ proposition is a main driver for the audit services and choices need to be made in terms of what is delivered by internal audit and how this task is achieved. The IIA's Performance Standards 2000 (Managing the Internal Audit Activity) reinforces this concept by stating that: ‘The CAE must effectively manage the internal audit activity to ensure it adds value to the organisation.’ The most important factor in this equation is the audit strategy that is set to achieve added value. Added value is described by the IIA in the following way:
Value is provided by improving opportunities to achieve organizational objectives, identifying operational improvement, and/or reducing risk exposure through both assurance and consulting services.
The CAE will succeed or fail on the basis of the adopted audit strategy. Note that all references to IIA definitions, code of ethics, IIA attribute and performance standards, practice advisories and practice guides relate to the International Professional Practices Framework (IPPF) prepared by the Institute of Internal Auditors in 2009. With this in mind we cover the following aspects of getting to a suitable audit strategy in this chapter:
8.1 Risk-Based Strategic Planning
8.2 Resourcing the Strategy
8.3 Managing Performance
8.4 The ...
