Effective Controls Don't Guarantee Efficient Processes: Why Internal Audit Must Address the Gap
This article argues that internal audit often overlooks process efficiency, focusing solely on control effectiveness. It highlights that while control systems may be deemed effective, the underlying processes can still be highly inefficient and costly. The author proposes that internal audit must expand its scope to include the efficiency of control systems, offering a 'third way' to bridge the gap between control quality and operational results.
The Paradox of Effective Controls and Inefficient Processes
Internal audit frequently concludes that a process's control system is effective, with identified risks, key controls, and proper design and operation. However, this effectiveness often coexists with highly inefficient processes that consume excessive resources. The article posits that internal audit's silence on efficiency stems from several factors, including methodological limitations, the nature of proof, institutional positioning, professional incentives, and a normative separation between standards. This oversight means that internal audit functions, despite conforming to standards, may be missing significant areas of value destruction within their organizations.
Challenging the Scope: What Frameworks Actually Allow
The author asserts that the notion of efficiency falling outside internal audit's scope is a misconception. Frameworks like COSO explicitly include the effectiveness and efficiency of operations as primary objectives. The 2017 IPPF Standard 2130 even mandated evaluating the efficiency of controls. While the 2024 Global Internal Audit Standards emphasize value creation and insight, the core message remains: internal audit is not normatively constrained from assessing efficiency. The article highlights that internal audit's current practice of focusing on operational audits without concluding on what these operations produce is a choice, not a requirement, and represents a significant missed opportunity.
Overcoming Methodological and Institutional Hurdles
Several barriers prevent internal audit from addressing efficiency. Methodologically, 'over-control' is not typically recognized as a risk in audit universes, and current testing methods are designed for binary control attributes, not continuous efficiency measures. Institutionally, concluding on efficiency often means critiquing process design, which can be uncomfortable and perceived as challenging management decisions. Furthermore, the asymmetry of professional risk incentivizes adding controls over removing them, leading to a 'control ratchet' where control systems only grow. The article suggests that internal audit can overcome these by incorporating system cost into audit universes, asking about the expected annual loss avoided versus control cost, and systematically performing gap analyses between control quality and target results.
A 'Third Way': Bridging the Gap Between System Quality and Results
The article proposes a practical 'third way' for internal audit to address efficiency without overstepping its role. After completing control testing, auditors possess detailed knowledge of processes and systems. By comparing the documented quality of the control system with the organization's own target values for process results, internal audit can identify significant gaps. This gap analysis preserves independence, as it uses management's own criteria, and has a low marginal cost since much of the fieldwork is already done. This approach provides valuable insights to operational management, addressing a demand often unmet by traditional control conformity reports. However, it's crucial to avoid concluding on efficiency where absolute obligations exist, redundancy is critical (e.g., industrial safety), or loss distributions are fat-tailed, as these situations have pre-arbitrated risk-cost proportions.
The Imperative for Change and Board Mandate
The author argues that internal audit's abstention from efficiency is no longer tenable, especially in areas of internal monopoly where market forces don't provide discipline. The 2024 Standards' emphasis on value creation and insight further supports this shift. The article concludes by advocating for boards and audit committees to explicitly include the efficiency of control systems in internal audit's mandate. This would transform the debate from a methodological discussion among professionals into a governance decision, ensuring that internal audit contributes to addressing value destruction in areas currently overlooked.
Read more
