Internal auditors face a problem common to many others in the business world: bigger responsibilities–but not-so-big resources. This is especially true in small internal audit departments, where resources are sparse and growing responsibilities can stretch them dangerously thin. As a result of this, it’s important to discuss 10 big things, small audit shops do incorrectly, and how they can do things right using resources more efficiently.

Joel Kramer, managing director of the Internal Audit Division of the MIS Training Institute, speaks from experience on this topic as a former director of internal audit, “I have made every one of these mistakes,” he says. 

Mistake 1: Acting like a large department

“Many small departments try to act like big ones,” says Kramer. “They have too many manuals and forms, too many meetings, too much review, too much report writing. They do not realize they do not need all the bells and whistles. If you have a small department, do you really need a complicated time-reporting system that a department of 50 or 100 has? Probably not.”

The idea, of course, is to do what is necessary to add value to the organization using the resources that are available. Trying to make a small department look like a large one can add bureaucracy rather than value, according to Kramer. He recalls one small audit department that required three complete work paper reviews before issuing the audit report. “When people come from public accounting, they bring the public accounting mentality with them,” he says. “That was the case here.”

He says there are three main ways to do more with less: improve productivity of processes; be more risk-based to eliminate audit steps and audits that do not focus on key risks; and make full use of technologies.

Mistake 2: Hiring the wrong people

Kramer says many internal audit shops focus too much on people from the Big Four firms, hire people who are not self-starters, are too compliance oriented or are too much of a specialist.

“A small department cannot afford a bad hire,” Kramer says. “If you have a department of eight people and one is a loser, 12 percent of your department is not performing.” He suggests two strategies to reduce the chances of making a bad hire. One is to have potential auditees review final candidates. Those people can bring a fresh and valuable perspective to the hiring process. Another is to have the in-charges meet candidates to assess how they may work together.

“When you bring the people in-charge to the process, they feel really involved and have such different insights,” Kramer says. “When you are a director or manager, your natural inclination is to look at the potential growth in people. The in-charge will ask, ‘How will this person work with me in trenches?’ It is really important to maximize both.”

Mistake 3: Making audits too long

Long audits consume resources that could be used elsewhere. They often result from a lack of focus on key risks and end up at least partly unread, according to Kramer. “We ask, ‘How long should an audit be?’ I was brought up with asking, ‘What is management’s ability to absorb your findings?’ An audit should be only as long as management’s ability to absorb,” Kramer says. “Maybe you do not look at the entire revenue cycle during one audit. Maybe you accomplish this in three or four shorter audits. If you have shorter audits you have shorter reports, and management has reports that are easier to read, understand and absorb.”

Mistake 4: Lacking creativity in acquiring people

Small audit departments often have difficulty competing with large companies when it comes to hiring staff. One way around the problem is to use recovery firms that receive a portion of whatever funds are recovered as a result of audits. The organization makes some financial recovery without having to add staff. Audit shops can also borrow people within the organization. Another excellent source could be people who have recently left the organization in a buy-out or retirement. “Some people do not fully retire,” Kramer says. “They want to continue using their brain. There are wonderful people like this who could help.”

Sometimes certain specialty firms conduct audits at a lower cost than the in-house audit shop. “As an example, there are people who specialize in construction or derivative auditing who can be productive from the first day,” Kramer says.

Mistake 5: Failing to effectively market

Kramer says many small audit departments do a poor job of promoting the ways in which the department adds value to the organization. He suggests audit departments create an annual report of two to three pages to show what the department has brought to the company in the last year. He also suggests using an Intranet, brochures and newsletters to promote the department.

This promotion can be done in a variety of ways, including by providing useful suggestions for employees. “You could provide tips for traveling with a laptop computer, as an example,” Kramer says. “Or you could let them know, ‘Here is why we need to ask this,’ when you are looking at certain expenses.”

Marketing resources can help polish up reports, especially with the help of a professional graphics department. Attending the right meetings is important, too. “You want to be strategic with meetings, so they help you better position the department,” Kramer says. “Let people know we have people; here is how we use them; here are their tools; here is their knowledge and experience. You want to engage people in the organization to use the skills of the people in the audit department, and that is what meetings should do.”

Mistake 6: Failing to effectively network

Kramer reports that he is often surprised at how little people in small internal audit departments network with others either within or outside the organization. There are usually internal groups, as well as industry groups whose members could be helpful to internal auditors.

Kramer says when he was an internal audit director he developed an internal group that included the assistant controller and people from international marketing and the domestic manufacturing department. They would meet periodically to discuss what his department was doing and tell him what was happening in their areas.

“I wanted to ensure I was using resources effectively,” Kramer says. “It worked very well.” He also suggests becoming active in the local chapter of The Institute of Internal Auditors (IIA) and attending MIS/IIA conferences and symposia as well as other events where fellow professionals would be present. Professional training also can be used as a networking opportunity. “Pick training where you can network,” Kramer says.

Mistake 7: Reinventing the wheel

Too many small departments fail to use resources that are already in hand, including the attest firm and networking groups. They also err in assuming certain risks do not apply to small departments when in fact they do.

“People will share,” Kramer says. “Go to a class list of where you were in training and find someone there who could help you – be flexible. Last year’s risks are not necessarily this year’s risks.”

Mistake 8: Improperly using technology

Many small departments create too many forms and templates, flowchart too deeply, ban use of the Internet, and do not strategize retrieval packages, according to Kramer.

“There is good technology and bad technology,” he says. “I have heard of many instances where technology has slowed things. I have asked [ACL executives], ’What is the percentage of clients that use their software to its maximum capacity?’ They say no more than 20 percent. Many times people do not use IDEA [Data Analysis Software], ACL or other packages properly. People get too comfortable with templates, and that can stifle their creativity.”

Mistake 9: Improperly using senior management

Another common mistake is a failure to deliver information top management and audit committee members need. Sometimes reports are issued at the wrong time. Other times reports overwhelm readers with too much information or provide the wrong information.

“Audit committees need guidance from internal audit,” Kramer says. “If you want more resources, have your department report ready before the budget process, so they can see the value internal audit can provide.”

Information overload is another problem. “Many reports give too much information and too little knowledge,” Kramer says. “In the financial services industry now, people are going to be looking hard at this,” noting collapses of major financial institutions or government loans and bailouts despite the reporting requirements of the Sarbanes-Oxley Act (SOX) and other laws and regulations.