Obligation or improvement: what good are internal audits?

But are these preconceptions true? What exactly is such an internal audit, and why would a company want to conduct an internal audit?

What are internal audits?

Before we delve further into conducting internal audits, it's good to take a small step back and create an overview: what exactly are internal audits?

Internal audits take place within your company. They can be conducted by your own employees or possibly by a hired consultant. An internal audit is basically an investigation within an organization into the proper and reliable functioning of the organization. A properly conducted internal audit identifies problems and risks, which can lead to improvements in business processes. Thus, an internal audit is not focused on individuals, but rather on the processes within an organization. Three types can be distinguished within internal audits:

• A compliance audit: does our organization comply with the applicable standards and rules?
• An efficiency audit: how can we set up and improve the organization more efficiently?
• An effectiveness audit: are our processes achieving the organization's goals?

These three forms of internal audits are closely aligned with Simon Sinek's Golden Circle: what you do, how you do it, and why you do it.

The compliance audit focuses primarily on what you do as an organization, the efficiency audit addresses how you do it, and the effectiveness audit focuses on why you do it.

In practice, it is common for the first two forms to be the focus: the what and how of an organization. Often missing is the why question: why do we have this process? How does this process contribute to the goals we want to achieve as an organization? This very question is perhaps the most important, and its absence keeps real success from being achieved for the organization.

How do you conduct a successful internal audit?

A successful internal audit starts with having a clear picture of the organization. Are the current processes well mapped out, are the risks clear, and are the relevant laws and regulations clear?

Only after this is clear can we look at what is going well and what can be improved. By the way, the improvement process does not stop after the audit. In fact, it only starts after the audit. Once the audit report is on your desk, you must ensure that the findings and areas for improvement from the report are discussed and communicated with the rest of the organization. Also ensure involvement and ownership of the improvement actions, so that the internal audit actually results in improvement.