Richard Chambers recently published an excellent article on the rotational audit staffing model. I wanted to add my perspective as the CAE of a small audit department, active in an inherently complex sector, development aid.
The reality of a small audit department
The size of the audit department is most often a function of the size of the organization it operates in. Yes, I am making abstractions here, there are other significant factors of influence, but look at any GAIN analysis and you will find a significant correlation between size of the organization and size of its audit department. The complexity of the sector and its activities is not usually a factor, although it should be.
As the most important influence is organizational size, organizational complexity is often just something the audit needs to come to terms with. In reality it's unlikely that a small audit department has all the competencies within its confines to adequately audit each aspect of the organizational complexity.
Of course, not auditing this subject area is not an option, quite often because these more complex areas of operations are the more if not the most risk prone. This is an important aspect in our operations. The more complex the project structures, the more exposed they are to risks. So, how do we go about this?
The rotational guest auditor
We actually turned the rotational audit staffing model which Richard talks about around about 180°. Rather than having people rotating in and out of internal audit as part of their management (fast)track, we actually have a small permanent audit team, which is there for the long(er) term, with operational collaborators rotating in and out on an ad hoc basis as a function of individual audit projects. For example, we will use a person with a deep understanding of our different reporting structures and requirements if we need to look at reporting as an aspect of an operational assessment of on of our regional sectoral support structures.
Of course, this approach is not without its challenges. Confidentiality of the audit findings and independence of the guest auditor are aspects which we approach with due and necessary care. Failure to appropriately address these concerns will lead to the loss of confidence in the adequacy of the internal audit process and hence of the validity of the internal audit department's approach. of course we want to avoid that.
What the guest auditor brings to the table
The guest auditor operates as a subject matter expert. He or she has experience in a field adjacent or related to the field being audited. This eliminates the need for a significant investment in audit techniques training, as the guest auditor is surrounded by an audit team well versed in these aspects of the audit process. He assists in developing the audit approach, explaining us what we need to look at and what we can expect to find, he assesses and interprets what we see coming out of the audit tests (as compared to what we expected to find there) and he adds an additional dimension of interpretation to the results which the small audit department not necessarily would be able to offer as quickly or at all.
Even when working in a field adjacent to his or her own, the guest auditor's independence is very closely monitored by critical auditors, in turn supervised by the CAE.
Additional value for internal audit
Our currently limited experience of this new way of operating has already shown that not only does the guest auditor add value to the internal audit work, but the appreciation for the daily internal audit activities increases significantly after a spell as a guest auditor. The guest auditor is often surprised at the level of intensity and the work rhythm of internal audit professionals, which increases the appreciation for our work.
We are actually looking forward to auditing some of our guest auditors. We expect them to both be more aware of our challenges and to be better prepared for the audit itself.
All in all, this approach which was conceptually developed by my predecessor and which we have now implemented seems to work well for our small internal audit department. It actively adds value both to our audits and audit reports and to the guest auditor.