Internal audits play a significant role in protecting the interests of the people government agencies serve.
Given the difficulty of the task and the often last-minute schedules involved, it's no wonder that some parts of government budgets occasionally receive less attention than they deserve. In any given year, it might seem tempting to take shortcuts when setting the internal audit budget. However, this can be one of the biggest budget mistakes a government leader can make.
The bad news is that there is no simple formula for developing an internal audit budget. The optimal expenditure level for an organization can't be determined by adding an inflation factor to last year's budget, and basing the internal audit budget on amounts spent at similar organizations just doesn't work. But the good news is that you can determine whether or not the internal audit budget is appropriate for your organization if you keep the following key factors in mind.
In today's cash-strapped environment, many government offices are practicing zero-based budgeting. The first step in budgeting for internal auditing might be to consider whether or not you need an internal audit function at all.
Let's start by looking at the numbers. For larger government organizations, the answer is obvious: Internal auditing is a must-have. Take, for example, the federal Inspector General (IG) offices. In 2013, savings recommendations and investigative recoveries by IG offices totaled nearly $52 billion, according to the Council of the Inspectors General on Integrity and Efficiency. While that figure is impressive, it is likely just the tip of the iceberg.
Each year, thousands of indictments are issued and thousands of individuals and companies are suspended or debarred from government contracts because of wrongdoing unearthed by the IGs. We may never know how much more money may have been saved because of crimes that were prevented or because of systems that did not break down, but almost certainly these savings amount to additional billions of dollars.
Those numbers are based just on the federal IG functions, but the numbers from other government audit groups are equally impressive. Even the smallest agencies and local governments need internal audits, at the very least on a part-time basis, because every government organization faces risks they can't afford to ignore.
Consider the town of Dixon, Illinois, where a city finance officer was charged with the theft of $53.7 million—a staggering loss for a community of only 16,000 people. According to press reports, the losses occurred over several years, yet the problem was only discovered when the accused finance officer took a vacation.
A professionally staffed, adequately funded internal audit function might easily have detected the problem years earlier. Or better yet, it might have recommended improvements to internal controls that could have prevented it entirely.
The Illinois case shows that even at small government organizations, the decision not to "trust but verify" can be penny-wise but pound-foolish. And financial savings are not the only reason to ensure that audit and inspection budgets are appropriate. Effective internal audit functions add transparency and help maintain confidence among citizens that government operations are free of fraud, waste, and abuse.
Auditing in Austerity
It's no surprise that the economic turmoil has taken its toll on government audit jobs. Some organizations made the difficult decision to eliminate internal audit positions, planning to increase staff when the economy recovered. Unfortunately, this approach often backfires spectacularly because controls are most likely to fail when systems are undergoing change.
When it comes to internal auditing, cyclical budgeting based on external economic conditions is a dangerous proposition. As someone who spent the vast majority of my career in the public sector, I have consistently found that government auditors add the most value during two opposing scenarios:
- when government spending is expanding rapidly
- when government revenues and spending are under pressure to contract.
Budget cuts may sometimes be necessary, but audit committees and other oversight authorities should consider their options carefully before making a decision to cut. Internal audit services can be particularly important in today's economy for several reasons, including:
Audits ensure accuracy of financial reporting. As governments seek greater access to capital markets to fund burgeoning debt, the accuracy of financial reporting becomes particularly critical.
Audits provide assurance of efficiency and effectiveness. Efficiency and effectiveness have never been more critical to governments than today, so operational audits and performance audits are among the principal services offered by many government audit organizations.
Audits foster greater accountability by government officials. The vast majority of government officials are dedicated and effective public servants. However, accountability over the effective use of scarce resources is vital as taxpayers are asked to bolster government agencies.
Audits identify opportunities for cost reduction and containment. When governments are forced to make difficult choices on which services to continue as revenues falter, government auditors are uniquely positioned to offer insights and perspectives to perplexed decision makers.
Perhaps most important of all, internal audit services are key to fostering greater public trust when the effectiveness of governments is increasingly being questioned.
Benchmarking and Historical Budgeting
Across-the-board funding cuts are a hard reality in some government offices, but the best internal audit budgets are not designed by applying a percentage increase or decrease to last year's figures. If the budget was too low or too high last year, making the same mistake twice may only compound the problem—and that can be a recipe for disaster. The risks faced by government organizations often change significantly from year to year, and this year's budget should be based on this year's audit needs, not on previous funding levels.
Keep in mind that if the internal audit function was adequately resourced in the past, audit recommendations for improvements in internal controls may actually reduce the need for certain audits in next year's budget. Conversely, if the budget was too low in the past, there may be more need than ever for a robust audit schedule in the coming year.
It's also a mistake to set the internal audit budget simply by comparing your budget to those at similar organizations. Even when two government programs are almost identical in size, function, and location, they might have very different internal audit needs. One program might be very well controlled, with excellent policies, procedures, and oversight mechanisms in place, while another seemingly similar program might be at significant risk for fraud, waste, and abuse.
This doesn't mean we should completely ignore the previous year's budget when preparing internal audit plans. Benchmarks about other internal audit departments are also useful. But the best internal audit budgets are designed first and foremost to follow your organization's risks.
Intelligent Internal Audit
All government organizations can benefit from internal auditing, but that doesn't mean that unlimited spending on internal audit will ever make sense. In some ways, deciding on an investment in internal auditing is like deciding on an insurance policy.
The coverage must be adequate to protect the organization against the risks it can't afford to take. Therefore, there is only one effective way to determine whether or not the internal audit budget is adequate—perform an organization-wide risk assessment.
During an organization-wide risk assessment, internal auditors meet with management to consider the specific risks in each process, division, and department throughout the organization. Based on evaluations of those risks, a prioritized list of potential audits can be developed. For each area, brief descriptions should explain why the area or process is considered high, medium, or low risk.
Because potential audit engagements are ranked in order by risk, it soon becomes apparent what might need to be cut if the audit budget is tight, or conversely, what additional audits can be performed if additional budget is available. The secret is to know where to draw the line—to determine how much internal auditing is justified at your organization based on your organization's specific risks.
Key to any discussion about internal audit budgeting is understanding that there is auditing, and then there is internal auditing. Financial statement audits are designed primarily to do one thing: form an opinion regarding whether or not the financial statements are materially correct. That's a very important task, but the scope of government internal auditing is much wider—encompassing efficiency, effectiveness, health, safety, legal compliance, and a host of other issues.
It's All About Risks
Obviously, there is more to the internal audit budgeting process than simply performing an organization-wide risk assessment and agreeing on a schedule of internal audit engagements. The chief audit executive must ensure that internal audit resources will be appropriate, sufficient, and effectively deployed to achieve the approved plan with the breadth, depth, and timeliness expected by senior management and the board.
There must be allowances for training and administration, and sufficient time should be available in the plan for emergency or unanticipated audits. But if annual plans and budgets are a good fit for your organization's perceived risk levels, chances are good that the internal audit budget will be appropriate for your organization.
As a former government auditor, I strongly believe that government internal auditors play an invaluable role in protecting our interests. Unlimited spending on internal audit can never be justified, but there is great potential for public harm when internal audit budgets are cut too far. This is a risk we can't afford to take.