Internal audit: A strategic governance imperative for board directors

Let me share a true story of a dilemma faced by a Board of Directors of a fast-growing dealership in Cebu not too long ago. Typical of a well-run business that has grown so fast, its exposure to risk has grown exponentially as well. Variances of forecasts were alarmingly volatile, having insufficient attention to the necessity of a Risk Management Framework for strategic governance, risk avoidance, and potential impacts of the market fluctuations, technology changes, human capital, economic ups and downs… and so on. Thankfully, the creation of a more structured approach to addressing these inevitables were put in place. One of the major outputs was the creation of an Internal Audit Department, which represents the gist of this article.

So, what role does the Internal Audit (IA) Department play?  Surely it is understood to be a compliance mechanism, one wherein internal controls are strengthened, however, the IA has evolved to become much more than this. The IA these days provides a strategic function that provides valuable insight and foresight into the corporation’s risk landscape aside from operational effectiveness — a coach to the Board and the CEO as well. 

To perform this role effectively, the Internal Audit Department must operate with full independence and professionalism. It reports functionally to the Board — through the Audit and Risk Committee — and administratively to the CEO, allowing it to escalate issues without interference. This reporting line enables auditors to carry out their responsibilities objectively and to maintain freedom from undue influence in the performance of their duties.

A sound Internal Audit Charter provides a formal mandate, granting the department unrestricted access to records, personnel, and resources necessary to carry out its work. It also empowers the department to determine audit scope, allocate resources, engage external expertise, and communicate results directly to the highest levels of governance.

A cornerstone of effectiveness is the commitment to The Institute of Internal Auditors’ Global Internal Audit Standards, including a Quality Assurance and Improvement Program (QAIP). This ensures that the internal audit function operates in alignment with global best practices and that its performance, ethics, and quality are continuously assessed and enhanced. Internal auditors must embody principles of integrity, objectivity, competency, confidentiality, and due professional care — while avoiding any roles that might impair their independence.

At the center of this function is the Chief Audit Executive (CAE). The CAE leads the Internal Audit Department, ensuring the team possesses the right skills, methodologies, and resources to meet its mandate. The CAE is responsible for developing an annual risk-based audit plan, reporting performance and risk insights to the Board, and adjusting the plan in response to evolving risks. The CAE must also communicate any limitations in scope or independence, and ensure that all findings and recommendations are clearly reported and followed up on.

The scope of Internal Audit’s services is enterprise-wide, covering all units, assets, and operations. These services include both assurance — evaluating the effectiveness of governance, risk, and control systems — and advisory engagements that may identify improvement opportunities. Internal Audit may also provide operational support services when requested by management, as long as it does not assume operational responsibility or audit its own work to preserve objectivity.

Audit engagements often assess whether: risks are well managed; operations align with objectives; laws, regulations, and policies are followed; data integrity is maintained; and resources are used efficiently. In doing so, Internal Audit acts as a proactive guardian of value, offering clarity in uncertainty and helping management navigate complex operational and regulatory environments.

In summary, the Internal Audit Department is a critical partner in achieving sustainable organizational resilience, integrity and performance. Its independence, professionalism, and strategic insight enable it to fulfill a vital oversight role while driving continuous improvement across the enterprise. Through an IA charter and its practical application, the IA supports the Board and Management in making informed, ethical, and forward-looking decisions for the organization’s sustained success. A sound IA approach is essential for sustainable success. Your shareholders deserve and demand it!