Your strategy should shape your internal audit plan.
Connect strategic ambition. Understand risk. Focus assurance where it matters.
Discuss your audit plan ↗An organisation’s strategy sets its direction. Its internal audit plan should provide assurance over the risks that could prevent it from getting there.
At Masegare & Associates Incorporated (MAI), we help boards, audit committees and executives connect strategic objectives, organisational risks and internal audit priorities—providing clearer insight into the governance, risk management and controls supporting organisational success.
From strategic intent to meaningful assurance
Kaplan and Norton’s Balanced Scorecard connects strategy with objectives and measures across financial, customer, internal process, and learning and growth perspectives. Their work emphasises that objectives and measures should derive from strategy (Kaplan & Norton, 1996). Their strategy-mapping approach explains the connections between these perspectives and how an organisation intends to create value (Kaplan & Norton, 2000).
MAI applies this strategic lens to internal audit planning: understand the intended outcomes, identify risks to delivery, and determine where independent assurance is needed most. This is our application of their strategic management concepts to audit planning.
Connect the strategic management process to audit priorities
-
01
Mandate and objectives
Understand what the organisation must achieve and the outcomes stakeholders expect.
-
02
Strategic choices and resources
Identify the processes, people, funding, technology and partnerships on which delivery depends.
-
03
Risks and responses
Assess threats to objectives, risk appetite, management responses and confidence in controls.
-
04
Implementation and performance
Examine delivery arrangements, progress against targets and the reliability of reported results.
-
05
Assurance priorities
Select engagements that address significant exposures and coverage gaps at the right time.
Look across the drivers of performance
Financial sustainability and stewardship
Are budgets, revenue management, expenditure controls and investment decisions supporting strategic priorities?
Customers and stakeholders
Are operational arrangements delivering the quality, responsiveness and outcomes stakeholders expect?
Internal processes
Are procurement, project management, operations and information systems enabling effective delivery?
People and capability
Does the organisation have the skills, leadership, culture and technology required to execute its strategy?
For public institutions, this assessment places the mandate, service delivery and public value at the centre.
Translate priorities into practical audit coverage
Management’s risk register is an important input. MAI also considers strategic plans, performance results, stakeholder concerns, previous findings and organisational change. Weaknesses in strategic planning or risk management may themselves warrant independent review.
How MAI supports your organisation
Management owns strategy, risks and controls. Internal audit provides independent assurance and advice on their effectiveness.
- ↗ Strategy-to-risk mapping and audit universe development.
- ↗ Independent risk assessment and engagement prioritisation.
- ↗ Annual and rolling risk-based internal audit plans.
- ↗ Combined assurance mapping and coverage reviews.
- ↗ Audit resource, skills and delivery planning.
- ↗ Reviews of strategic planning, risk management and performance monitoring.
Give your board a clearer view of what matters
Can your board see how its internal audit plan addresses the risks to its most important objectives? Contact MAI to develop or review a plan that connects strategy, risk and assurance.
Connect with MAI ↗ Call 011 420 0445References & strategic foundations
Kaplan, R.S. & Norton, D.P. (1996). Linking the Balanced Scorecard to Strategy. California Management Review, 39(1), 53–79.
Kaplan, R.S. & Norton, D.P. (2000). Having Trouble with Your Strategy? Then Map It. Harvard Business Review, September–October.