Many best practices involve the conversion of the internal audit staff from reviewers of controls to advisors who impart knowledge about business improvements. However, this shift in emphasis means that the traditional task of reviewing controls will be done much less frequently.
An alternative is to shift some of the controls review burden to the business units themselves. Though this may seem like a case of having the fox guard the henhouse, the internal audit department can still monitor business unit results at a high level to see if general operational and financial performance measures indicate a problem, and then send in a team to conduct a thorough review. In most cases, there are no serious control breakdowns, so audit tasks with lower risk profiles can be safely assigned to business unit employees. By doing so, there is more likelihood of audits being conducted on a regular basis, and by people who are thoroughly familiar at a detailed level with business processes, which may result in better audit work.
To make this shift of responsibilities a success, the internal audit department should construct a series of self-audit guides for the business units. These guides should briefly explain a control objective, note how specific controls are used within a process to meet that objective, and then lay out detailed auditing steps for employees to follow. The level of detail in these guides should be sufficient for employees without audit training to understand what they are doing and why it is important. The guides should be short, concise, and targeted only at specific audit objectives. Also, they must avoid any accounting language that might be confusing to a non-accountant. When creating a self-audit guide, be sure to test it on a non-accountant to see where points of confusion arise, so that any problems can be eliminated before the guide is released for general use. Though a great deal of work is required to create an effective self-audit guide, the effort expended will be more than offset by the eventual reduction in control review work by the audit staff.