Getting the best out of internal audit: the role of the leader

Guarantee independence

This is the primary lever, and the most structuring one. To be credible, internal audit must be able to examine and say everything, without fear. This presupposes a reporting line to the board or audit committee, direct access to its members, and an absence of conflicts of interest — an internal audit head cannot objectively audit an activity that they also manage. The board is the guarantor of this independence: it is up to the board to protect it.

Equip the function to match the level of risk

An under-resourced internal audit function cannot cover the risks that matter. The issue of resources — headcount, budget, skills — therefore deserves regular review by the board. Today's risks (cybersecurity, data, AI) demand expertise that not all teams possess in-house: turning to external specialists, for support or co-contracting, is a common and legitimate response.

The right questions the board should ask

A board doesn't need to be an audit expert to evaluate its value. A few simple questions are often enough to gauge the strength of the function:

• Does the audit plan adequately cover our most significant risks, and is it updated when those risks change?
• Have past recommendations been acted upon, or remain a dead letter?
• Does internal audit give us a clear, overall opinion on the effectiveness of our risk management system?
• Does he have the necessary means and skills? If not, what is missing?
• Has its quality been assessed by an independent third party?

Measure quality

Like any function, internal audit must report on its own performance. Professional standards provide for a periodic quality assessment by an independent third party — a sound practice that reassures the board as to the reliability of the assurance it receives. This is not just another compliance review: it is the guarantee that the tool upon which the board relies is actually working.