Real Time Assurance: Part 2 - From Insight to Action and Embedding Value.

In Part 1 of this series, we introduced Real Time Assurance as a focused, high-paced internal audit activity designed to provide rapid insights into specific controls or processes within approximately two weeks. We explored its definition, the scenarios where it's most valuable, and the critical importance of setting a sharp, narrow scope for success.

Now, in Part 2, we turn our attention to what happens once the fieldwork is complete: effectively communicating the findings, ensuring timely action is taken, and crucially, how these agile reviews can inform and strengthen your overall annual internal audit planning process.

Reporting for Impact: Delivering Timely Insights: The speed at which a Real Time Assurance review is conducted must be mirrored in its reporting. Delaying the communication of findings undermines the very purpose of a "real time" activity.

• Timeliness is King: Reports should be issued as soon as possible after the review is completed, ideally within a few days. This ensures the insights are still highly relevant and actionable for management operating in a fast-changing environment.

• Know Your Audience: Tailor the report's level of detail and focus to the recipients. For management responsible for the reviewed area, provide sufficient detail on the finding and its direct implications. For an Audit Committee, a more executive summary highlighting the key issue, its potential impact, and the agreed actions will likely be more appropriate.

• Content: Clear, Concise, and Action-Oriented: The report should be brief and to the point. Focus on:

  • A clear statement of the focused scope and objectives.

  • The specific finding(s) identified, supported by concise evidence.

  • The potential risk or impact associated with the finding.

  • Pragmatic and agreed-upon recommendations or actions.

  • Avoid lengthy descriptions of background or process that aren't directly relevant to the findings.

• Efficient Formats: Consider using efficient reporting formats such as a concise memo, a focused slide deck for a presentation, or even a structured email for very minor findings. The goal is rapid communication, not a lengthy formal report.

Action Management: Ensuring Findings Lead to Improvement: Identifying issues quickly through Real Time Assurance is valuable, but the true value is realised when timely and effective action is taken to address them.

• Clear Ownership is Non-Negotiable: Every action arising from a Real Time Assurance finding must have a clearly assigned owner within the business who is responsible for its implementation.

• Tight Deadlines Reflect the Pace: Just as the review is rapid, the deadlines for completing actions should reflect this urgency. Work with action owners to set realistic but aggressive timelines for remediation.

• Streamlined Follow-Up: Implement a lean process for following up on action completion. This might involve simple check-ins with action owners or requesting targeted evidence of completion rather than a lengthy re-validation audit.

• Internal Audit's Role: Internal Audit's role is to monitor the progress of actions and validate their completion, not to become responsible for implementing the actions themselves. Maintain independence while facilitating timely remediation.

Embedding Value: Informing the Annual Audit Plan: Real Time Assurance activities, while focused and short-term, generate valuable intelligence that should not be isolated. These insights are crucial inputs into the annual internal audit planning process, enhancing its responsiveness and risk coverage.

• Highlighting Emerging Risks and Deeper Dives: Findings from Real Time Assurance can act as early warning indicators for emerging risks or highlight areas within a process or control that warrant a more extensive review in a future full audit.

• Informing the Audit Universe and Risk Assessment: The experience and findings from Real Time reviews provide valuable, current information that can be used to update the audit universe and refine the risk assessment that underpins the annual plan. Did a Real Time review uncover a systemic issue? This should influence the risk rating of related areas in the universe.

• Expanding Successful Reviews: If a Real Time Assurance activity on a specific control or process proves particularly insightful and highlights areas for improvement, this topic could be a strong candidate for a broader, more in-depth audit in the subsequent year's plan.

• Formalising Real Time Assurance in the Plan: Consider explicitly including a component for agile or real-time reviews within your annual audit plan. This demonstrates to the Audit Committee and management that internal audit has the flexibility to respond to in-year risks and changes. Allocate a small portion of audit time for these rapid reviews.

Integrating Insights into the Audit Universe and Risk Assessment: To ensure the intelligence from Real Time Assurance truly informs your planning, establish practical steps to integrate it:

• Regular Updates: Implement a process for regularly (e.g., quarterly) feeding the outcomes of completed Real Time Assurance reviews into the audit universe and the underlying risk assessment.

• Discussion in Planning Meetings: Dedicate time in audit planning meetings to discuss the insights gained from recent Real Time activities and their implications for the annual plan.

• Documentation: Ensure findings and observations from Real Time reviews are appropriately documented and linked to relevant risks and auditable entities in your internal audit management tools.

Conclusion: Agile Assurance for a Resilient Organisation: Real Time Assurance is more than just a faster audit; it's a shift towards a more agile and responsive internal audit function. By focusing on timely reporting and robust action management, internal audit can ensure that the insights gained from these rapid reviews translate into tangible improvements in the control environment.

Furthermore, by intentionally embedding the outcomes of Real Time Assurance into the annual planning cycle, internal audit can ensure its work remains highly relevant, risk-focused, and aligned with the dynamic needs of the organisation. Embracing agile assurance methodologies like Real Time Assurance is key to providing valuable, timely assurance in today's fast-paced business world, ultimately contributing to a more resilient and well-controlled organisation.