I started my accounting career in external audit but realised quite quickly that I preferred work on processes, controls and governance. I had a sense of internal audit from my time in external audit because you inevitably liaise with and understand their work. After considering what type of role I would enjoy most, I found an internal audit role in professional practice. 

I started working with some public sector clients including housing associations, councils and universities before moving to support clients in the corporate world covering a broad spectrum of industries including media, power generation, mining and financial services.  

For a long period of time, I focused on internal audit and assurance work for firms in the financial services industry, covering wealth & asset managers, banks and consumer credit firms. This involved undertaking everything from setting up internal audit plans, leading on individual reviews and presenting at Audit Committees.

Throughout my career my role has been broader than solely internal audit. I have been in involved in a number of different types of assurance reviews including ISAE3000s, agreed-upon-procedures, review and recommend engagements and due diligence work, where I considered controls and regulatory compliance at target organisations. 

My current role at Johnston Carmichael is also relatively broad as I run the Risk Assurance and Internal Audit practice which includes all types of non-financial statement assurance. Whilst a lot of our focus is on financial services, we also look at other sectors with my role involving overseeing the build out of the practice in the UK.

Johnston Carmichael is also part of Moore Global, a global accounting, audit and advisory network of over 228 independent firms and 112 countries; I chair Risk Advisory for Moore Global. This helps to ensure we are co-ordinated across all jurisdictions which undertake any internal audit or assurance work to ensure that we bring the best of the firm to our clients.

We are able to undertake fully outsourced internal audit where we do everything from putting together the audit plan for the year, delivering all the audits and presenting to the Audit Committee, as well as co-sourced support where we provide resources or subject matter input to the in-house internal audit team.

One of the things that has always been a challenge working in Internal Audit is the variety of work we get involved in. We look at a number of different topic areas and therefore the team needs to be comfortable with getting up to speed quickly on different aspects of operations and governance. It isn’t a role where you’re doing the same thing day in and day out; irrespective of your grade, you’ll always be challenged in that respect and there will always be new things to learn.

A further challenge when working in practice is that teams will have multiple clients so will need to juggle the needs of different firms. Whist it is this variety which attracts many people into practice, it can also bring challenges as you need to get under the skin of lots of different organisations very quickly to really understand how they operate. 

It is this breadth of subject matter which means that Internal Audit teams need to have the right skill sets to work on specific engagements and with particular clients.  If the team does not have this, they should consider how they bring in this expertise, be it through hiring specialist resource or engaging with an external consultant to support the work. 

This is particularly important in industries such as financial services given the high level of regulation. Consideration of the requirements of the regulator therefore often needs to be taken into account when planning and undertaking audit and assurance work.  

Given the number and breadth of firms in the financial services sector as well as the amount of regulation, there are often new topics being discussed. For example, the FCA published an ESG policy statement in November 2023 which would likely impact many firms in the sector this year. It is this level of regulation, including forthcoming changes, which needs to considered by internal audit teams to provide accurate and robust feedback to clients.

Of fundamental importance to internal auditors is communication skills. A key part of the role is being able to talk to all types of stakeholders knowledgably as well as being able to clearly articulate issues and recommendations in audit reports.   Written communication is something that only comes through lots of practice and requires teams to tailor for their audience. From a relatively junior level staff are often tasked with writing reports. This is a key difference to external audit and, based on my experience, a skill which those moving into Internal Audit from external audit often need to pick up. 

However, the advances in Artificial Intelligence (‘AI’) means it will likely be increasingly used to support teams in drafting audit reports, which will inevitably result in greater efficiency and more accurate and timely reporting.  

I genuinely enjoy the variety of work I am involved with as these challenges are an opportunity to keep learning, and seeing how our feedback benefits clients is hugely satisfying. Furthermore, senior management and audit committees see Internal Audit as providing real value and increasingly seek our advice and input on areas of concern.

Another facet to my current role is having to build the business which involves multiple activities such as driving propositions, engaging with new prospects and clients, writing proposals and developing the team. This aspect of the role is perhaps less technical in nature, however it requires a different focus and skillset to “pure” Internal Audit. 

Looking forward, internal auditors are going to need to get to grips with the new IIA (Institute of Internal Auditors) standards and embrace technology like AI – both in terms of using AI to deliver our work as well as how to make sure that companies are using AI correctly, including in an ethical manner. This may mean that internal audit teams need to review their skillset to ensure they are well placed to deal with future demands.