Internal auditors must look beyond third parties to incorporate key fourth, fifth, and sixth parties when planning, scoping, and executing each audit — a process known as “ecosystem management.”
Shifting the Emphasis
Focusing on an organization’s ecosystem can change the underlying approach and output of an internal audit. Aiming scoping questions, walk-throughs, and outputs at the organization’s external partners shifts the emphasis from control gaps, issues, and items requiring resolution to how the business protects its value-driving activities and profit-making ability. This doesn’t mean that an organization should change how it plans its annual internal audit schedule. Instead, it should integrate three key principles into how it executes each audit. In other words, the annual audit schedule should continue to focus on higher risk areas, but the scope of each audit should include the ecosystem principles. This approach may result in longer and more complex audits.