Internal audit, from mandatory tick-box exercise to an organisation’s strategic radar
Internal audit should no longer be viewed merely as a legal obligation, but also as a tool that enables organisations to identify at an early stage risks that may affect profitability, cash flow and long-term resilience. In an economic environment characterised by cost pressures, digital transformation, the accelerated adoption of artificial intelligence, tax changes and increasingly complex sustainability requirements, internal audit can provide organisations with an independent perspective on the risks and vulnerabilities that may influence long-term performance, according to TPA Romania, a leading company in Central and Eastern Europe specialising in accounting, tax, financial audit and legal advisory services.
“In many organisations in Romania, internal audit continues to be viewed primarily as a legal obligation. The questions the auditor asks are often the same: Have the procedures been followed? Are the controls working? Have there been any deviations? Today, however, this perspective is too limited. An internal audit that adds value to an organisation is not one that identifies the largest number of deficiencies, but one that helps the organisation identify and manage major risks before they materialise,” says Claudia Bratu, Audit & Advisory Partner and Head of ESG Services at TPA Romania.
In the construction industry a healthy margin may conceal losses
In the construction sector, a project may appear profitable when only direct costs are analysed, but the picture can change significantly once indirect costs are properly allocated.
“For example, Project A has a margin of 10%, while Project B has a margin of 5%. After the appropriate allocation of indirect costs, Project A’s margin rises to 7%, while Project B becomes loss-making, at -2%. At an organisational level, the result may seem acceptable. In reality, however, a profitable project is financing an unprofitable one. The situation becomes even more acute when, for various reasons, the project is delayed or suspended. Work may stop, but financing costs and lawyers’ and experts’ fees may continue. Internal audit can identify margin deterioration at an early stage and assess whether the necessary traceability exists between event, project and cost,” explains Claudia Bratu.
According to the TPA Romania specialist, this approach becomes essential when a project subsequently enters arbitration. In such a situation, it is no longer sufficient to establish that losses occurred. It is also necessary to explain where, when and why they arose, as well as the financial impact of the event that gave rise to the dispute.
Beyond analysing project profitability, an internal audit can also identify the operational causes that contribute to margin erosion and rising costs across an organisation. Certain processes, although formally operational, are inefficient in practice: too many approval levels, the same information being entered into multiple systems, duplicated controls, manual reconciliations, unclear responsibilities and reports produced monthly that are no longer used. In such cases, the question the internal auditor asks should not only be does the control exist? But also why does it exist? What risk does it address? Is it still necessary? Can the process be simplified or automated?
AI brings new governance risks
With artificial intelligence being used increasingly frequently in estimates, forecasts, pricing, supplier selection, contract analysis and human resources processes, new governance, control and accountability challenges are also arising. Organisations must answer essential questions as to who approves the use of AI solutions, what data are allowed to be used, who validates the generated results, how the applications in use are monitored and who assumes responsibility when an AI-based decision produces unintended effects.
According to the TPA Romania specialist, internal audit can play a preventive role by assessing the AI governance framework, responsibilities and approval levels, applications and use cases, as well as how data is protected, results validated and the performance of implemented solutions monitored. The purpose is not to restrict the use of artificial intelligence, but to leverage its benefits within a framework in which risks are understood, assessed and appropriately managed.
From control function to strategic partner for the organisation
Internal audit remains an independent function, but its role can expand into areas that directly influence an organisation’s performance and resilience. The internal auditor can thus become a strategic partner to management, providing insight into the risks and processes that influence an organisation’s activities. The internal auditor can contribute to understanding the true profitability of projects, identifying processes that require redesign and supporting an organisation during periods of transformation, mergers and acquisitions. At the same time, the internal auditor can analyse the governance framework within which artificial intelligence is used, how ESG risks are managed and an organisation’s level of preparedness for the new pay transparency requirements.
“Perhaps the most important change is the shift from an audit that explains why a deficiency occurred to one that helps the organisation identify and prevent it before it begins generating losses, penalties or reputational damage. In this new model, the internal auditor’s questions become: what risks are emerging within the organisation? What do the data tell us and how can we intervene before they lead to losses, operational bottlenecks or missed opportunities?” explains Claudia Bratu.
