A collaborative approach to sourcing your utility’s internal audit

Internal audit value to utilities

Depending on your utility’s size and resources, an internal audit function may or may not be present. Whether or not your utility staffs individuals with this expertise in-house, an internal audit function can be an essential component of addressing organizational risk.

In The Three Lines of Defense in Effective Risk Management and Control, The Institute of Internal Auditors outlines how an organization should protect itself from risk:

1. Management controls and internal control measures
2. Financial control, security, risk management, quality, inspection and compliance
3. Internal audit

As the third line of defense, the internal audit acts as:

• A firewall between regulators and external auditors
• An independent partner to assess risk and test the application of those risks against internal controls
• The reporting conduit to the governing body on the state of risk and controls in the utility

Say the words “internal controls” and you might be met with a glazed look. However, internal controls are nothing more than business processes which are by definition designed to effectively allocate resources, achieve objectives and act as a deterrent against fraud. Thinking of internal controls in this manner contributes to the understanding that effective controls lead to an effective organization. External financial statement audits will not provide in-depth evaluation of controls because they fly at a 30,000 feet cruising altitude. To view controls from the treetop level or lower, the internal audit function is a necessity.

Benefits of internal audit services

By selecting an outside firm to provide or supplement internal audit capabilities, your utility will:

• Utilize a team experienced in internal audit across multiple utilities
• Gain access to a deeper pool of resources, experience, tools and project templates
• Access information technology specialists that may not reside in your utility
• Receive unbiased review of the assessment areas
• Benefit from the outside firm’s knowledge transfer to your utility’s own internal audit team

While any firm would get to know your utility intimately throughout the internal audit process, one that brings deep utility industry experience and knowledge of issues faced by peer utilities cuts the learning curve. This firm quickly reaches the heart of your utility industry risk areas to:

• Prepare risk assessments for the internal audit’s focus areas
• Bring current perspectives in line with utility industry best practices related to operational, information technology and financial processes including:
  
• Navigate current issues that impact the utility industry including:
  
• Operation of utility programs such as energy efficiency programs
• Issues under joint billing agreements due to multiple owners of generating units
• Information technology controls
• Financial controls over key areas
• Operational controls
• Effective data flow  between operations and finance
• Cybersecurity
• Workforce planning and the aging workforce to develop tomorrow’s leaders
• Distributed generation’s effects on revenues, rates and operations
• Compliance with requirements such as those for transmission utilities under North American Electric Reliability Corporation (NERC) jurisdiction
• Conversion of power supply generation to new fuel sources
• Business processes efficacy in a changing industry
• The utility of tomorrow’s influence on current operations

A team of utility industry-engaged professionals focuses efforts that will benefit your utility including identifying areas that need tighter controls for greater efficiencies, pinpointing risks that should be addressed and evaluating the effectiveness of implementing utility strategies.

Managing internal audit services

When considering the engagement of an internal audit service provider, it will be important to discuss the effectiveness of the internal audit relationship, how your utility will control costs and how you will maximize the value from the project results.

To best ensure effective internal audit services, select one of these approaches:

1. Additional support for your utility’s existing internal audit function. This approach combines your utility’s own internal audit team with individuals from an outside firm to create an experienced team that works together on the internal audit.

2. Project-specific use of internal audit services. With this approach, after your utility shares insights with an outside internal audit team, the service provider conducts an independent review and makes recommendations.

Success can be gained by utilizing an outside firm for experienced managers or even “arms and legs” assistance for testing areas for larger projects.

Cost efficiency of internal audit services

Your utility may hope to resolve certain challenges by having an internal audit performed. As in any cost-benefit analysis, the cost of using outside services must be less than the benefit you will receive.

Discuss these considerations:

• Would it be more cost effective to hire our own internal audit staff and train and develop them?
• Is it more cost effective to use an outside firm with defined scope and budgets to address pressing areas of concern?
• Would use of an outside firm be more useful politically to emphasize a particular area and bring potential recommendations needed in this situation?
• Do we need more utility industry peer experience in this situation than is present on our current internal audit team?

In some cases you will want to have your utility’s team grow; in others, it might make more sense to co-source a specific project.

Summary

Engaging internal audit services can supplement your utility’s internal audit function, provide insights into optimal utility practices and allow you to address immediate areas of concern. If your utility is in this position, using a systematic approach is key to an effective project:

• Determine the value of using internal audit services
• Manage the project scope and thus the fee
• Implement recommendations
• After recommendations have been in place for an appropriate period of time, evaluate whether they are effective or require adjustments

For key insights into evaluating your utility’s business processes to enhance its organizational sustainability, watch Baker Tilly’s on-demand webinar “Creating a sustainable organization: the intersection of finance, technology and human capital.”

For more information on this topic, or to learn how Baker Tilly energy and utility specialists can help, contact our team.

1 The Institute of Internal Auditors, The Three Lines of Defense in Effective Risk Management and Control, January 2013.