Many Internal Audit teams spend a majority of their time on SOX compliance, leaving the remainder for audit projects in high-risk areas.

Some teams have no SOX responsibilities but continue using their long-established audit methodology.

Some audit departments, regardless of size, strive to be best-in-class but limit their potential by either insisting on handling everything internally or believing they lack the budget to enhance their audit projects with external assistance.

These internal audit teams typically carry out their projects in a very standard way:

• Plan the audit based on documented policies and procedures, along with their team's online research about the process or risk under review,
• perform fieldwork,
• identify fundamental issues and obtain management's reluctant agreement to internal audit's recommendations
• issue the report, and then follow-up.

This approach is fine - Internal Auditors have been enlisting the approach since our profession began.

However, this approach creates a situation where most audit observations focus on control effectiveness and activities that deviate from management's expectations.

What's typically missing is the ability to assess both the design effectiveness of the area under review and whether management's process expectations are appropriate or truly best-in-class. Could it be that the area audited is doing the wrong thing in the right way, and Internal Audit isn’t catching this?

Fortunately, this problem can be solved by leveraging external subject matter expertise during the planning, fieldwork, and reporting phases of internal audit projects.

Some teams may dismiss this approach citing time constraints, budget limitations, or simply because it falls outside their standard practices.

But leveraging external expertise was a strategy I used extensively as CAE. It proved to be the single biggest factor in our audit projects' success and helped build our team's excellent reputation within the company.

So this morning, I'll share three ways my team leveraged external expertise in our audits and outline strategies that any Internal Audit leader can adopt in their team’ auditing approach.

1. Leverage Big Four or Other Business Consultants

During my time at a Big Four firm, I worked with a Fortune 100 internal audit team that used a consultative approach for all their new and non-routine audit projects.

I was responsible for cold-calling and networking throughout the firm’s vast ecosystem to find subject matter experts who could dedicate 40–60 hours to our 600+ hour audit projects.

After engaging the audit SME, our team would meet for an hour to make introductions and understand their perspective on how similar-sized organizations and other Fortune 100 companies manage the risk being audited.

Armed with this knowledge and our normal preparation, our audit team would create a pre-planning questionnaire and meet with the key audit customer. In these meetings, our team would ask open-ended questions, but the audit customer would typically provide brief, closed-ended responses.

However, when our SME joined these meetings, they would listen to the initial discussion and then ask just one or two questions—and suddenly, the audit customer would open up, sharing a wealth of valuable information that helped us better scope the audit.

We used the consultant during fieldwork only to validate whether our identified observations were genuine issues.

The most valuable aspect of using these consultants came during the draft audit report presentation. Rather than having our internal audit team prescribe solutions, we took a different approach: Internal Audit would present the identified issues, management would acknowledge them, and then our SME would explain how other Fortune 100 and comparable organizations were successfully addressing similar challenges.

After becoming Chief Audit Executive, I immediately implemented this approach with our team, achieving outstanding results.

Our audit customers received not only standard observations and issues but also practical, timely insights and recommendations from credible experts with proven track records. These SMEs provided valuable context about process design, operational effectiveness, and solutions proven successful at other organizations. The impact was meaningful and immediate.

But the benefits didn't stop there.

Post-audit satisfaction survey scores skyrocketed.

Audit issues were resolved and remediated more quickly.

Most rewarding of all, management began actively seeking our help. They wanted our help and expertise.

Executives were hearing about Internal Audit’s work, through water-cooler conversations and formal channels. Instead of seeing our work as “just an audit,” they saw opportunities to get free consulting that helped them improve processes, controls, outcomes, and their own professional standing.

It wasn’t “free,” obviously. But considering the added value of the assurance that the SME investment provided over Internal Audit’s assurance, it was time and money unbelievably well spent.

How to Do It

When I speak with CAEs about this approach, a common objection is that they lack the budget to use SMEs. Here are some tactics to consider if you want to use this approach:

1. Find a consulting partner with a broad range of services and SMEs who can support all your potential audit projects. While it doesn't need to be a Big Four firm, these firms typically offer the most comprehensive consulting expertise. Ideally, partner with one firm for all your projects.
2. Look for an experienced manager, senior manager, or director who can participate virtually for a few hours each week during the 2–3 month project timeline. While you'll pay standard rates, the total fee should be under $10,000 per project.
3. If you encounter resistance from SMEs (they naturally prefer full engagements over advisory roles), ask your CFO to promise the Big Four firm's business development leader that they'll be invited to bid on all major business projects from your CFO and company.
4. To make the business case for SME funding, start by requesting a budget for 1–3 pilot projects. With the right SME, these initial projects will demonstrate clear value, and positive feedback from audit customers will strengthen your case for future budget requests.

2. Leverage Association Resources and Speak with Industry Experts

A more affordable way to leverage external expertise during an audit project is to join an association that represents the audited area, process, or department.

When I was a CAE, our organization was leaning into digital transformation, and one of the key changes involved expanding from hardware-only to software products. Our Internal Audit team reviewed the strategic workforce planning process for software engineers—an area where both our company and our audit team had limited experience.

For a few hundred dollars, one of my team members purchased a membership with the Society for Human Resource Management (SHRM), a respected HR professional association. We planned to use their resources to gather insights.

Then we had an even better idea.

During her research, my colleague discovered an association SME who served as their thought leader. His expertise focused on strategic hiring, so we decided to contact him.

We reached out and said, "We're auditors who just joined SHRM because we're reviewing our organization's workforce planning process. Would you be willing to share your expertise with us for an hour?"

He immediately said yes. Our first call lasted more than two hours, and our team spoke to him at least three times. His feedback, coupled wit all of the resources the association had available for members,  was packed with best practices and industry insight, including how strategic hiring processes were changing at Fortune 500s.

It was hyper-relevant information that would have taken us months to identify on our own.

Instead, we accomplished this for just a few hundred dollars and less than three hours of meeting time.

How to Do It

1. Find/join a relevant association. There are associations for virtually everything we audit. Auditing payroll (again)? A quick online search yields several local, national, and global payroll associations. Why not uplevel this year’s payroll audit with genuinely relevant insight?
2. Get creative about connecting. Consider attending association-sponsored events to connect with professionals who have the expertise you're seeking to audit. Could you network in forums to find the right SME? Why not reach out to an association spokesperson, a journalist whose articles you frequently read, or a regularly quoted expert? You'll never know if they're willing to share their knowledge unless you ask—and in my experience, they usually are.

3. Leverage your Peers to Benchmark Processes

Let's say you're the Internal Audit leader with no budget to spare. Or perhaps you're working on a routine project and don't want to allocate any budget toward it.

Even in these situations, you can still leverage external expertise. One of the most cost-effective options is to tap into your Internal Audit network.

Like most audit teams, we performed an annual Travel and Entertainment Expense audit. While this audit is important, testing the same controls year after year—such as whether an executive exceeded dinner expenses by $500—can become repetitive.

One year, my team decided to do something different.

One year, I reached out to five other CAEs at similarly sized companies in our industry. I proposed benchmarking our companies' T&E policy data together.

I organized a virtual meeting where each CAE shared their T&E policy and process documentation. Together, we spent 90 minutes analyzing the data to create a useful benchmark for everyone.

We compiled this benchmark data into a table for the audit report appendix. The table compared six manufacturers across approximately 10 key metrics, including T&E spend, headcount, and other relevant statistics.

During our presentation to the audit committee, they focused almost entirely on that benchmark slide.

While the report contained standard T&E findings from current and prior years, the appendix slide revealed fresh insights. The audit committee was particularly intrigued by the differences in how other companies operated.

This initiative led to meaningful changes in our T&E expense policy and process, demonstrating to our Audit Committee and Executive team that we were an exceptional internal audit function.

How to Do It

1. Build your network. Most experienced CAEs have at least four or five trusted peers in their network. However, there are many more excellent CAEs eager to connect. To expand your network and find benchmarking partners, join relevant communities or associations, or invest time in building out your professional network.
2. Nourish authentic connections. Connecting at a conference or on LinkedIn, or in a community is just the beginning. The key is initiating and maintaining meaningful conversations that build lasting relationships.
3. Initiate collaborations with your peers. Be clear, targeted, and specific about your benchmarking goals. Emphasize how the collaboration will benefit everyone involved.

The Need to Leverage External Expertise

As business processes grow increasingly complex and Generative AI adoption expands, organizations need a more comprehensive approach to Internal Auditing.

By leveraging external expertise, you provide more valuable assurance to your key stakeholders. Instead of simply calling "balls and strikes" on policy compliance, you bring relevant, credible, and actionable advice that enables positive organizational change.