Norman Marks’s Auditing that Matters is a former chief audit executive’s argument that internal audit earns its place only when it gives the board and top management what they need to lead the organisation to success: assurance, advice and insight about the risks that matter to the organisation’s objectives, delivered when it is needed and in a form they can act on. Marks led internal audit at large international companies for two decades, and the book, which he published through a self-publishing platform in 2016, sets down positions he had argued for years on his blog and has kept arguing since. Audit plans built from lists of auditable entities, he contends, give assurance that is useful mainly to the managers of those entities; a plan should start instead from the enterprise’s significant risks; reports should tell executives first what they need to know and leave out what they do not; and a finding is worth nothing unless it leads to change. For a chief audit executive or an audit manager rebuilding a risk-based plan, the book is a practitioner’s statement of what risk-based ought to mean. This guide summarises it without reproducing it, sets out its main positions with the cases Marks has published, maps them to the Global Internal Audit Standards and to audit planning and reporting, and ends with a worked example of a hospital system’s audit function rebuilding its 2027 plan around the organisation’s objectives.
In this guide
- The book in one page
- Who Norman Marks is, and how the book came about
- The structure: five themes
- Enterprise risk-based auditing: the risk universe, not the audit universe
- Reporting what leaders need
- The function behind it: budget, plan and measures
- The nine ideas worth keeping
- The vocabulary: fourteen terms defined for practitioners
- What it means for internal audit: planning, scoping and reporting
- The criticisms, and what the book leaves to the reader
- Editions, reading time and how to read it
- A one-hour discussion guide for an audit team
- Worked example: Ashgrove Health System rebuilds its plan around its objectives
- Frequently asked questions
- Related guides
The book in one page
| Question | The answer, in our words |
|---|---|
| What is the book about? | How an internal audit function can matter to the people who lead an organisation, by helping them make decisions with confidence in management’s ability to manage risks and carry out the strategy. |
| What is the central argument? | That internal auditors should audit only what matters to the board and top management as they lead the organisation towards success. Everything else, however tidy, is effort the organisation does not need. |
| What is enterprise risk-based auditing? | Marks’s name for building the plan and each engagement around the most significant risks to the enterprise’s objectives, and examining the controls over each risk wherever they sit, rather than auditing a list of units, processes and systems in rotation. |
| What does it mean for reports? | Write for each audience separately; put the overall opinion first; give executives only what they must act on or monitor, or what is a significant and unacceptable risk; deal with minor issues in the closing meeting; and judge a finding by the change it produces. |
| What does it mean for the function? | A budget built from the audits that matter and a team and processes able to deliver them; in his later writing, a plan that moves when the risks move. |
| Where does it come from? | Two decades as a chief audit executive, after ten years in public accounting and five in information technology, and a long-running blog on governance, risk and audit. |
| Why read it as an auditor? | Because the Global Internal Audit Standards describe internal audit’s purpose as assurance, advice, insight and foresight and the internal audit plan as risk-based and dynamic, and the book is a practitioner’s account of what those words demand of a plan, an engagement and a report. |
| Reading time | A short practical book for two or three evenings; the planning and reporting material is worth a second reading with the function’s own plan beside it. |
Who Norman Marks is, and how the book came about
Marks spent ten years in public accounting at what is now PwC and five years as a vice president in information technology, and then led internal audit at major global corporations for two decades, by his own account in a 2021 interview. His published biography adds roles as chief risk officer, compliance officer and ethics officer, leadership of an IT governance function that included information security, and responsibility for Sarbanes-Oxley section 404 programmes and investigation units at several companies. His blog posts name several of the companies where he was chief audit executive, among them Solectron, Tosco and Maxtor. He is a CPA and holds the IIA’s Certification in Risk Management Assurance; he won the IIA’s Thurston award for his articles in 2004 and again in 2014, is a fellow of OCEG and an honorary fellow of the Institute of Risk Management, and in 2018 was inducted into the IIA’s American Hall of Distinguished Practitioners. He retired in early 2013 and has written, trained and blogged since, producing books on internal audit, risk management, technology risk and the IIA’s management guide to Sarbanes-Oxley section 404.
The book came out of that writing. His launch announcement, on his blog in November 2016, described it as setting down the thinking he had expressed on the blog and elsewhere about how internal audit can help an organisation succeed, and it carried endorsements from practitioners including three former chairmen of the IIA’s board. In a later post he placed it in a sequence: an earlier book of stories from his career explains how he arrived at his approach, Auditing that Matters explains how to put it into practice, and a maturity-model book lets a function assess itself. A pair of companion volumes followed, a collection of twenty case studies drawn, all but one, from real situations in his career, with a discussion guide for the team leader who runs them. His 2022 book on auditing at the speed of risk with a continuous audit plan builds on it, and his posts from 2024 to 2026 return repeatedly to Auditing that Matters as the source of what he calls enterprise risk-based internal auditing.
The structure: five themes
We could not obtain the book’s table of contents. The publisher’s listing, the Google Books record (which offers no preview), library catalogues and the author’s own announcements describe the book but none lists its chapters, so this guide does not describe them or say which chapter covers what. The structure below is the one the author gives: five themes, listed in his launch announcement and in the book’s description. The middle column draws on what Marks has published about each theme, and the right-hand column shows where this guide takes it up.
| Theme, as the author lists it | What it means, from his published writing | Where this guide covers it |
|---|---|---|
| Providing the assurance, advice and insight that leaders need | Confidence for the board and executives that the risks to objectives are being managed, and help where they are not | The audit map, and the worked example |
| Focusing on the risks and issues that matter to executive management and the board | A risk is in scope only if poor management of it would matter to leadership because of its effect on objectives | Enterprise risk-based auditing |
| Practising enterprise risk-based auditing | A plan and engagements built from enterprise risks, examining controls wherever they sit | Enterprise risk-based auditing |
| Communicating what leaders need, when they need it, in a useful and actionable form | Reports written for each audience, with the opinion first and minor matters left out | Reporting what leaders need |
| Building the team and processes needed for world-class internal audit services | A budget, staffing and methods that deliver the work that matters | The function behind it |
Enterprise risk-based auditing: the risk universe, not the audit universe
The book’s centre, by Marks’s own description, is what he calls enterprise risk-based internal auditing, which he abbreviates eRBIA to stress the word enterprise. The core of internal audit’s job, in his account, is to give the board and top management reasonable assurance that the controls over the enterprise’s most significant risks are effective. In posts since, he has set the idea against the way most plans are built. A plan built from an audit universe, a list of auditable entities such as business units, processes and systems audited on a cycle, produces assurance that is useful mainly to the managers of those entities; the board and top management get value from it only if someone translates the findings into their effect on the organisation as a whole. A plan built from a risk universe starts from the enterprise’s significant risks, audits the controls over each risk wherever they sit, and then forms a view of the risk across the organisation. The difference, in our reading, is not that one plan is risk-based and the other is not, since an audit-universe plan can be ranked by risk. It is that the opinion is about something different: in the first case an activity, in the second a risk to the organisation’s objectives.
The case Marks gives from the book is his own. At Solectron, a company with roughly $12 billion of revenue and more than a hundred factories, reliable procurement of quality components at acceptable prices was critical to profitability, and the quality of procurement around the world was uncertain. His predecessor had checked procurement in every factory audit, which confirmed local compliance and missed the enterprise-wide picture. Marks instead staffed a single procurement engagement with senior people, who reviewed corporate contracting and the chief procurement officer’s monitoring, visited selected sites across the regions and then assessed procurement for the company as a whole. The report presented procurement as an improvement opportunity material to profitability, and one site, Penang, turned out to be best in class, negotiating better local prices than corporate had obtained for the whole company. In the 2024 blog post that quotes the case, he adds that the same enterprise approach, applied to information security, found no enterprise risk assessment, poor coordination and an understaffed corporate team.
| Dimension | Audit-universe plan | Risk-universe plan, as Marks describes it |
|---|---|---|
| Starting point | A list of auditable entities: units, processes, systems | The enterprise’s significant risks to its objectives |
| Unit of an engagement | An entity, audited on a cycle | A risk, examined across the entities where its controls sit |
| The opinion | On the entity or activity | On whether the controls over a significant enterprise risk are effective |
| Who finds it useful | Mainly the entity’s managers | The board and top management, as well as the managers |
| What it misses | Risks that span entities, and whether local compliance adds up to control of the enterprise | Entities whose risks never rise high enough to be visited, a trade-off Marks accepts |
| His example | Procurement checked in every factory audit | One procurement engagement across the company, staffed with senior people |
In later posts Marks turns the idea into a scoping rule. Scope is decided before fieldwork begins, and a source of risk is in scope only if weaknesses in it would matter to leadership because of their effect on objectives; the question to ask of any area is who would care if it had weaknesses. Objectives need not be written down to exist, he adds, and they still have to be considered. Engagements should be short and focused, the plan continuously updated, and advisory work used where it is the better response. In a 2026 post he sets out the approach in five steps: understand leadership’s objectives; keep a risk-based plan that is updated continuously; scope each audit around the controls for significant risks; assess whether the right policies and procedures exist, not only whether they are complied with; and rate control issues by their effect on enterprise objectives. His challenge to readers is to take their last five audit reports and ask how much of the content the chief executive would need to act on. The risk-based auditing guide and the annual risk assessment playbook set out the method in the site’s terms, and the guide to building an audit universe covers the inventory that Marks would not let drive the plan.
Reporting what leaders need
Marks chose to excerpt the book’s guidance on reports on his blog the week it came out, in a post criticising a then-new IIA practice guide on audit reports as describing a style at least a decade out of date. The excerpt starts from a simple rule: communication is for the reader, not the auditor, and each audience needs something different. Operating management, executive management and the board are separate audiences, and so are others such as regulators and the external auditor. The overall opinion, on the condition of the controls and on whether the risks in scope are managed at the levels the organisation wants, goes at the top, because executives should be able to take the key message from the first few paragraphs. The table summarises the excerpt.
| Audience or situation | What Marks says they need | What to leave out | The guide’s note |
|---|---|---|---|
| Operating management | Anything beyond the trivial that is not working as intended, with its root causes and practical fixes that can be made quickly | Little; this is the audience for the detail | The root cause guide covers the causes |
| Executive management | What they must act on, what they must monitor, and any significant and unacceptable risk to objectives, after an overall opinion stated first | Anything that does not meet that test, which only weakens the report | The executive summary guide gives the format |
| The board and other audiences | Each addressed on its own terms, including regulators and the external auditor | Detail written for another audience | The guide to reporting to the audit committee covers the board version |
| Issues already fixed | If an issue was not significant to senior management, omit it or note briefly that management corrected further issues; if the risk was significant until corrected, say so and say it is resolved | A full write-up of a minor issue already fixed | A judgment the reviewer should check, not a default |
| Minor issues | A conversation at the closing meeting | The report itself, which they dilute | The closing meeting playbook covers how to close them |
The excerpt also states the idea that, in our reading, best sums up the book: a finding and its recommendation are worth nothing unless they lead to a necessary and appropriate change by management, so the change, not the report, is what internal audit produces. In our reading the rules sit within the Global Internal Audit Standards rather than against them. The Standards set what a final engagement communication must contain (Standard 15.1) and require an engagement conclusion, which the glossary defines as a judgment about the findings viewed collectively (Standard 14.5); Marks’s test decides what else earns a place in the version executives read and where the conclusion goes, which is first. The guide to reports people actually read and the guide to writing for the board apply the same discipline.
The function behind it: budget, plan and measures
The fifth of the book’s themes is building the team and processes to deliver this kind of auditing, and Marks has described on his blog how he went about it. The budget follows the work, not the reverse. He presented a zero-based budget every year rather than carrying the previous year’s forward, built from a prioritised list of the projects needed to give reasonable assurance over the most significant enterprise risks, and he says the book covers that link between budgets and the audits that matter. He showed the audit committee which engagements current staffing would cover and which additional risk areas each extra auditor would address, so that a decision to cut or add resources was taken with its consequences in view; when the budget is short, he argues, the cause is more often that the chief audit executive has not made the case than a constraint imposed from outside. He ties the practice to Standards 8.2, 10.1 and 10.2 of the Global Internal Audit Standards, on the board’s oversight of resources and the chief audit executive’s management of financial and human resources. The table sets out the three classes into which he sorted projects.
| Class | What it holds, in his account | When resources are cut |
|---|---|---|
| A | Must-do work: regulatory requirements, high enterprise risk, requests from the audit committee | Protected |
| B | High-value work on lower risks | Protected where possible; at Tosco he kept the budget for all A and B projects, and at Solectron he trimmed co-sourcing and training instead of staff |
| C | Work that can be dropped | Dropped first |
| Sarbanes-Oxley testing for management | Additional work done for management, which needs its own budget | Funded separately, not at the expense of A and B |
Marks’s own plans were rolling rather than annual: he ran a rolling plan, three months ahead, at several companies during his twenty years as chief audit executive, and his 2022 book develops the idea of auditing at the speed of risk with a continuously updated plan. The Standards accommodate the idea: their glossary describes the internal audit plan as risk-based and dynamic, reflecting timely adjustments in response to changes affecting the organisation, and Standard 9.4 sets the requirements for the plan. When a reader pointed out that the Standards require an annual risk assessment and an audit plan rather than an annual plan, Marks replied that functions should conform only where it makes sense for their business, a position a function that declares conformance with the Standards cannot take. The measure he proposes for the function is the success of the organisation and the satisfaction of the people it serves rather than counts of audits or issues; Standard 12.2 (Performance Measurement) leaves room for that, and the guide to audit KPIs shows how to build such measures.
The nine ideas worth keeping
- Audit what matters to leadership, and only that. The test for every engagement and every line of a report is whether the board or top management would care.
- Start from enterprise objectives and risks, not from a list of entities. The audit universe is an inventory; the risk universe is a plan.
- Give opinions on risks, not on activities. The question is whether the controls over a significant risk to objectives are effective, wherever those controls sit.
- Put senior people on the engagements that matter. The Solectron procurement engagement was staffed with senior people as well as scoped around the enterprise risk.
- Assurance, advice and insight are what leaders need. A function that offers only assurance, on its own timetable, offers less than they need.
- Opinion first, for each audience. Executives should get the conclusion in the first paragraphs, and only what they must act on or monitor.
- A finding is worth the change it produces. A report that changes nothing has produced nothing.
- The budget follows the risks. Build it from zero, show the committee what each auditor covers, and protect the work that matters when cuts come.
- Plans should move at the speed of risk. A plan fixed for a year audits what used to matter; the Standards’ own glossary calls the plan dynamic.
The vocabulary: fourteen terms defined for practitioners
| Term | What Marks means | What it looks like in an audit |
|---|---|---|
| Enterprise risk-based internal auditing (eRBIA) | Planning and scoping around the most significant risks to enterprise objectives | The plan and each scope start from enterprise risks |
| Risk universe | The enterprise’s significant risks, used as the basis of the plan | Plan rows are risks, not units |
| Audit universe | A list of auditable entities audited on a cycle | An inventory for coverage, not the plan’s driver |
| What matters | What the board and top management need, because of its effect on objectives | The test for scope and for report content |
| Enterprise objectives | What leadership is trying to achieve, whether or not it is written down | The starting point of the risk assessment |
| Assurance, advice and insight | The three things leaders need from internal audit | The function’s services; compare the Standards’ purpose statement |
| Overall opinion | A conclusion on the controls over the risks in scope, stated first | The engagement conclusion in the first paragraph |
| Actionable | Information leaders can act on, when they need it | Timeliness and content tests for every report |
| Change | Management’s necessary and appropriate action, the measure of a finding’s value | Issue closure and its effect |
| Zero-based budget | A budget built each year from the work needed, not from last year’s figure | The resource request to the audit committee |
| A, B and C projects | His classes of must-do, high-value and droppable work | Plan prioritisation and the conversation about cuts |
| Rolling plan | A plan updated continuously, a few months ahead | The plan as a living document |
| The good kind of lazy | His endorsement of an Internal Auditor article’s phrase for doing less where the work adds nothing | Cutting low-risk, habitual audits |
| Customer satisfaction | His measure of quality: the satisfaction of the people the function serves | Stakeholder feedback in the KPI set |
What it means for internal audit: planning, scoping and reporting
The book is about the orientation of a whole function, so its implications run from the annual risk assessment to the measures the chief audit executive reports. The map takes eight activities in turn. The guide to building an internal audit plan and the annotated plan template carry the planning procedures, and the map of the Global Internal Audit Standards places each step in the Standards.
| Audit activity | What the book implies | Procedure it changes |
|---|---|---|
| Annual risk assessment | Start from enterprise objectives and the risks to them | Begin with the strategic plan’s objectives and leadership’s view of the risks to each; map the audit universe to those risks afterwards |
| Building the plan | A risk universe, prioritised and continuously updated | Make the plan’s rows enterprise risks with the controls to be examined; review it with the committee every quarter rather than once a year |
| Engagement scoping | Only the sources of risk that matter to leadership | In the planning memo, state for each scope item who would care if it failed and why; see the engagement risk assessment guide and the scoping memo guide |
| Staffing | Senior people on the engagements that matter | Assign the most experienced auditors to the A projects rather than by rotation |
| Reporting | Opinion first; only what executives must act on or monitor, or significant unacceptable risk | Write an executive version with the opinion in the first paragraph; give the detail to operating management; close minor items at the closing meeting |
| Rating issues | By effect on enterprise objectives | Calibrate the rating scale to enterprise impact rather than local severity; see the severity ratings guide |
| Resourcing and budget | Zero-based and tied to coverage | Present the budget as a coverage map: what each auditor covers, and what a cut would drop |
| Measuring the function | The organisation’s success and the satisfaction of leaders | Replace counts of audits and findings with measures of change achieved and of stakeholder value |
Two cautions belong beside the map. The first is that a plan built on what matters to leadership still needs a view of coverage. The board and the external auditor will ask what has not been audited, and in some sectors supervisors expect certain activities to be covered whatever their enterprise significance; the assurance mapping guide shows how other assurance providers fill the gaps, and the guide to what regulators expect from internal audit sets out the supervisory view. The second is that leadership’s view of what matters is a starting point, not a boundary. The Standards’ purpose statement includes foresight as well as insight, and a function that audits only what executives already think is important will miss the risks they have not yet seen. Marks’s own five steps begin with understanding leadership’s objectives, not with adopting its list of concerns.
The criticisms, and what the book leaves to the reader
Two criticisms are documented; the third and fourth are ours. The first came in the comments under the reporting excerpt in 2016: one practitioner argued that the IIA guidance Marks dismissed largely restated the mandatory standards, and another warned that leaving material out of the executive version could allow a dishonest chief executive to keep the board uninformed. That second objection matters, because the test of what executives need is applied by auditors whose day-to-day working relationships are with those executives, and it is why the board’s version of a report cannot simply be the executives’ version. The second is the tension with the Standards that Marks makes explicit in his later writing. His view that functions should conform where it makes sense for their business is not available to a function that declares conformance, the subject of Standard 4.1, so the reader has to separate his practice, most of which the Standards accommodate, from his asides about them. The third is about provenance: the book is published independently, its evidence is its author’s experience, and it presents that experience as such rather than as research.
The fourth is our reading. The cases Marks has published come from large multinationals with sizeable audit functions, and the approach depends on judgment about what matters to leadership that a small function or a junior team may not yet have. For a function of one or two people the logic holds, since a small team has even more reason to audit only what matters, but the mechanics differ, and the operating manual for a one-person audit shop covers them. And the approach says how to choose what to audit, not how to audit it: the testing, evidence and documentation that make an opinion on an enterprise risk defensible are as demanding as for any other engagement, and probably more, because the opinion is broader.
Editions, reading time and how to read it
| What | Details | Best for |
|---|---|---|
| Paperback | CreateSpace Independent Publishing Platform, 2016 (announced on the author’s blog on 9 November 2016); ISBN 9781537662022 | The edition to buy; the author recommends print |
| Ebook | A Kindle edition sold through Amazon | Reading on screen |
| Companion volumes | Auditing that Matters: Case Studies, twenty cases each ending with questions, and a discussion guide for the team leader; announced on the author’s blog in June 2020 | Team training sessions |
| Later book | Auditing at the Speed of Risk with an Agile, Continuous Audit Plan (2022), which builds on it | The planning argument in full |
| Reading plan | Straight through once; then the planning and reporting material again, with the function’s current plan and five recent reports beside it | A chief audit executive or audit manager with two evenings |
| Companion reading | The Audit Society summary for the critique of assurance for its own sake; the Failure of Risk Management summary for the risk assessment beneath the plan; the Sawyer’s Guide summary for the conventional practice the book argues with | Placing the argument |
Read it with the current audit plan open and a single question: for each engagement, which enterprise risk does it give the board an opinion on? Engagements that cannot be matched to one are the plan’s weakest lines, and Marks’s argument is that they should either be re-scoped around a risk or dropped. The exercise also works in reverse: take the five risks the board regards as most significant and find the engagements that give an opinion on them. A plan that answers the first question well and the second badly has been built from the audit universe, however carefully it was ranked.
A one-hour discussion guide for an audit team
- Ten minutes: the five-report test. Each person brings a recent report and counts the findings the chief executive would need to act on or monitor. Compare the counts with the length of the reports.
- Fifteen minutes: universe or risks? Mark each engagement in the current plan as entity-based or risk-based. For the five most significant risks in the risk register, find the engagements that give an opinion on them.
- Ten minutes: who would care? For one engagement about to start, list the scope items and, for each, who in leadership would care if it failed. Discuss dropping any item with no answer.
- Fifteen minutes: the budget conversation. Sort the plan into A, B and C projects and draft the paragraph that tells the audit committee what a 10 percent cut in resources would drop.
- Ten minutes: the measures. List the function’s KPIs and mark those that count activity and those that measure change or value; the KPI guide has alternatives.
Worked example: Ashgrove Health System rebuilds its plan around its objectives
Ashgrove Health System is a fictional US nonprofit with five hospitals, $2.1 billion of revenue and an internal audit function of 12. Its plan for 2026 had been built the conventional way: an audit universe of 160 auditable entities across the five hospitals and the system office, risk-scored and audited on a three-year cycle, which produced 34 engagements a year, most of them hospital-by-hospital reviews of the same processes. For 2027 the chief audit executive rebuilt the plan from the system’s objectives, using the book’s approach, with the audit committee chair’s agreement to present it as a rolling plan reviewed every quarter. The guide to internal audit in healthcare covers the sector’s risks, and the guide to internal audit in higher education and nonprofits covers the nonprofit side.
The starting point was the strategic plan the board had approved, which set five objectives. For each, the function asked the executive team and the chairs of the board’s committees which risks, if poorly managed, would stop the system achieving it, and rated the risks by their effect on the objective rather than on any one hospital. The table compares the old plan’s coverage of each objective with the new plan’s.
| Enterprise objective | The risk that matters, enterprise-wide | Coverage in the 2026 plan | The 2027 engagement |
|---|---|---|---|
| Quality and patient safety: fewer serious safety events | Serious events not reported or escalated consistently across the five hospitals | Five hospital-level compliance reviews on rotation; none on incident reporting | One system-wide review of safety event reporting and escalation, led by the most senior auditor with a clinical adviser |
| Financial sustainability: a 2 percent operating margin | Revenue lost to claim denials and coding errors, which no hospital-level audit compares across hospitals | Five revenue cycle audits, one per hospital, each rated satisfactory | One revenue integrity engagement comparing denial rates and coding across the hospitals; see the hospital revenue cycle audit |
| Workforce: lower spending on agency nurses | Reliance on agency staff and weak scheduling controls | Not in the plan; classed as a low-risk human resources entity | An advisory review of agency staffing controls and spend forecasting |
| Community benefit and tax exemption | Each hospital must meet the four section 501(r) requirements, facility by facility, to keep its exemption: a community health needs assessment, financial assistance and emergency care policies, limits on charges, and billing and collection rules | Covered once, in 2023, inside a patient financial services audit | An assurance engagement on 501(r) compliance at all five facilities |
| Digital: one electronic health record across the system | Programme delivery, data migration and access to patient records | A post-implementation review scheduled for 2028 | Quarterly advisory checkpoints during the programme and an opinion on access controls at go-live; see the HIPAA audit programme |
The new plan had 22 engagements instead of 34: 12 A projects, 7 B projects and 3 C projects that would be the first to go. The engagements it dropped were mostly hospital-level reviews of small cash-handling points and departmental processes that had produced only low-rated findings for six years, the bad kind of laziness that repeats the same tests out of habit. The budget was presented from zero, as a coverage map: the committee could see that the function’s twelve auditors covered the A and B projects, and that one more auditor would add the cybersecurity of connected medical devices, which leadership had named as a risk to the safety objective. The committee approved the plan and deferred the additional post to the mid-year review, which the rolling plan made a natural point to revisit it.
The first result came in the first quarter of 2027. The revenue integrity engagement found what five hospital-level audits, each rated satisfactory, had not: at one hospital, initial denial rates for the same payers ran at nearly twice the system average, traced to an insurance eligibility check that its registration staff performed after admission rather than before. Each earlier audit had tested its own hospital’s process against its own policy, and none had compared the hospitals. The chief audit executive’s quarterly report to the committee opened with the opinion on each enterprise risk the plan had covered so far, and the revenue finding was the first item, stated in terms of the margin objective. The system’s chief financial officer called it the first audit report that had told the finance team something about the system rather than about a hospital, which is the distinction the book is built on.
Frequently asked questions
What is enterprise risk-based internal auditing?
Marks’s term, abbreviated eRBIA, for building the audit plan and each engagement around the most significant risks to the enterprise’s objectives. The opinion is on whether the controls over each such risk are effective, wherever those controls sit, rather than on a business unit, process or system audited in rotation.
Does the approach conform with the Global Internal Audit Standards?
Largely. The Standards describe internal audit’s purpose as assurance, advice, insight and foresight and the internal audit plan as risk-based and dynamic, and Standard 9.4 sets the plan requirements. Marks’s remark that functions should conform only where it makes sense is not open to a function that declares conformance. The Domain IV guide covers planning and resources under the Standards.
Should an audit function abandon its audit universe?
In our view no: keep it as an inventory for coverage, for the external auditor and for any regulator, and let the enterprise risks drive the plan. Marks’s argument is against letting the universe decide what is audited, not against knowing what exists.
What does Marks say an audit report should contain?
An overall opinion first, so that executives get the message in the opening paragraphs; for executives, only what they must act on or monitor, or what is a significant and unacceptable risk; the detail for operating management; and minor issues dealt with at the closing meeting rather than in the report.
Is there a later edition or a companion book?
We found no second edition. The companions are Auditing that Matters: Case Studies and its discussion guide, announced in June 2020, and the 2022 book on auditing at the speed of risk with a continuous plan, which builds on it.
Where does the book sit in the reading list?
In the profession section of the internal audit reading list, as a practitioner’s case for what risk-based should mean.
Related guides
- Risk-Based Internal Auditing: How Risk Drives the Plan, the Scope and the Testing — the method in the site’s terms
- The Annual Internal Audit Risk Assessment: A Step-by-Step Playbook — the assessment the plan starts from
- How to Build an Internal Audit Plan (Worked Example + Memo) — building the plan itself
- Engagement-Level Risk Assessment: From Process Understanding to Test Plan — scoping what matters
- The Executive Summary: One Page That Decides Your Report’s Fate — opinion first
- Dashboarding Audit Results: KPI Design for Audit Committees and Management — measuring the function by its value
- The Best Books for Internal Auditors — where this book sits among the others
- All book summaries — the full set of summaries for auditors
- Trusted Advisors by Richard Chambers: Summary and Lessons for Internal Auditors — the attributes of outstanding internal auditors
- The Speed of Risk by Richard Chambers: Summary and Lessons for Internal Auditors — audit plans that keep up with risk
- World-Class Internal Audit by Norman Marks: Summary and Lessons for Audit Leaders — one chief audit executive’s stories, and the judgement in them.
- Agents of Change by Richard Chambers: Summary and Lessons for Internal Auditors — internal auditors as catalysts for change.
Leave a Reply