The Overlooked Side of Internal Audit: Advisory

Advisory engagements are not all of one kind. The IIA’s practice literature distinguishes four types:

• Formal engagements: planned work governed by a written agreement.
• Informal engagements: committee participation, comments on a draft policy.
• Special engagements: participation in an ERP or system transformation team, merger and acquisition reviews.
• Emergency engagements: support to a team set up after an extraordinary event.

Each of these has a concrete counterpart in a mid-sized company. The examples below are anonymised composite scenarios:

• Control requirements in an ERP migration: Before moving to a new ERP or upgrading the current version, internal audit gives a written opinion at the design stage on segregation of duties rules, the authority matrix and approval flows. Instead of writing findings after go-live, it records its reservations in the design document. Control design in ERP projects
• New dealer model: As a food brand grows its franchise network from fifteen dealers to sixty, internal audit comments on the audit-rights clauses in the dealer agreement, the turnover verification method and the structure of the dealer audit programme.
• Purchasing authority matrix: When a manufacturer with three sites resets its approval limits, internal audit assesses whether the limits fit the risk profile and the role definitions in the ERP.
• Institutionalisation project: In the move from a family business to professional management, internal audit comments on the new policy and procedure set from the perspective of control points.
• After a fraud case: When an incident occurs, internal audit contributes to the design of the whistleblowing line and the preliminary investigation protocol.

In every example the output is of the same nature: a recommendation report, a design opinion or training. It is not an approval. Management makes the decision and implements it; internal audit does not own the process, it gives advice.

Nor is the knowledge gained in these engagements wasted. Every control weakness noticed during an advisory engagement becomes an input to the following year’s risk assessment and internal audit plan. This is one of the most productive information flows between enterprise risk management and internal audit.

Expert Note

Running advisory engagements within a legitimate and bounded framework depends on two documents. The first is the board-approved internal audit charter: under Standards 6.1 (Internal Audit Mandate) and 6.2 (Internal Audit Charter) of the 2024 Standards, the internal audit mandate and the scope and types of services to be provided are defined in this document, which the board approves. The second is the internal audit plan: Standard 9.4 (Internal Audit Plan) requires the plan to be based on a documented assessment of the organisation’s strategies, objectives and risks, to take into account the mandate and all agreed services, and to escalate to the board conflicting demands such as replacing planned assurance engagements with advisory ones. The practical consequence: if next year’s internal audit plan has no separate line and no reserved resources for “advisory”, every advisory request that arrives during the year is time taken from the plan and disrupts assurance work (effective: 9 January 2025).

The owner’s first question is a fair one: “If internal audit both designs the process and audits it, who is auditing whom?” It points to the most misunderstood part of the advisory role of internal audit. The boundary is defined in the standards, and a mid-sized company can apply it with three rules.

Rule one: internal audit does not take on management responsibility. It gives advice, comments on design and provides training, but it does not run the process or make the decision. In an authority matrix review, internal audit says “this limit is high for your risk profile”; the manager is the one who changes the limit. If this line is crossed, internal audit becomes the owner of a process it built and loses its independence.

Rule two: advisory is not approval. “Internal audit has looked at it” does not mean “internal audit has approved it”. Banking regulation states this explicitly: banks may obtain advisory services from their internal audit unit on new products and procedures, but such advice does not mean the matter has been approved. If this is the principle in sectors governed by external regulation, a mid-sized company outside that regulation should write the same principle into its internal audit charter.

Rule three: if assurance will be given in an area internal audit helped design, safeguards are put in place. If internal audit commented on the design of a process, auditing the same process shortly afterwards can impair its objectivity. The safeguards are well established: a different auditor carries out the assurance engagement, an independent oversight arrangement is set up, and the potential impairment is disclosed to the board.

The same three rules apply to companies that receive internal audit through an outsourced or co-sourced model, and matter even more there. If the same external provider is both advising on process design and providing assurance, the buyer has every right to ask how the teams are separated and how the impairment is disclosed. If that question is never asked, nobody knows how independent the assurance actually is.

Expert Note

In the 2024 Global Internal Audit Standards, objectivity is covered under Principle 2: 2.1 Individual Objectivity, 2.2 Safeguarding Objectivity and 2.3 Disclosing Impairments to Objectivity. Under 2.2, objectivity is presumed to be impaired when an internal auditor provides assurance on an activity for which they had responsibility within the previous 12 months; advisory services on the same activity may be provided, but the potential impairment is disclosed to the party requesting the service before the engagement is accepted. 7.1 Organizational Independence requires organisational independence to be confirmed to the board at least annually and, when internal audit takes on a non-audit role, the safeguards protecting independence to be documented in the internal audit charter. In Turkish banking, the relevant provision is Article 33 of the Regulation on Banks’ Internal Systems and Internal Capital Adequacy Assessment Process (Official Gazette 11.07.2014, No. 29057): advisory services may be obtained from the internal audit unit on new products and services, policies and procedures, and the advice given does not mean the matter has been approved. Article 27(3) of the same Regulation requires the internal audit plan to be prepared taking advisory services into account.

The first reason is historical: the legacy of inspection (teftiş). Broadly speaking, the inspector is the person who finds errors and holds people to account; the inspector looks backwards and focuses on events and individuals. Internal audit looks at systems and processes, focuses on the future and aims to improve operations. The differences between internal audit and inspection are set out in a table. In the public sector and banking this shift was launched by legislation on a set date; in the rest of the private sector it has moved slowly and voluntarily.

The second reason is the legislation itself: internal audit is not mandatory for private companies that are not publicly traded. The Turkish Commercial Code gives the board the duty to establish the financial control system and the power to set up committees for internal audit purposes. It makes the early risk detection committee mandatory for companies whose shares are traded on the stock exchange; in other companies this committee is set up only at the written request of the independent auditor. For public administrations, internal audit is defined by Law No. 5018; for banks, by the regulations of the BRSA (Banking Regulation and Supervision Agency, BDDK). For the thousands of mid-sized companies outside this framework, internal audit is a management choice, and for the advisory role there is usually neither an internal audit charter nor a plan. The International Standards for internal audit, and an internal audit charter drafted in line with them, are the right guide here.

The third reason is capability. An advisory engagement demands more than an assurance engagement: process knowledge, ERP knowledge, sector knowledge, knowledge of best practice, field and implementation experience, a project management approach, and the ability to write recommendations in management’s language. When the team is small, companies settle for assurance; advisory becomes the work done “if there is time left”, and there almost never is.

When these three reasons come together, internal audit stays confined to “counts, cash and findings, the valuable traditional expectations”. This is not a measured ratio but an observation from within the profession, one that practitioners working with mid-sized companies have voiced for a long time. How the picture changes is a question of model and method.

Expert Note

Traces of internal audit and advisory in Turkish legislation: Law No. 5018 on Public Financial Management and Control, Article 63 defines internal audit as “an advisory activity providing independent and objective assurance”; its scope is public administrations. Turkish Commercial Code No. 6102 (Official Gazette 14.02.2011, in force 1 July 2012): Article 375(1)(c) lists establishing the accounting and financial control system among the board’s non-delegable duties; Article 366(2) grants the power to set up committees and commissions for internal audit purposes; Article 378 makes the early risk detection and management committee mandatory for companies whose shares are traded on the stock exchange, and in other companies the committee is set up immediately if the independent auditor deems it necessary and notifies the board in writing. The Capital Markets Board Corporate Governance Communiqué (II-17.1) (Official Gazette 03.01.2014, No. 28871) contains corporate governance principles on the audit committee for listed companies. None of these provisions imposes an internal audit obligation on a non-listed SME; in such companies internal audit is established by board resolution.

The advisory role of internal audit can be set up through one of three models: an in-house unit, co-sourcing or outsourcing.

• In-house unit: Advisory engagements require investment in process, ERP and sector knowledge, as well as field experience and a project management approach.
• Co-sourcing: The in-house team carries out assurance engagements and advisory engagements are mostly sourced from external specialists, or the other way round; the work is carried out by internal and external resources together.
• Outsourcing: The whole function is external; oversight by the board or audit committee is essential.

We compared the models in a separate article. The real question here is how an advisory engagement works, whichever model is chosen.

A realistic advisory engagement goes through these steps:

1. Trigger: An ERP project, a new dealer model, a revision of the authority matrix, a fraud case and so on. The request comes from management; internal audit does not start the engagement on its own.
2. Written agreement: Purpose, scope, mutual responsibilities and output are written on a single page. The document states plainly that advisory does not mean approval and that the decision rests with management.
3. Who in the company is involved: The process-owning manager, finance, IT and, where needed, legal. In a typical engagement these people are asked for two to four hours a week; project-type engagements need more.
4. Which documents are requested: Process flows, the current authority matrix, ERP role definitions, the policy and procedure set, any earlier internal audit findings and so on.
5. Duration: An ERP control design opinion takes three to six weeks and an authority matrix review two to four weeks, depending on the complexity of the process, the scope, the organisational structure and so on. These are typical ranges; they vary with the company’s size, digital maturity and corporate culture and are not a commitment.
6. Output: A recommendation report, a design note or an identified training need. Every output states which recommendation addresses which risk and that the implementation decision belongs to management.
7. Follow-up: Implementation is management’s job. Internal audit may provide assurance in the same area in a later plan period, under the conditions described in the boundary section above. With co-sourcing, it may be possible for the external resource to take on implementation work.

This flow has one precondition: the advisory request comes from management, and management only asks if it knows the option exists. If the advisory scope is not written into the internal audit charter and has not been communicated to staff, no requests arise and the advisory role stays on paper.

The analytical capacity of internal audit is also decisive in advisory engagements. Detecting conflicting authorisations in ERP role definitions, verifying dealer turnover data or screening purchasing approval exceptions can, with data analytics, often be completed in days instead of weeks. In later stages of data analytics, projects such as advanced analytics, artificial intelligence and autonomous AI can be planned; this capacity directly affects how deep an advisory engagement can go. Where in-house capacity is not sufficient in these areas, co-sourcing or outsourcing under the board’s oversight can be considered.

TeoLupus is an Istanbul-based assurance and management advisory firm working across Türkiye with mid-sized companies, family businesses and growing groups. Our internal audit services aim to build and establish both sides described in this article together: running assurance engagements on a risk-based plan, and positioning advisory engagements within the same plan with their boundaries defined in writing.

In concrete terms, we do the following:

• Establishing the internal audit unit: Preparing the internal audit charter and the charters of the board’s risk and audit committees, writing the nature and scope of advisory services into these documents, building a risk-based internal audit plan, and selecting and training the team.
• Co-sourced and outsourced internal audit: Carrying out assurance and advisory engagements within an annual plan, without you having to build your own unit, or by complementing your existing one. Both models are a live option alongside in-house capacity.
• Bringing advisory engagements into the plan: Opening an advisory line in your existing internal audit function’s plan for 2027 and beyond, and designing the balance between assurance and advisory in a form that can be presented to the board.
• Quality Assurance and Improvement Programme: Periodic assessment, against the international professional practices framework and the International Standards for internal audit, of whether advisory engagements are carried out in line with the objectivity rules.

TeoLupus’s data analytics, robotic process automation, artificial intelligence and autonomous AI services in this area also offer value-adding solutions to your organisation. These include examining the full population instead of selecting samples; detecting unusual transactions, fraud and misconduct risks and commercial opportunities; shortening processing times and reducing the risk of error in repetitive transactions with robotic process automation and AI; and, with management’s approval, having certain decisions taken with the help of autonomous AI to reduce workload.

Our boutique way of working rests on defining each company’s needs individually and on the quality of a qualified team: a scope specific to your sector, your company and your team, a specialist team under Partner oversight, and engagement economics that fit a mid-sized company’s budget. Our approach is TeoLupus’s own and incorporates the systematic approach of the international internal audit standards.

When you prepare your internal audit plan for 2027 and beyond, a first conversation is enough to assess together where advisory engagements should sit. You already know which findings should not make it into the report a third time; we suggest talking about how to close them at the design stage.

Is the advisory role of internal audit the same as external management consulting?

No. The advisory role of internal audit covers the recommendations the internal audit function gives within the framework of the internal audit charter and the standards, without taking on management responsibility, and it draws on internal audit’s risk and sector knowledge and experience. Management consulting is a service brought in from outside for a specific problem and usually also takes part in implementation. The two can complement each other, but internal audit’s recommendations always remain bound by the rules of independence and objectivity.

Can internal audit both design and audit a process?

It can comment on the design; designing and running the process is management’s job. If it is going to audit a process it commented on shortly afterwards, safeguards to protect independence are put in place: a different auditor carries out the assurance engagement, independent oversight is set up, and the potential impairment is disclosed to the board. These rules apply equally to companies that receive internal audit through an outsourced or co-sourced model.

We have no internal audit unit. How do we set up the advisory side?

It can be set up through a co-sourced or outsourced model. The first step is to define the scope of assurance and advisory services in an internal audit charter approved by the board. The second is a periodic or annual plan based on a risk assessment that shows the resources set aside for advisory engagements. The third is to communicate this framework to staff; requests only arise for an option people know about.

How do advisory engagements fit into the internal audit plan? What does the board approve?

The board approves two things: in the internal audit charter, the nature and scope of advisory services; in the internal audit plan, the balance between assurance and advisory engagements and the resources allocated to them. If an advisory request that arrives during the year and is not in the plan would disrupt the assurance side of the plan, it is assessed with the board informed.

Does an advisory report count as “approval”? Who is responsible?

No. Internal audit’s advisory output is a recommendation; the implementation decision and the responsibility lie with the relevant manager. Banking regulation states this principle explicitly, and companies in every sector should write it into their own internal audit charter just as clearly. Otherwise units may act on the assumption that “internal audit has looked at it and approved it”, and responsibility becomes blurred.

How long does an advisory engagement take? Who in the company needs to make time?

It depends on the subject. An authority matrix review typically takes two to four weeks and an ERP control design opinion three to six weeks; these are observed ranges, not commitments. On the company side, the process-owning manager and the heads of finance and IT spend a few hours a week. The duration depends on the company’s size, its digital maturity and whether the requested documents are ready. It is also affected by many other factors, such as the complexity of the company’s processes, the density of applicable regulation, corporate culture, organisational structure and staff qualifications.