- \n
- What is the advisory role of internal audit?<\/b>\u00a0Giving advice, guidance, input on process design, training and similar non-executive advisory activities, without taking on management responsibility. Its output is a recommendation, not a decision.<\/li>\n
- How is it different from assurance?<\/b>\u00a0In assurance, internal audit sets the scope and provides an independent assessment. In advisory, the scope is agreed with the management that requests it, and the result does not amount to approval.<\/li>\n
- Which companies need it?<\/b>\u00a0Any company that is growing, changing its ERP (Enterprise Resource Planning) system, building a dealer or branch network, moving from a family business to a corporate structure, investing, buying, selling or merging a business, needing a second opinion, or facing similar situations. In short, companies whose control environment cannot keep pace with the business.<\/li>\n
- What if we have no internal audit unit?<\/b>\u00a0The same role can be set up through a co-sourced or outsourced model, within a written internal audit charter and plan.<\/li>\n<\/ul>\n
Without its advisory side, internal audit can risk becoming a partly expensive repeat of the external audit and working below its capacity. Let us start with how that looks inside your company.<\/p>\n
![\"Two](\"https:\/\/teolupus.com\/wp-content\/uploads\/01-advisory-role-of-internal-audit-featured.jpg\" "\\"\\"")
<\/a><\/p>\nIn this article:<\/b><\/p>\n
- \n
- Internal audit that lists findings but gives no direction<\/li>\n
- Assurance and advisory: the two sides of internal audit<\/li>\n
- What do advisory engagements look like in practice?<\/li>\n
- The boundary: how is independence protected during advisory work?<\/li>\n
- Why has the advisory role of internal audit lagged behind in T\u00fcrkiye?<\/li>\n
- How to build internal audit with a strong advisory side<\/li>\n
- What TeoLupus does in this area<\/li>\n
- Frequently asked questions<\/li>\n<\/ul>\n[\/vc_column_text][\/vc_column][\/vc_row][vc_row type=”in_container” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” scene_position=”center” left_margin=”100″ constrain_group_8=”yes” right_margin=”100″ left_margin_tablet=”10″ constrain_group_10=”yes” right_margin_tablet=”10″ text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” id=”orneklem-caginin-sonu” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none” gradient_type=”default” shape_type=””][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” column_position=”default” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][divider line_type=”No Line” custom_height=”40″][nectar_animated_title heading_tag=”h2″ style=”hinge-drop” color=”Accent-Color” text=”Internal Audit That Lists Findings but Gives No Direction: What Does It Look Like in a Company?”][vc_column_text]\nPicture a mid-sized manufacturing and distribution company: three hundred employees, three locations, a family business in which the second generation has joined management. Internal audit is run either by a small in-house team or by an external provider that visits a few times a year. At the end of every period a findings report arrives, and every year it repeats the same three issues: the authority matrix is out of date, the purchasing approval chain is being bypassed, and warehouse count differences cannot be explained.<\/p>\n
This company has internal audit, but it works only in assurance mode. The report correctly identifies that the control is not working. Nobody writes down how the control should be designed, which ERP authorisation should be taken from whom and given to whom, or which step of the counting procedure is missing. Management reads the report like a list of penalties, departments go on the defensive, and processes keep changing without anyone asking internal audit.<\/p>\n
The cost is invisible, but it accumulates:<\/p>\n
- \n
- Budget is spent on the same finding for a third year; over time the internal audit report turns into a cost item and its strategic contribution narrows.<\/li>\n
- Because control design was skipped during the ERP migration, authorisations and approval flows are rebuilt after go-live, which is a correction made at the most expensive stage of the project.<\/li>\n
- As the dealer network grows, contracts and audit arrangements go uncontrolled, and the problem surfaces at the first serious dispute.<\/li>\n
- During a bank or investor review, the impression forms that \u201cthere is internal audit, but it does not improve the business\u201d.<\/li>\n<\/ul>\n
![\"Diagram](\"https:\/\/teolupus.com\/wp-content\/uploads\/02-recurring-finding-loop-diagram.png\" "\\"\\"")
<\/a><\/p>\nThe triggering events are almost always the same: the start of an ERP project, a new dealer or branch model, the handover to the second generation, partnership or investor talks, a fraud case, and so on. In each of them internal audit needs to be at the table at the design stage; if it is not, it writes findings afterwards.
\n[\/vc_column_text][divider line_type=”No Line” custom_height=”40″][\/vc_column][\/vc_row][vc_row type=”in_container” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” scene_position=”center” left_margin=”100″ constrain_group_8=”yes” right_margin=”100″ left_margin_tablet=”10″ constrain_group_10=”yes” right_margin_tablet=”10″ text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” id=”eylemsizligin-maliyeti” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none” gradient_type=”default” shape_type=””][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” column_position=”default” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][divider line_type=”No Line” custom_height=”40″][nectar_animated_title heading_tag=”h2″ style=”hinge-drop” color=”Accent-Color” text=”Assurance and Advisory: The Two Sides of Internal Audit”][vc_column_text]\nThe Institute of Internal Auditors (IIA) is clear: internal auditing is \u201can independent, objective assurance and consulting activity designed to add value and improve an organization\u2019s operations.\u201d What is internal audit<\/a>\u00a0The two words in the definition describe two different jobs. Assurance services and advisory services are carried out by the same or by different teams, under the same standards but with different rules.<\/p>\nIn assurance work, internal audit sets the scope. There are three parties: the manager who runs the process, the internal auditor who carries out the assessment, and the board or senior management who use it. The output is an independent assessment of a process or control. The \u201cpurchasing process audit\u201d in an annual internal audit plan, for example, belongs to this category.<\/p>\n
In advisory work, the scope is agreed with the management that requests it. There are two parties: the internal auditor who gives the advice and the manager who asks for it. The output is a recommendation, which may take the form of guidance, input on process design, a review of a draft policy, an opinion on the risks of an investment before it is made, or training. At no stage does the internal audit unit take on management responsibility; the relevant manager makes the decision and implements it.<\/p>\n
The two sides feed each other. Risk and control information gathered during an advisory engagement flows into the following year\u2019s risk assessment. A new design need that emerges during an assurance engagement becomes a separate advisory engagement through a written agreement. For a mid-sized company, this means getting the design and planning right at the start instead of correcting things after the audit.<\/p>\n
![\"Diagram](\"https:\/\/teolupus.com\/wp-content\/uploads\/03-assurance-vs-advisory-comparison-diagram.png\" "\\"\\"")
<\/a><\/p>\nExpert Note<\/b><\/p>\n
The IIA\u2019s Global Internal Audit Standards<\/b>\u00a0were published on 9 January 2024 and took effect on 9 January 2025<\/b>, replacing the 2017 International Professional Practices Framework (IPPF). Structure: 5 Domains, 15 Principles, 52 Standards. Under the previous framework, advisory (consulting) services were governed by separate \u201cC\u201d implementation standards (1000.C1, 1130.C1, 2010.C1, 2220.C1, 2440.C2 and others); that numbering is no longer in force. The 2024 Standards treat assurance and advisory services within one framework and place the advisory-specific requirements inside the relevant standards: the mandate, the scope of services and the types of services are defined in the board-approved internal audit charter (6.1 Internal Audit Mandate and 6.2 Internal Audit Charter), and the plan must take into account the mandate and all agreed services (9.4 Internal Audit Plan). The Glossary defines advisory services as services through which internal auditors provide advice without providing assurance or taking on management responsibility. The official Turkish translation is published by T\u0130DE as Uluslararas\u0131 \u0130\u00e7 Denetim Standartlar\u0131<\/i>\u00a0(October 2024).
\n[\/vc_column_text][divider line_type=”No Line” custom_height=”40″][\/vc_column][\/vc_row][vc_row type=”in_container” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” scene_position=”center” bottom_margin=”50″ left_margin=”100″ constrain_group_8=”yes” right_margin=”100″ left_margin_tablet=”10″ constrain_group_10=”yes” right_margin_tablet=”10″ text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” id=”kullanim-alanlari” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none” gradient_type=”default” shape_type=””][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” column_position=”default” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][divider line_type=”No Line” custom_height=”40″][nectar_animated_title heading_tag=”h2″ style=”hinge-drop” color=”Accent-Color” text=”What Do Advisory Engagements Look Like in Practice?”][vc_column_text]\nAdvisory engagements are not all of one kind. The IIA\u2019s practice literature distinguishes four types:<\/p>\n- \n
- Formal engagements:<\/b>\u00a0planned work governed by a written agreement.<\/li>\n
- Informal engagements:<\/b>\u00a0committee participation, comments on a draft policy.<\/li>\n
- Special engagements:<\/b>\u00a0participation in an ERP or system transformation team, merger and acquisition reviews.<\/li>\n
- Emergency engagements:<\/b>\u00a0support to a team set up after an extraordinary event.<\/li>\n<\/ul>\n
Each of these has a concrete counterpart in a mid-sized company. The examples below are anonymised composite scenarios:<\/p>\n
- \n
- Control requirements in an ERP migration:<\/b>\u00a0Before moving to a new ERP or upgrading the current version, internal audit gives a written opinion at the design stage on segregation of duties rules, the authority matrix and approval flows. Instead of writing findings after go-live, it records its reservations in the design document. Control design in ERP projects<\/a><\/li>\n
- New dealer model:<\/b>\u00a0As a food brand grows its franchise network from fifteen dealers to sixty, internal audit comments on the audit-rights clauses in the dealer agreement, the turnover verification method and the structure of the dealer audit programme<\/a>.<\/li>\n
- Purchasing authority matrix:<\/b>\u00a0When a manufacturer with three sites resets its approval limits, internal audit assesses whether the limits fit the risk profile and the role definitions in the ERP.<\/li>\n
- Institutionalisation project:<\/b>\u00a0In the move from a family business to professional management, internal audit comments on the new policy and procedure set from the perspective of control points.<\/li>\n
- After a fraud case:<\/b>\u00a0When an incident occurs, internal audit contributes to the design of the whistleblowing line and the preliminary investigation protocol.<\/li>\n<\/ul>\n
In every example the output is of the same nature: a recommendation report, a design opinion or training. It is not an approval. Management makes the decision and implements it; internal audit does not own the process, it gives advice.<\/p>\n
Nor is the knowledge gained in these engagements wasted. Every control weakness noticed during an advisory engagement becomes an input to the following year\u2019s risk assessment and internal audit plan. This is one of the most productive information flows between enterprise risk management<\/a>\u00a0and internal audit.<\/p>\n
![\"Infographic](\"https:\/\/teolupus.com\/wp-content\/uploads\/04-advisory-engagement-types-infographic.png\" "\\"\\"")
<\/a><\/p>\nExpert Note<\/b><\/p>\n
Running advisory engagements within a legitimate and bounded framework depends on two documents. The first is the board-approved internal audit charter<\/b>: under Standards 6.1 (Internal Audit Mandate) and 6.2 (Internal Audit Charter) of the 2024 Standards, the internal audit mandate and the scope and types of services to be provided are defined in this document, which the board approves. The second is the internal audit plan<\/b>: Standard 9.4 (Internal Audit Plan) requires the plan to be based on a documented assessment of the organisation\u2019s strategies, objectives and risks, to take into account the mandate and all agreed services, and to escalate to the board conflicting demands such as replacing planned assurance engagements with advisory ones. The practical consequence: if next year\u2019s internal audit plan has no separate line and no reserved resources for \u201cadvisory\u201d, every advisory request that arrives during the year is time taken from the plan and disrupts assurance work (effective: 9 January 2025).
\n[\/vc_column_text][\/vc_column][\/vc_row][vc_row type=”in_container” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” scene_position=”center” bottom_margin=”50″ left_margin=”100″ constrain_group_8=”yes” right_margin=”100″ left_margin_tablet=”10″ constrain_group_10=”yes” right_margin_tablet=”10″ text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” id=”somut-ornek” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none” gradient_type=”default” shape_type=””][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” column_position=”default” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][divider line_type=”No Line” custom_height=”40″][nectar_animated_title heading_tag=”h2″ style=”hinge-drop” color=”Accent-Color” text=”The Boundary: How Is Independence Protected During Advisory Work?”][vc_column_text]\nThe owner\u2019s first question is a fair one: \u201cIf internal audit both designs the process and audits it, who is auditing whom?\u201d It points to the most misunderstood part of the advisory role of internal audit. The boundary is defined in the standards, and a mid-sized company can apply it with three rules.<\/p>\nRule one: internal audit does not take on management responsibility.<\/b>\u00a0It gives advice, comments on design and provides training, but it does not run the process or make the decision. In an authority matrix review, internal audit says \u201cthis limit is high for your risk profile\u201d; the manager is the one who changes the limit. If this line is crossed, internal audit becomes the owner of a process it built and loses its independence.<\/p>\n
Rule two: advisory is not approval.<\/b>\u00a0\u201cInternal audit has looked at it\u201d does not mean \u201cinternal audit has approved it\u201d. Banking regulation states this explicitly: banks may obtain advisory services from their internal audit unit on new products and procedures, but such advice does not mean the matter has been approved. If this is the principle in sectors governed by external regulation, a mid-sized company outside that regulation should write the same principle into its internal audit charter.<\/p>\n
Rule three: if assurance will be given in an area internal audit helped design, safeguards are put in place.<\/b>\u00a0If internal audit commented on the design of a process, auditing the same process shortly afterwards can impair its objectivity. The safeguards are well established: a different auditor carries out the assurance engagement, an independent oversight arrangement is set up, and the potential impairment is disclosed to the board.<\/p>\n
The same three rules apply to companies that receive internal audit through an outsourced or co-sourced model, and matter even more there. If the same external provider is both advising on process design and providing assurance, the buyer has every right to ask how the teams are separated and how the impairment is disclosed. If that question is never asked, nobody knows how independent the assurance actually is.<\/p>\n
![\"Internal](\"https:\/\/teolupus.com\/wp-content\/uploads\/05-internal-audit-independence-boundary-diagram.png\" "\\"\\"")
<\/a><\/p>\nExpert Note<\/b><\/p>\n
In the 2024 Global Internal Audit Standards, objectivity is covered under Principle 2: 2.1 Individual Objectivity<\/b>, 2.2 Safeguarding Objectivity<\/b>\u00a0and 2.3 Disclosing Impairments to Objectivity<\/b>. Under 2.2, objectivity is presumed to be impaired when an internal auditor provides assurance on an activity for which they had responsibility within the previous 12 months; advisory services on the same activity may be provided, but the potential impairment is disclosed to the party requesting the service before the engagement is accepted. 7.1 Organizational Independence<\/b>\u00a0requires organisational independence to be confirmed to the board at least annually and, when internal audit takes on a non-audit role, the safeguards protecting independence to be documented in the internal audit charter. In Turkish banking, the relevant provision is Article 33 of the Regulation on Banks\u2019 Internal Systems and Internal Capital Adequacy Assessment Process<\/b>\u00a0(Official Gazette 11.07.2014, No.\u00a029057): advisory services may be obtained from the internal audit unit on new products and services, policies and procedures, and the advice given does not mean the matter has been approved. Article 27(3) of the same Regulation requires the internal audit plan to be prepared taking advisory services into account.
\n[\/vc_column_text][\/vc_column][\/vc_row][vc_row type=”in_container” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” scene_position=”center” bottom_margin=”50″ left_margin=”100″ constrain_group_8=”yes” right_margin=”100″ left_margin_tablet=”10″ constrain_group_10=”yes” right_margin_tablet=”10″ text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” id=”surekli-denetim-izleme” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none” gradient_type=”default” shape_type=””][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” column_position=”default” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][divider line_type=”No Line” custom_height=”40″][nectar_animated_title heading_tag=”h2″ style=”hinge-drop” color=”Accent-Color” text=”Why Has the Advisory Role of Internal Audit Lagged Behind in T\u00fcrkiye?”][vc_column_text]\nThe first reason is historical: the legacy of inspection (tefti\u015f<\/i>). Broadly speaking, the inspector is the person who finds errors and holds people to account; the inspector looks backwards and focuses on events and individuals. Internal audit looks at systems and processes, focuses on the future and aims to improve operations. The differences between internal audit and inspection<\/a>\u00a0are set out in a table. In the public sector and banking this shift was launched by legislation on a set date; in the rest of the private sector it has moved slowly and voluntarily.<\/p>\nThe second reason is the legislation itself: internal audit is not mandatory for private companies that are not publicly traded. The Turkish Commercial Code gives the board the duty to establish the financial control system and the power to set up committees for internal audit purposes. It makes the early risk detection committee mandatory for companies whose shares are traded on the stock exchange; in other companies this committee is set up only at the written request of the independent auditor. For public administrations, internal audit is defined by Law No.\u00a05018; for banks, by the regulations of the BRSA (Banking Regulation and Supervision Agency, BDDK<\/i>). For the thousands of mid-sized companies outside this framework, internal audit is a management choice, and for the advisory role there is usually neither an internal audit charter nor a plan. The International Standards for internal audit, and an internal audit charter drafted in line with them, are the right guide here.<\/p>\n
![\"Map](\"https:\/\/teolupus.com\/wp-content\/uploads\/06-internal-audit-obligation-legal-map.png\" "\\"\\"")
<\/a><\/p>\nThe third reason is capability. An advisory engagement demands more than an assurance engagement: process knowledge, ERP knowledge, sector knowledge, knowledge of best practice, field and implementation experience, a project management approach, and the ability to write recommendations in management\u2019s language. When the team is small, companies settle for assurance; advisory becomes the work done \u201cif there is time left\u201d, and there almost never is.<\/p>\n
When these three reasons come together, internal audit stays confined to \u201ccounts, cash and findings, the valuable traditional expectations\u201d. This is not a measured ratio but an observation from within the profession, one that practitioners working with mid-sized companies have voiced for a long time. How the picture changes is a question of model and method.<\/p>\n
Expert Note<\/b><\/p>\n
Traces of internal audit and advisory in Turkish legislation: Law No.\u00a05018 on Public Financial Management and Control, Article 63<\/b>\u00a0defines internal audit as \u201can advisory activity providing independent and objective assurance\u201d; its scope is public administrations. Turkish Commercial Code No.\u00a06102<\/b>\u00a0(Official Gazette 14.02.2011, in force 1 July 2012): Article 375(1)(c) lists establishing the accounting and financial control system among the board\u2019s non-delegable duties; Article 366(2) grants the power to set up committees and commissions for internal audit purposes; Article 378 makes the early risk detection and management committee mandatory for companies whose shares are traded on the stock exchange, and in other companies the committee is set up immediately if the independent auditor deems it necessary and notifies the board in writing. The Capital Markets Board Corporate Governance Communiqu\u00e9 (II-17.1)<\/b>\u00a0(Official Gazette 03.01.2014, No.\u00a028871) contains corporate governance principles on the audit committee for listed companies. None of these provisions imposes an internal audit obligation on a non-listed SME; in such companies internal audit is established by board resolution.
\n[\/vc_column_text][\/vc_column][\/vc_row][vc_row type=”in_container” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” scene_position=”center” bottom_margin=”50″ left_margin=”100″ constrain_group_8=”yes” right_margin=”100″ left_margin_tablet=”10″ constrain_group_10=”yes” right_margin_tablet=”10″ text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” id=”erp-veri-kontrol” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none” gradient_type=”default” shape_type=””][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” column_position=”default” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][divider line_type=”No Line” custom_height=”40″][nectar_animated_title heading_tag=”h2″ style=”hinge-drop” color=”Accent-Color” text=”How to Build Internal Audit With a Strong Advisory Side”][vc_column_text]\nThe advisory role of internal audit can be set up through one of three models: an in-house unit, co-sourcing or outsourcing.<\/p>\n- \n
- In-house unit:<\/b>\u00a0Advisory engagements require investment in process, ERP and sector knowledge, as well as field experience and a project management approach.<\/li>\n
- Co-sourcing:<\/b>\u00a0The in-house team carries out assurance engagements and advisory engagements are mostly sourced from external specialists, or the other way round; the work is carried out by internal and external resources together.<\/li>\n
- Outsourcing:<\/b>\u00a0The whole function is external; oversight by the board or audit committee is essential.<\/li>\n<\/ul>\n
We compared the models in a separate article<\/a>. The real question here is how an advisory engagement works, whichever model is chosen.<\/p>\n
A realistic advisory engagement goes through these steps:<\/p>\n
- \n
- Trigger:<\/b>\u00a0An ERP project, a new dealer model, a revision of the authority matrix, a fraud case and so on. The request comes from management; internal audit does not start the engagement on its own.<\/li>\n
- Written agreement:<\/b>\u00a0Purpose, scope, mutual responsibilities and output are written on a single page. The document states plainly that advisory does not mean approval and that the decision rests with management.<\/li>\n
- Who in the company is involved:<\/b>\u00a0The process-owning manager, finance, IT and, where needed, legal. In a typical engagement these people are asked for two to four hours a week; project-type engagements need more.<\/li>\n
- Which documents are requested:<\/b>\u00a0Process flows, the current authority matrix, ERP role definitions, the policy and procedure set, any earlier internal audit findings and so on.<\/li>\n
- Duration:<\/b>\u00a0An ERP control design opinion takes three to six weeks and an authority matrix review two to four weeks, depending on the complexity of the process, the scope, the organisational structure and so on. These are typical ranges; they vary with the company\u2019s size, digital maturity and corporate culture and are not a commitment.<\/li>\n
- Output:<\/b>\u00a0A recommendation report, a design note or an identified training need. Every output states which recommendation addresses which risk and that the implementation decision belongs to management.<\/li>\n
- Follow-up:<\/b>\u00a0Implementation is management\u2019s job. Internal audit may provide assurance in the same area in a later plan period, under the conditions described in the boundary section above. With co-sourcing<\/a>, it may be possible for the external resource to take on implementation work.<\/li>\n<\/ol>\n
This flow has one precondition: the advisory request comes from management, and management only asks if it knows the option exists. If the advisory scope is not written into the internal audit charter and has not been communicated to staff, no requests arise and the advisory role stays on paper.<\/p>\n
The analytical capacity of internal audit is also decisive in advisory engagements. Detecting conflicting authorisations in ERP role definitions, verifying dealer turnover data or screening purchasing approval exceptions can, with data analytics, often be completed in days instead of weeks. In later stages of data analytics, projects such as advanced analytics, artificial intelligence and autonomous AI can be planned; this capacity directly affects how deep an advisory engagement can go. Where in-house capacity is not sufficient in these areas, co-sourcing or outsourcing under the board\u2019s oversight can be considered.<\/p>\n
![\"Flow](\"https:\/\/teolupus.com\/wp-content\/uploads\/07-advisory-engagement-flow-diagram.png\" "\\"\\"")
<\/a>
\n[\/vc_column_text][\/vc_column][\/vc_row][vc_row type=”in_container” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” scene_position=”center” bottom_margin=”50″ left_margin=”100″ constrain_group_8=”yes” right_margin=”100″ left_margin_tablet=”10″ constrain_group_10=”yes” right_margin_tablet=”10″ text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” id=”teknik-uygulama” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none” gradient_type=”default” shape_type=””][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” column_position=”default” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][divider line_type=”No Line” custom_height=”40″][nectar_animated_title heading_tag=”h2″ style=”hinge-drop” color=”Accent-Color” text=”What TeoLupus Does in This Area”][vc_column_text]\nTeoLupus is an Istanbul-based assurance and management advisory firm working across T\u00fcrkiye with mid-sized companies, family businesses and growing groups. Our internal audit services<\/a>\u00a0aim to build and establish both sides described in this article together: running assurance engagements on a risk-based plan, and positioning advisory engagements within the same plan with their boundaries defined in writing.<\/p>\nIn concrete terms, we do the following:<\/p>\n
- \n
- Establishing the internal audit unit:<\/b>\u00a0Preparing the internal audit charter and the charters of the board\u2019s risk and audit committees, writing the nature and scope of advisory services into these documents, building a risk-based internal audit plan, and selecting and training the team.<\/li>\n
- Co-sourced and outsourced internal audit:<\/b>\u00a0Carrying out assurance and advisory engagements within an annual plan, without you having to build your own unit, or by complementing your existing one. Both models are a live option alongside in-house capacity.<\/li>\n
- Bringing advisory engagements into the plan:<\/b>\u00a0Opening an advisory line in your existing internal audit function\u2019s plan for 2027 and beyond, and designing the balance between assurance and advisory in a form that can be presented to the board.<\/li>\n
- Quality Assurance and Improvement Programme:<\/b>\u00a0Periodic assessment, against the international professional practices framework and the International Standards for internal audit, of whether advisory engagements are carried out in line with the objectivity rules.<\/li>\n<\/ul>\n
TeoLupus\u2019s data analytics, robotic process automation, artificial intelligence and autonomous AI services in this area also offer value-adding solutions to your organisation. These include examining the full population instead of selecting samples; detecting unusual transactions, fraud and misconduct risks and commercial opportunities; shortening processing times and reducing the risk of error in repetitive transactions with robotic process automation and AI; and, with management\u2019s approval, having certain decisions taken with the help of autonomous AI to reduce workload.<\/p>\n
Our boutique way of working rests on defining each company\u2019s needs individually and on the quality of a qualified team: a scope specific to your sector, your company and your team, a specialist team under Partner oversight, and engagement economics that fit a mid-sized company\u2019s budget. Our approach is TeoLupus\u2019s own and incorporates the systematic approach of the international internal audit standards.<\/p>\n
When you prepare your internal audit plan for 2027 and beyond, a first conversation<\/a>\u00a0is enough to assess together where advisory engagements should sit. You already know which findings should not make it into the report a third time; we suggest talking about how to close them at the design stage.
\n[\/vc_column_text][\/vc_column][\/vc_row][vc_row type=”in_container” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” scene_position=”center” bottom_margin=”50″ left_margin=”100″ constrain_group_8=”yes” right_margin=”100″ left_margin_tablet=”10″ constrain_group_10=”yes” right_margin_tablet=”10″ text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” id=”sss” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none” gradient_type=”default” shape_type=””][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” column_position=”default” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][divider line_type=”No Line” custom_height=”40″][nectar_animated_title heading_tag=”h2″ style=”hinge-drop” color=”Accent-Color” text=”Frequently Asked Questions”][vc_column_text]\nIs the advisory role of internal audit the same as external management consulting?<\/h3>\n
No.\u00a0The advisory role of internal audit covers the recommendations the internal audit function gives within the framework of the internal audit charter and the standards, without taking on management responsibility, and it draws on internal audit\u2019s risk and sector knowledge and experience. Management consulting is a service brought in from outside for a specific problem and usually also takes part in implementation. The two can complement each other, but internal audit\u2019s recommendations always remain bound by the rules of independence and objectivity.<\/p>\n
Can internal audit both design and audit a process?<\/h3>\n
It can comment on the design; designing and running the process is management\u2019s job. If it is going to audit a process it commented on shortly afterwards, safeguards to protect independence are put in place: a different auditor carries out the assurance engagement, independent oversight is set up, and the potential impairment is disclosed to the board. These rules apply equally to companies that receive internal audit through an outsourced or co-sourced model.<\/p>\n
We have no internal audit unit. How do we set up the advisory side?<\/h3>\n
It can be set up through a co-sourced or outsourced model. The first step is to define the scope of assurance and advisory services in an internal audit charter approved by the board. The second is a periodic or annual plan based on a risk assessment that shows the resources set aside for advisory engagements. The third is to communicate this framework to staff; requests only arise for an option people know about.<\/p>\n
How do advisory engagements fit into the internal audit plan? What does the board approve?<\/h3>\n
The board approves two things: in the internal audit charter, the nature and scope of advisory services; in the internal audit plan, the balance between assurance and advisory engagements and the resources allocated to them. If an advisory request that arrives during the year and is not in the plan would disrupt the assurance side of the plan, it is assessed with the board informed.<\/p>\n
Does an advisory report count as \u201capproval\u201d? Who is responsible?<\/h3>\n
No.\u00a0Internal audit\u2019s advisory output is a recommendation; the implementation decision and the responsibility lie with the relevant manager. Banking regulation states this principle explicitly, and companies in every sector should write it into their own internal audit charter just as clearly. Otherwise units may act on the assumption that \u201cinternal audit has looked at it and approved it\u201d, and responsibility becomes blurred.<\/p>\n
How long does an advisory engagement take? Who in the company needs to make time?<\/h3>\n
It depends on the subject. An authority matrix review typically takes two to four weeks and an ERP control design opinion three to six weeks; these are observed ranges, not commitments. On the company side, the process-owning manager and the heads of finance and IT spend a few hours a week. The duration depends on the company\u2019s size, its digital maturity and whether the requested documents are ready. It is also affected by many other factors, such as the complexity of the company\u2019s processes, the density of applicable regulation, corporate culture, organisational structure and staff qualifications.
\n[\/vc_column_text][\/vc_column][\/vc_row][vc_row type=”in_container” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” scene_position=”center” left_margin=”100″ constrain_group_8=”yes” right_margin=”100″ left_margin_tablet=”10″ constrain_group_10=”yes” right_margin_tablet=”10″ text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” id=”kaynakca” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none” gradient_type=”default” shape_type=””][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” column_position=”default” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][divider line_type=”No Line” custom_height=”40″][vc_column_text css=”.vc_custom_1793137067957{padding-top: 20px !important;}”]\nReferences<\/h2>\n
- \n
- The Institute of Internal Auditors (IIA). Global Internal Audit Standards<\/a><\/i>. Published 9 January 2024; effective 9 January 2025. Turkish translation: T\u00fcrkiye \u0130\u00e7 Denetim Enstit\u00fcs\u00fc (T\u0130DE), Uluslararas\u0131 \u0130\u00e7 Denetim Standartlar\u0131<\/i>\u00a0(K\u0131rm\u0131z\u0131 Kitap), October 2024.<\/li>\n
- T\u00fcrkiye \u0130\u00e7 Denetim Enstit\u00fcs\u00fc (T\u0130DE). \u0130\u00e7 Denetimin Tan\u0131m\u0131<\/a><\/i>\u00a0(Definition of Internal Auditing)<\/a>. In Turkish.<\/li>\n
- Turkish Commercial Code No.\u00a06102<\/a>\u00a0(T\u00fcrk Ticaret Kanunu<\/i>). Official Gazette 14.02.2011, No.\u00a027846; in force 1 July 2012. Articles 366, 375, 378. In Turkish.<\/li>\n
- Law No.\u00a05018 on Public Financial Management and Control<\/a>\u00a0(Kamu Mal\u00ee Y\u00f6netimi ve Kontrol Kanunu<\/i>). Official Gazette 24.12.2003, No.\u00a025326. Article 63. In Turkish.<\/li>\n
- Capital Markets Board of T\u00fcrkiye (SPK). Corporate Governance Communiqu\u00e9 (II-17.1)<\/a><\/i>. Official Gazette 03.01.2014, No.\u00a028871. In Turkish.<\/li>\n
- Banking Regulation and Supervision Agency (BDDK). Regulation on Banks\u2019 Internal Systems and Internal Capital Adequacy Assessment Process<\/a><\/i>\u00a0(Bankalar\u0131n \u0130\u00e7 Sistemleri ve \u0130\u00e7sel Sermaye Yeterlili\u011fi De\u011ferlendirme S\u00fcreci Hakk\u0131nda Y\u00f6netmelik<\/i>). Official Gazette 11.07.2014, No.\u00a029057. Articles 23, 27, 33. In Turkish.<\/li>\n<\/ul>\n
This content is for general information only and does not constitute legal, financial or audit advice. Please contact us for an assessment specific to your company.<\/i>
\n[\/vc_column_text][\/vc_column][\/vc_row]\n","protected":false},"excerpt":{"rendered":"[vc_row type=”in_container” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” scene_position=”center” left_margin=”100″ constrain_group_8=”yes” right_margin=”100″ left_margin_tablet=”10″ right_margin_tablet=”10″ text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none” gradient_type=”default” shape_type=””][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default”…<\/p>\n","protected":false},"author":4,"featured_media":9997,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[265,1083],"tags":[],"class_list":["post-10014","post","type-post","status-publish","format-standard","has-post-thumbnail","category-article","category-ultimate-guide"],"_links":{"self":[{"href":"https:\/\/teolupus.com\/en\/wp-json\/wp\/v2\/posts\/10014","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/teolupus.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/teolupus.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/teolupus.com\/en\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/teolupus.com\/en\/wp-json\/wp\/v2\/comments?post=10014"}],"version-history":[{"count":2,"href":"https:\/\/teolupus.com\/en\/wp-json\/wp\/v2\/posts\/10014\/revisions"}],"predecessor-version":[{"id":10016,"href":"https:\/\/teolupus.com\/en\/wp-json\/wp\/v2\/posts\/10014\/revisions\/10016"}],"wp:attachment":[{"href":"https:\/\/teolupus.com\/en\/wp-json\/wp\/v2\/media?parent=10014"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/teolupus.com\/en\/wp-json\/wp\/v2\/categories?post=10014"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/teolupus.com\/en\/wp-json\/wp\/v2\/tags?post=10014"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
- T\u00fcrkiye \u0130\u00e7 Denetim Enstit\u00fcs\u00fc (T\u0130DE). \u0130\u00e7 Denetimin Tan\u0131m\u0131<\/a><\/i>\u00a0(Definition of Internal Auditing)<\/a>. In Turkish.<\/li>\n
- Co-sourced and outsourced internal audit:<\/b>\u00a0Carrying out assurance and advisory engagements within an annual plan, without you having to build your own unit, or by complementing your existing one. Both models are a live option alongside in-house capacity.<\/li>\n
- Written agreement:<\/b>\u00a0Purpose, scope, mutual responsibilities and output are written on a single page. The document states plainly that advisory does not mean approval and that the decision rests with management.<\/li>\n
- Co-sourcing:<\/b>\u00a0The in-house team carries out assurance engagements and advisory engagements are mostly sourced from external specialists, or the other way round; the work is carried out by internal and external resources together.<\/li>\n
- New dealer model:<\/b>\u00a0As a food brand grows its franchise network from fifteen dealers to sixty, internal audit comments on the audit-rights clauses in the dealer agreement, the turnover verification method and the structure of the dealer audit programme<\/a>.<\/li>\n
- Informal engagements:<\/b>\u00a0committee participation, comments on a draft policy.<\/li>\n
- Formal engagements:<\/b>\u00a0planned work governed by a written agreement.<\/li>\n
- How is it different from assurance?<\/b>\u00a0In assurance, internal audit sets the scope and provides an independent assessment. In advisory, the scope is agreed with the management that requests it, and the result does not amount to approval.<\/li>\n