How much is enough?

Internal Auditor, Feb, 2000 by Norman Marks

Without precise, universal guidelines for determining staff size, many internal audit departments aren't sure whether they're too big or too little--or how to justify their numbers to the audit committee and management. At Tosco, audit management has dissected the most significant elements affecting staff size and devised a formula that feels just right.

At a recent meeting of general auditors, one of the participants, the director of audit for a publicly traded company, told the group that he had a staff of only three people to cover the business risks of a rapidly growing, $2 billion company. He knew he was understaffed; but while his audit committee wanted him to add two people, the CEO had vetoed any increase.

At the same event, the general auditor of a much larger company explained that he had been compelled to limit his coverage, since he had only 200 auditors. To address all major business risks, he felt he would need a staff of perhaps 1,000.

Does the first company have too few auditors? Does the second company have too many? Although 200 auditors may seem excessive--even for a massive international corporation--the "right" number may be even more if major business risks are not being audited.

Are the data in benchmarks, such as those provided in The IIA's Global Auditing Information Network (GAIN) study, useful in answering these questions? Should companies measure themselves against those averages? Or should a company's CEO or CFO establish the audit function size based on how much she thinks it is worth?

Unfortunately, no easy answers or simple equations exist for determining the correct number of internal auditors. The variables are many and complex, and they differ from company to company.

At Tosco, our formula for establishing the right size for our audit staff involves elements as wide-ranging as understanding our customers' needs; adding value, as well as addressing risk; staffing strategies; plus the implementation of tools such as CSA, ACL--and imagination. We also integrate external factors such as regulation and competitive pressures into our paradigm. Although we don't claim to have a blueprint that will work for everyone, some of the details of our experience may be helpful to others who wonder just how much internal auditing is enough.

JUST THE RIGHT SIZE?

Every year, the Tosco audit committee asks me whether or not we have sufficient resources. Are we too small to cover all the major business risks and advise the committee on the adequacy of internal control? Has management forced us to cut costs below advisable levels?

The committee members are right to raise these questions. Tosco's 22 internal auditors address the business risks of a $14 billion oil refining and marketing company. Our major brands are 76 Gasoline and Circle K convenience stores. With more than 26,000 employees, we operate a total of seven refineries and 2,400 convenience stores; and we sell gasoline at more than 4,000 locations.

When I compare our staff size and our operating costs to data from the latest GAIN study, we look very small. Exhibits 1 and 2 on page 32 show how we compare against the more than 300 companies in the study, as well as against those in the same industry. Both in terms of employees per auditor and cost as a percentage of net sales, we are dramatically smaller.

In part, these differences can be attributed to our practice of hiring only experienced personnel. In fact, our staff members average 18 years of business experience. As a result, we eliminate much of the overhead cost incurred by more traditional departments, such as those related to supervision, training, and workpaper reviews. Nonetheless, we're clearly not among the giants in terms of numbers.

Are we efficient, or are we understaffed? My answer to the audit committee's question has consistently been that, with our internal resources plus some cosourcing, we have the necessary staffing to:

* Address the areas where we, and management, believe there is the greatest risk of a control weakness--financial, compliance, or operational--that could have a significant adverse effect on the company.

* Proactively participate in controls consulting in areas of change that may have a significant effect on the company, especially new computer systems.

* Provide consulting and operational audit assistance to members of management at the level they are willing to fund.

We audit only critical areas, functions, and processes where both business risk and the opportunity to add value exist; and we audit only to the depth necessary to express an opinion on the adequacy of internal controls over those major business risks. We do not audit much historical detail, only enough to know that the controls are working.

Do I want to grow our staff size? More people would enable more coverage, including the opportunity to dig deeper and to address areas that are not considered likely to have significant control problems--and thus are more likely to contain a surprise. But the answer to the question is "no." As a businessman, I need to ensure that internal auditing costs no more than necessary to meet my customers' needs. Tosco's business interests lie in areas where containing costs is essential for survival. Margins in both refining and retail are wafer-thin. Internal auditing must operate as a business, ensuring that we maximize net value--value less cost--to our customers. If we are not responsive and are seen as either expensive or as representing greater cost than value, we will rightfully become a clear outsourcing target; and I, as General Auditor, am likely to be looking for a "new opportunity."