Since Internal Audit departments deploy a structured and risk‑based approach to proving assurance guided by formal internal audit standards, it creates an opportunity for the alignment of these functions and deploying a collaborative or combined assurance relationship that will benefit the Compliance group in developing a sound CMS. For example, Internal Audit are experts in leveraging frameworks for assurance testing (fraud risk management, confidential reporting, etc.) in identifying and assessing risks; documenting and testing the effectiveness of controls; root cause analysis; communicating findings; and validating remediation with control owners. They are also becoming leaders in deploying data analytics, continuous auditing and other technologies to increase efficiencies and effectiveness of providing assurance that would immensely benefit Compliance groups’ use of data for assessing compliance. A measured approach to achieving this alignment could be through secondments of internal auditors to Compliance; combining efforts in compliance testing programs or directly hiring compliance officers with Internal Audit designations and experience.

Regulators expect companies to effectively demonstrate that it has a fully functioning CMS. Executing a compliance program with Excel spreadsheets, manual processes, ad‑hoc practices and under‑skilled Compliance Officers may attract scrutiny from regulators and put the organization at reputational risk with clients, customers or other stakeholders in the event of a compliance failure.
There is a great opportunity for Compliance groups to leverage Internal Audit capabilities and practices in developing, executing and sustaining their own compliance management programs.