MarcusWelcome to VoraPrep Audio. I’m Marcus.

AvaAnd I’m Ava. Today we’re talking about the internal auditor’s role in strategic planning. And Marcus, this can feel like a high-wire act.

MarcusIt really can. On one hand, we need to be relevant and add value. On the other, the Global Internal Audit Standards demand independence. So how do we engage with something as fundamental as strategy without crossing a line?

AvaThat is the essential question. The stakes are incredibly high. Think about Blockbuster in the early 2000s. They were a giant. When Netflix, a tiny startup, offered a partnership, Blockbuster’s leadership literally laughed them out of the room.

MarcusAnd we all know how that story ended. A catastrophic failure.

AvaExactly. But it wasn't just a bad business call. It was a failure of the strategic planning *process*. They couldn't see or adapt to a major threat. As auditors, our job isn't to be the CEO and make the call. Our job is to provide assurance that the *process* for making that call is sound.

MarcusOkay, so let's start there. When we say "strategic planning," what are we actually talking about? It sounds so abstract.

AvaIt's the formal process for figuring out where the organization is going and how it's going to get there. It starts with the absolute basics, the foundation of the house: the Mission. That’s the organization's purpose, its reason for existing.

Marcus"Why are we here?"

AvaPrecisely. And right alongside that is the Vision. If the mission is why we exist today, the vision is what we aspire to become tomorrow. It's the desired future state.

MarcusSo, 'what we do' and 'what we want to be.' But how does a company make sure its people actually live those ideas?

AvaThrough its Values. These are the core principles that guide everyone's behavior and decisions. They're the non-negotiables.

MarcusOkay, so we have this high-level foundation: Mission, Vision, Values. How does that turn into something the business can actually execute? I can’t audit a ‘vision.’

AvaYou can’t. That’s where Strategic Objectives come in. These translate the vision into concrete targets. And on the exam, you should always think SMART: Specific, Measurable, Achievable, Relevant, and Time-bound goals.

MarcusSo, not just "increase sales," but "increase sales of Product X by 15% in the North American market by the end of the fiscal year."

AvaPerfect. That’s a real objective. And to achieve that objective, management develops Strategies. These are the high-level plans—the 'how.' Are we going to compete on price? On quality? Are we entering new markets?

MarcusAnd the final piece must be the ground-level execution.

AvaThat’s right. Those are the Action Plans. The detailed, operational steps, the budgets, the timelines, the specific people responsible for getting it done.

MarcusSo, it's a full cascade, from the big 'why' of the mission all the way down to a specific team's to-do list. But this brings us back to the high-wire act. If we get involved in any of this, aren't we immediately impairing our independence?

AvaThat’s the trap. And the standards are crystal clear: internal audit must not take on management's responsibility for setting strategy. If we help choose the strategy, we can't objectively audit it later.

MarcusSo how do we help without taking over?

AvaI want you to think of the Chief Audit Executive as a ship's navigator. The captain—that's senior management—and the ship's owner—the board—they decide on the destination. That’s the strategy.

MarcusOkay, they want to sail to the Caribbean.

AvaExactly. The navigator, our CAE, does not choose that destination. But the navigator provides critical assurance for the journey. They check that the maps—the market data—are accurate and up to date. They ensure the navigational equipment—the planning process itself—is working correctly. And they point out hazards on the proposed route—the reefs and storms, which are the strategic risks.

MarcusI like that. We don't steer the ship, but we make sure the captain has a reliable chart and is aware of the dangers.

AvaThat's the role. We're an independent advisor. We're not part of the command crew making the decisions.

MarcusSo, in practical terms, what does a navigator's work look like? What are some appropriate activities for internal audit here?

AvaOne of the biggest is assessing the planning process itself. Is it robust? Did management consider a wide range of scenarios? Did they include the right people in the conversation?

MarcusWe’re auditing the 'how,' not the 'what.'

AvaPrecisely. Another key activity is evaluating the information used. We can review the quality and reliability of the data that management based their decisions on. Is the market analysis sound? Is the competitor intelligence accurate? Are the internal performance metrics trustworthy?

MarcusSo, back to the analogy, we're checking the quality of the maps.

AvaYou got it. We can also facilitate risk identification. We can use our expertise to help management brainstorm the risks associated with their chosen strategy.

MarcusBut we're not telling them which risks are acceptable?

AvaNever. We help them see the potential reefs, but the captain decides whether to take the risk and sail close to them. We simply provide the independent perspective on what those risks are.

MarcusLet's make this real with a scenario. Let's say we're auditors for Urban Retail Co., a clothing retailer. Management just finished their SWOT analysis—Strengths, Weaknesses, Opportunities, and Threats.

AvaA classic strategic planning tool.

MarcusRight. Their strengths are brand recognition and a loyal customer base. A key weakness is an outdated e-commerce platform. For opportunities, they see growing demand for sustainable apparel. And a major threat is intense competition from fast-fashion.

AvaA very common retail picture.

MarcusThe strategy team asks for our feedback. The exam gives us four possible comments from the internal audit team. I want to know which one is MOST appropriate. Option one: "The company should prioritize the sustainable apparel opportunity, as it aligns best with our brand strength."

AvaThat sounds helpful, doesn't it? It's good business advice. But it is absolutely not our role to say that.

MarcusWhy not?

AvaBecause we just chose the destination for the captain. We picked a strategy for management. That's a clear independence impairment. We've crossed the line.

MarcusOkay, crossed off. Option two: "We have validated the data supporting the 'loyal customer base' strength and can confirm its accuracy."

AvaNow, what does that sound like?

MarcusThat sounds like checking the maps. We're not telling them what to do with the information, just confirming that the information itself is reliable.

AvaThat is a perfect example of an appropriate assurance activity. Let's hold onto that one.

MarcusOption three: "To mitigate the supplier dependency weakness, we recommend diversifying to at least three new suppliers in the next quarter."

AvaAnother classic trap. This is prescriptive. We are telling management *how* to run the business. That’s an action plan, which is management's responsibility. We can advise on the *controls* around supplier management, but we can't dictate the operational decision.

MarcusSo, we're not just crossing the line, we're deep in management's territory. Okay, last one. Option four: "The threat from fast-fashion is the most significant risk and should be the primary focus of the new strategy."

AvaAnd there we are prioritizing risks *for* management. We can facilitate the discussion where they rank their risks, but we can't make the final judgment call on which one is most important. That's their decision, their risk to own.

MarcusSo it has to be option two. The only one where we are providing assurance on the information, not making the decision. It feels less impactful, but it's the correct role.

AvaIt's the role that protects our objectivity, which is the ultimate source of our value.

MarcusSo after the SWOT, management uses this analysis to choose a competitive strategy. I know the exam often references Michael Porter’s models.

AvaYes, Porter’s generic strategies are fundamental. The first is Cost Leadership. This is about becoming the lowest-cost producer in your industry. Think of a massive, no-frills retailer.

MarcusAnd how would we audit that?

AvaWe would audit the key controls that enable that strategy. We'd review process efficiency controls, supply chain cost management, and how they control overhead expenses. We’re checking if the engine is built for fuel efficiency, which it must be for that strategy to work.

MarcusWhat’s the opposite of that?

AvaDifferentiation. This is about offering a unique product or service that people are willing to pay a premium for. Think of a luxury car or a high-end tech brand.

MarcusAnd our audit focus there?

AvaIt would shift completely. We'd be auditing controls over R&D, intellectual property protection, brand management, and quality assurance. The things that create and protect the 'uniqueness' they're selling.

MarcusAnd the third strategy is Focus.

AvaRight. This is about concentrating on a very narrow market segment, a niche, and then pursuing either cost leadership or differentiation within that niche. Think of a company that only makes high-performance running gear for elite marathoners.

MarcusAnd again, the audit plan follows the strategy. We’d assess if their risk and control processes are tailored to the specific risks of that niche market.

AvaExactly. The organization’s strategy dictates where the most significant risks are likely to be, which in turn dictates our audit plan.

MarcusThat brings us to strategic risk itself. Every choice, every strategy, creates risk.

AvaIt does. Strategic risk is the risk that your decisions will just be wrong, or that you'll fail to implement them properly, or that you won't respond to changes in the industry—like Blockbuster.

MarcusLet’s go back to Urban Retail Co. If they follow the 'differentiation' path and go all-in on sustainable apparel, what new strategic risks pop up?

AvaSeveral big ones. There's Execution Risk. What if they can't actually source the materials or market the products effectively? They could promise sustainability but fail to deliver, which would be a huge reputational hit.

MarcusThen there's Market Risk. What if sustainability turns out to be a fad, or a competitor does it better and faster?

AvaAbsolutely. And Financial Risk. The ethical sourcing and materials will cost more. What if customers aren't willing to pay that higher price? Margins get crushed.

MarcusAnd I imagine there’s a ton of Compliance Risk.

AvaA huge amount. You’re dealing with complex international labor laws and environmental standards. A failure there could lead to fines, sanctions, and more reputational damage. The CAE sees these big, strategic risks and builds the audit plan around them.

MarcusIt all comes back to that central challenge: providing insight on these risks without taking ownership of them. That seems to be the biggest pitfall.

AvaIt is. The line is crossed when the CAE is in a strategy meeting and votes on an objective, or helps write the mission statement. At that moment, independence is impaired. You can't be a co-creator and an objective evaluator at the same time.

MarcusSo, we need a simple way to remember our proper role when we’re under pressure to "be a team player."

AvaFor that, I use the mnemonic APE. It stands for the auditor's appropriate role in strategy.

MarcusOkay, what is APE?

AvaA is for Assess. Assess the process and the information used. P is for Provide. Provide insights on risks and controls. And E is for Evaluate. Evaluate the framework for monitoring the execution of the strategy.

MarcusAssess, Provide, Evaluate. APE. That’s great. It keeps the focus on our evaluation role, not management’s decision-making role. On the exam, it seems like any answer with verbs like "select," "decide," or "implement" is a red flag.

AvaThat's a fantastic exam-day tip. Those words almost always signal an independence impairment and are likely the wrong answer. The correct answer will use words like "evaluate," "assess," "advise," or "confirm."

MarcusThis is a perfect example of how the exam tests judgment, not just memorizing rules. If you're looking for more lessons that break down these complex topics, VoraPrep is a full exam-prep app — lessons, practice questions, and an AI tutor in one place. You can get started for free. Just go to Vora Prep dot com.

AvaRemember that your independence is your greatest asset. By focusing on the process, the data, and the risks, you provide immense value without ever crossing that critical line. Keep focusing on the 'why' behind the rules, and you'll be well-prepared.

MarcusThanks, Ava. And thank you for listening to VoraPrep Audio.