Latest / VoraPrep Audio — Professional Licensure & Certification Exam Prep / [CIA] CIA3: Internal Audit's Strategic Role in Mergers and Acquisitions
Transcript
- Marcus: Welcome to VoraPrep Audio's Office Hours. Today, we're talking about a topic that's one of the highest-stakes areas for an internal audit function: mergers and acquisitions. Ava: And for good reason. The numbers are pretty staggering. Studies show that something like 70 to 90 percent of M and A deals fail to deliver the value they promised on paper. What’s going wrong? Marcus: It almost always comes down to discovering unforeseen risks after the deal is done. Problems with the target company's culture, their technology, their compliance... the kinds of things a thorough internal audit is designed to find. Ava: So this is a huge opportunity for the Chief Audit Executive, the CAE, to really demonstrate IA’s strategic value. Marcus: Exactly. Getting involved in an M and A transaction isn't just about compliance. It's about directly influencing the success of the future, combined company. But to do that, you have to understand that M and A isn't a single event. It's a lifecycle. Ava: Okay, so let's walk through that lifecycle. Where does it begin, and what's internal audit's first move? Marcus: It starts with the Strategy and Target Identification phase. This is before anyone is even talking about a specific company to buy. The organization is just defining what a good acquisition would even look like. Ava: And the risk here is chasing a deal that doesn't actually fit the business strategy or the culture. So what is audit’s role at this very early stage? Marcus: It’s purely advisory. The CAE advises the board on the risk management framework for evaluating deals in the first place. Think of it as IA helping to build the "ruler" that all potential deals will be measured against. They make sure that ruler aligns with the company's overall risk appetite. Ava: Okay, so IA helps build the evaluation framework. Then, management uses that framework to identify a target company. What’s the next phase? Marcus: This next phase is Due Diligence. And it’s where internal audit's contribution is most critical. This is the intensive investigation of the target company. Ava: This sounds like where IA gets to really dig in. Is this where the role shifts from just advising to more hands-on assurance work? Marcus: It’s a mix of both. The audit team will assess the target's entire governance structure. They'll look at its internal control environment using frameworks like COSO. They'll also review its IT security posture and its compliance with major regulations. The findings here directly impact what the company is worth and how the deal gets negotiated. Ava: You once gave me a great analogy for this. The home inspection. Marcus: That’s the perfect way to think about it. When you buy a house, you hire an inspector. The inspector doesn't tell you whether to buy the house. And they don't negotiate the price for you. Ava: Right. They give you a detailed, objective report on the foundation, the plumbing, the electrical system... all the hidden problems. Marcus: Precisely. That report empowers you, the buyer, to make a smarter decision and negotiate from a position of strength. Internal audit is doing the exact same thing for the "corporate foundation." They assess the governance, risks, and controls to uncover hidden liabilities before the company buys. Ava: I love that. It makes the role so clear. Okay, so IA delivers its "inspection report." What happens next in the lifecycle? Marcus: That leads to the Negotiation and Closing phase. The two companies start hammering out the purchase price and the terms of the deal. Ava: And I assume the risk here is overpaying or agreeing to bad terms because you missed something in due diligence. Marcus: Exactly. So IA's role is again advisory. They provide the negotiation team with a clear, risk-based summary of the issues they found. This isn't just a data dump; it’s targeted insight. Ava: So for example, if IA found weak IT security at the target, they would advise the negotiators to push for specific protections in the contract related to potential data breaches? Marcus: You got it. They might advise them to negotiate for warranties or indemnities to cover that specific risk. Or even to argue for a price adjustment. IA provides the ammunition for the negotiators. Ava: Okay, so the deal is negotiated and closed. The papers are signed. Now the real work begins, right? Marcus: Right. Now we're in the Post-Merger Integration phase. This is the incredibly complex process of combining two organizations—their people, their processes, their systems. The risks are huge. Culture clashes, technology that won't talk to each other, losing key employees. Ava: And a big one for us auditors: a breakdown in internal controls during all that chaos. So what is IA’s job here? Marcus: Now, the role shifts primarily to assurance. The team will audit the integration plan itself to see if it's effective. They'll assess if controls in the newly combined processes are designed correctly. And they'll check if those controls are operating effectively. Think about auditing a major data migration or reviewing how financial reporting is being consolidated. Ava: So they’re making sure the new, bigger house is actually stable and secure. That leads to the final phase, then. Did the deal actually pay off? Marcus: That's the question. The final phase is called Synergy Realization. The goal of any deal is to create value—synergies. These can be cost savings from eliminating duplicate roles, or new revenue from cross-selling products. Ava: But those are just projections when the deal is signed. Someone has to check if they actually happened. Marcus: And that someone is internal audit. The role here is pure assurance. IA performs post-implementation reviews. This gives the board an independent, objective report on whether those projected synergies are being tracked and achieved. It holds management accountable for the promises they made to get the deal approved. Ava: This is so helpful broken down by phase. Can we walk through an example? Let's focus on that last phase, auditing synergy realization. Marcus: Absolutely. Let’s imagine a company, Global Corp, is acquiring a smaller competitor, Regional Inc. The M and A team projects significant financial benefits. Ava: Okay, what do their projections look like? Marcus: They project 10 million dollars in cost synergies from consolidating departments like HR and Finance. They also project 5 million in new revenue synergies from cross-selling. That's a total of 15 million dollars in benefits. Ava: But there are always costs to combine companies. Marcus: Correct. They project 8 million dollars in one-time integration costs. This is for things like merging IT systems and paying severance. So, you take the 15 million in synergies, subtract the 8 million in costs. The deal is approved based on achieving a 7 million dollar net benefit in the first year. Ava: A clear, simple promise: this deal will create 7 million dollars in net value in year one. So, what happens next from an audit perspective? Marcus: Twelve months go by. The CAE puts an audit of the M and A synergy realization on the plan. The audit team’s objective is to provide assurance to the board: was the promised value delivered? Ava: And what do they find? Marcus: They find a significant shortfall. The audit report compares the projections to what actually happened. Actual cost synergies were only 6 million dollars, not 10 million. Actual revenue synergies were just 2 million, not 5 million. Ava: So the total benefits were only 8 million dollars instead of the projected 15 million. That’s a huge miss. What about the costs? Marcus: The costs were also worse than expected. The integration ended up costing 11 million dollars instead of the planned 8 million. Ava: So if you take the actual 8 million in benefits and subtract the actual 11 million in costs... they actually had a 3 million dollar net loss. Marcus: Exactly. The promise was a 7 million dollar gain; the reality was a 3 million dollar loss. The key conclusion internal audit provides to the board is that the acquisition failed to meet its financial objectives. There was a total performance shortfall of 10 million dollars against the plan. Ava: And that is a powerful, high-value finding. What's the trap on the exam in a scenario like this? What's the tempting-but-wrong answer choice? Marcus: The wrong answer would be something like, "The CAE recommends that the managers responsible for the integration be fired." While the results are terrible, making personnel decisions is a management responsibility. Ava: If the CAE did that, they'd be overstepping their authority and impairing their own objectivity. Marcus: That's it. Audit's job is to provide the objective assessment. The board and management decide what to do about it. That distinction is critical on the exam. Ava: It seems like that's the core challenge with M and A questions—knowing the boundaries of internal audit's role. Marcus: It is. The most common pitfall is confusing two different roles. There's audit's independent assurance and advisory role. And then there's management's decision-making responsibilities. Internal audit assesses, evaluates, and advises. Management decides, negotiates, and implements. Ava: So on the exam, I should always ask myself: is this action an objective assessment, or is it a subjective management judgment? Marcus: That is the perfect question to ask. If the answer choice has internal audit making an executive decision—like setting the purchase price or approving the deal—it's always incorrect. Ava: Okay, so that's the big picture pitfall. How can we tie all these phases and roles together into a simple way to remember IA's contribution? Marcus: There's a great mnemonic for this. Just remember the word ADVISE. Each letter stands for a key contribution. Ava: I'm ready. What does the 'A' stand for? Marcus: A is for Assess strategic risks and alignment, which happens right at the start. Ava: Okay. 'D'? Marcus: D is for Drive due diligence on governance and controls. That's the home inspection. Ava: 'V'? Marcus: V is for Validate valuation assumptions and data integrity. Ava: 'I'? Marcus: I is for Inspect post-merger integration plans. Ava: 'S'? Marcus: S is for Scrutinize synergy realization and tracking. Ava: And finally, 'E'? Marcus: E is for Ensure post-merger governance is effective. A-D-V-I-S-E. It covers the entire lifecycle. Ava: That's excellent. Assess, Drive, Validate, Inspect, Scrutinize, Ensure. That really helps pull it all together. You're connecting the theory to exactly how we need to think on exam day. Marcus: That's the goal. And having a structured way to learn and practice these concepts is key. VoraPrep is a full exam-prep app — lessons, practice questions, and an AI tutor in one place. Get started at Vora Prep dot com.