Get a demo
Get a demo
Demo vereinbaren
Case Study · Internal Audit Management

How a corporate group centrally manages internal audits across more than 100 sites

How centralised governance, local accountability and end-to-end processes make even complex audit programmes manageable. 

Initial Situation Decentralised audits in a complex corporate group

The initial situation – Decentralised audits in a complex corporate group

A large service group with more than 100 sites and approximately 16,500 employees faced the challenge of coordinating internal audits across multiple companies, sites and responsibilities. The group is organised into approximately 30 companies, more than 100 sites and a hybrid model consisting of a central core quality management team and local quality managers.

The sites are spread across the country. The organisation deliberately sees itself as a group of companies with decentralised units and centrally defined standards. The internal audit programme covers a broad spectrum of requirements and standards and aims to audit each site at least once a year.

Key Figures at a Glance


Structure: Approximately 30 companies, over 100 sites, nationwide presence

Employees: Approximately 16,500

Types of Audits: Internal audits, external certification audits, other audit formats in line with Group standards

Audit Volume: Approximately 130 internal audits plus other audit formats

QM model: A central core team plus local quality managers in the units

The Challenge

Limited overarching oversight and transparency

The biggest challenge lay not so much in the individual on-site audits, but in the governance of an extensive audit programme spanning many companies and sites. With more than 100 sites, planning, approvals and reporting increasingly became an organisational challenge that depended heavily on a few key individuals.

Instead of centralised management, the process was dominated by scattered lists, email loops and inconsistent procedures, all of which required significant coordination and offered limited transparency for management. New solutions had to pass through multiple committees and be thoroughly justified from a technical perspective, while requirements for security, compliance and documentation continued to increase.

Typical challenges within the group

A complex group structure with many companies, sites and roles that cannot be fully represented in simple lists.
A complex group structure with many companies, sites and roles that cannot be fully represented in simple lists.
High audit frequency, with each site audited at least once a year, and limited resources for planning, approvals and reporting. 
High audit frequency, with each site audited at least once a year, and limited resources for planning, approvals and reporting.
Information on findings, corrective actions and reports was distributed across different tools. Follow-up depended heavily on individuals.
Information on findings, corrective actions and reports was distributed across different tools. Follow-up depended heavily on individuals.
Increasing requirements for data protection and information security in relation to sensitive audit data. 
Increasing requirements for data protection and information security in relation to sensitive audit data.
"In the past, our IMS team used a huge Excel spreadsheet for planning."

Quality Management and Data Protection Officers at a large corporate group

Requirements for a centralised internal audit management system

As organisational complexity increased, it became clear that internal audit management within the corporate group could no longer be handled through individual decisions and local lists. Instead, a centralised internal audit management system was needed to establish clear governance structures, transparency and accountability across all subsidiaries and sites.

A group and site model that maps companies, sites and roles within a consistent system.
A group and site model that maps companies, sites and roles within a consistent system.
A comprehensive audit process, from planning and execution to corrective action follow-up and evaluation.
A comprehensive audit process, from planning and execution to corrective action follow-up and evaluation.
Clear models for roles and responsibilities that combine centralised governance with local accountability. 
Clear models for roles and responsibilities that combine centralised governance with local accountability.
Management reporting and audit KPIs that give decision-makers an overview of programmes, risks and pending corrective actions.
Management reporting and audit KPIs that give decision-makers an overview of programmes, risks and pending corrective actions.
The Solution

A unified audit process across companies, sites and responsibilities

The corporate group has gradually transitioned its internal audit organisation into a centralised audit management system: first planning, then execution, and finally corrective action follow-up and KPI analysis.

This real-world example therefore illustrates requirements that kameon AUDIT Corporate also addresses: mapping complex group structures, differentiated role models and a shared audit process spanning multiple organisational units

 

Group-wide audit planning with centralised management

Centralised audit planning in the system: sites enter their own audit dates, and the central team consolidates and reviews the plans. 
Centralised audit planning in the system: sites enter their own audit dates, and the central team consolidates and reviews the plans.
Approvals for committees and steering committees are prepared directly from the platform, with clear responsibilities and role-based views.
Approvals for committees and steering committees are prepared directly from the platform, with clear responsibilities and role-based views.
Annual plans can be reviewed systematically; coverage, frequency and responsibilities become transparent.
Annual plans can be reviewed systematically; coverage, frequency and responsibilities become transparent.

The centrally managed planning process is being transformed into a decentralised planning process with clearly defined roles: sites enter their audit dates within defined parameters, while the central team manages coverage, frequency and approvals across the group.

Clear roles and responsibilities

The central quality management team defines standards, programmes and governance requirements, and oversees Group-wide audit planning. 
The central quality management team defines standards, programmes and governance requirements, and oversees Group-wide audit planning.
Local quality managers and site managers are responsible for operational preparation, oversee audits and implement corrective actions. 
Local quality managers and site managers are responsible for operational preparation, oversee audits and implement corrective actions.

A roles and permissions model ensures that local units can view their own data, while central teams receive Group-wide overviews.

A roles and permissions model ensures that local units can view their own data, while central teams receive Group-wide overviews.

This makes it clear internally who is responsible for each part of the audit programme: from central guidelines to local corrective actions. 

Cross-Site corrective action tracking

Corrective actions resulting from audits are recorded centrally in the system, assigned to specific individuals and tracked across multiple audit cycles. 
Corrective actions resulting from audits are recorded centrally in the system, assigned to specific individuals and tracked across multiple audit cycles.
Automated reminders increase accountability and reduce the risk of tasks being lost in day-to-day operations. 
Automated reminders increase accountability and reduce the risk of tasks being lost in day-to-day operations.

Open corrective actions can be analysed across companies, sites and responsibilities.

Open corrective actions can be analysed across companies, sites and responsibilities.
"There is now a completely different level of pressure on the owners, because the system automatically sends out reminders."

Quality Management and Data Protection Officers at a large corporate group

Management reporting and audit KPIs

KPI reports on processing time, pending findings and sites requiring attention are centrally available to management.
KPI reports on processing time, pending findings and sites requiring attention are centrally available to management.
BI dashboards are also used to visually present trends and key areas of focus within the audit programme. 
BI dashboards are also used to visually present trends and key areas of focus within the audit programme.

Management and governing bodies gain a consistent view of the effectiveness of the internal audit programme and critical areas of concern.

Management and governing bodies gain a consistent view of the effectiveness of the internal audit programme and critical areas of concern.

In this way, internal audit management evolves from a mandatory operational requirement into a key management tool for the corporate group.

Balancing central governance with local accountability

Central offices define audit programmes, standards and reporting requirements. Local managers prepare audits, document findings and implement corrective actions. A nuanced role model combines Group-wide transparency with clearly defined local responsibilities.

Results

Greater accountability, transparency and management oversight

From manual coordination to quantifiable benefits 

According to the quality management team, the introduction of the management system reduced internal audit costs from the lower six-figure range to the mid-five-figure range. The greatest efficiency gains do not occur during the audit itself, but in planning, approvals, communication and reporting — precisely where distributed lists and email loops previously dominated. 

At a glance

Clear responsibilities and greater accountability for pending tasks and progress. 
Clear responsibilities and greater accountability for pending tasks and progress.

Group-wide transparency across companies, sites, findings and corrective actions.

Group-wide transparency across companies, sites, findings and corrective actions.
A consistent management view of audit status, processing time and critical areas. 
A consistent management view of audit status, processing time and critical areas.
Conclusion

Internal audit management as a governance function

This real-world example shows that as organisational complexity increases, internal audit management becomes less a matter of individual audits and more a matter of centralised control, clear responsibilities and reliable management information. A unified audit process across all subsidiaries, sites and responsibilities provides the foundation for this.

Instead of scattered lists and individual tracking, a structured audit governance framework emerges that establishes accountability, increases transparency and gives management a solid basis for decision-making. Internal audit management thus becomes a core governance function within corporate groups.

FAQ – Internal audit management in corporate groups

How can internal audits across multiple sites be managed centrally?

Internal audits across multiple sites can be managed through centralised audit planning. Sites enter their own dates, while central teams prepare approvals and systematically review annual plans. Clear responsibilities and role-specific views ensure transparency for management and governing bodies.

How can central governance be combined with local responsibility?

Centralised governance and local accountability can be combined through clear roles and permissions models. Central teams manage guidelines, audit programmes and reporting, while local managers implement corrective actions and update task statuses directly in the system. This ensures that local responsibilities are maintained while the Group remains centrally manageable.

What features should audit software for corporate groups include?

Audit software for corporate groups should map companies, sites, roles and responsibilities within a consistent model. It should organise audit programmes across this structure and take into account both central governance and local responsibilities. This enables complex group structures to be managed transparently and efficiently.

How are open corrective actions tracked across multiple companies?

Open corrective actions are recorded centrally, assigned to responsible parties and tracked across multiple audit cycles. Automated reminders and Group-level management views show where corrective actions are still open, deadlines have been missed or delays have occurred.

Which KPIs are suitable for managing a Group-wide audit programme?

Relevant KPIs include the time taken to address findings, the number of open findings per site or company, adherence to deadlines in audit plans and turnaround times in approval processes. Sites and units that present a risk due to repeated delays in addressing findings can also be analysed.

Why are roles and permissions models important in decentralised audit structures?

A roles and permissions model determines who is authorised to view and edit specific audit data. Local managers are granted access to their own sites, while central teams and management levels can access Group-wide overviews. This supports controlled data processing, clear lines of responsibility and transparent audit governance.

Request a Free Demo

Rethinking audit governance for your corporate group

In an initial consultation, we’ll analyse your audit organisation, group structures, and existing control processes. We’ll then show you how kameon AUDIT Corporate brings together corporate audit planning, corrective action management, and reporting across sites 0and areas of responsibility.

Make an appointment
mbo

 

Learn more and restructure internal audit management within your corporate group.