The Role of the Internal Auditor in the Hospitality Industry

“A man with money met a man with experience – the man with the experience ended up with the money, the man with the money ended up with the experience”. – Anonymous

The above is a quote which I have embraced as my standard working guide ever since I came across it in one of the many books/articles on Internal Auditing. I find that it has a dual meaning and purpose at least in my specific case. It firstly encapsulates the essence and raison d’être of what I do – Internal Audit and secondly it describes as the Italians would aptly say…’a pennello’ what the hospitality business is all about.

Let us face it, although the hospitality sector in Malta is undoubtedly one of the pillars of the economy it is also an industry where competition is particularly intense and keeping up with the Joneses is not a simple euphemism… all this in a never-ending bid to attract clients with money… mind you… globally it is not much better.

Symptomatic of the hospitality environment are words such as luxury, good food and all year entertainment. Whilst however, this may well be the all end game, the reality behind these trademark connotations are endless hours of hard work and increasing operational and financial risks.

What Makes A Hotel Or A Restaurant A Grade Above The Rest?

Is it the quality of food, location, service, room or restaurant décor, staff hospitality or efficiency in dealing with clients’ requirements/complaints whether the latter are on holiday or business? Or is it the overall good experience that the client takes with him/her?

This drives me once again to my guiding quote where the fine balance between a positive or negative experience can be expressed as the correlation between the money paid and the perceived experience that one expects to receive.

Among the major reasons why hospitality companies are being exposed to high levels of risk and possibly fraud is that the industry’s culture frequently emphasises customer service over internal controls.

Hotel or restaurant managers naturally want to spend most of their time meeting and greeting guests rather than authorising purchases, guest refund requests, monitoring check-ins, approving complimentaries, monitoring energy usage or marketing costs, scrutinising payroll costs and the efficient deployment of employees, etc.,

Line employees, supervisors, managers and senior executives are often so narrowly focused and ingrained on getting repeat clients that financial and operational controls inevitably go down the pecking order.

In such an environment, what is the real role of the Internal Auditor – Is it one which should be inward looking and focused solely on the internal environment with emphasis on internal controls and maximisation of returns or should it be outward looking ensuring that the client receives a positive experience through established internal practices that focus on maximising the client experience?

A Balanced Mix Of Both

While customer service is indeed the ultimate factor determining if a hospitality property sinks or swims, neglecting anti-fraud controls is bound to shrink the bottom line… no matter how wonderful guests think their visits are.

The challenge to achieve a balance between the quest for premium customer service and the unavoidable necessity to keep hard-earned revenues from flowing out through exploitation of inadequate internal controls and the loss of potential opportunity for growth is sometimes draconian.

The Biggest Challenge – Growth!

Globally but particularly in Malta hospitality is an industry experiencing both great success and at the same time undergoing tremendous transformation. However, differences in purposes and markets, integrated IT systems and continuously emerging technologies, loyalty programs, challenges associated with increasing concerns over cyber security, terrorism, employment of foreign casual workers, the environment, socio economic concerns, etc., are just a few of the real risks to this industry.

Acquisitive behaviour is driving the need for more shared services and greater integration across systems. Expansion to global markets, demands new ways of approaching operations to address differences in the level and types of products and services.

While this growth is positive, it drives important changes for the way internal audit is conducted. The internal auditor must shift the operational focus, devise and leverage new controls with finite resources and manage risk across a greater number of properties and operators.

By looking beyond processes and controls, the internal auditor can with the holistic knowledge which is garnered through indirect involvement in day to day operational issues [through fieldwork reviews] and direct interaction with management, audit committees and boards play an essential advisory role within the hospitality sector. It can identify enterprise-wide cost efficiencies, provide strategic insights that improve business performance and provide key insights that focus on the risks that matter. This kind of support reaps multiple benefits for the organisation, including enhanced efficiency, and the ability to move more quickly and to take advantage of opportunities.

Technology Is Transforming The Industry On Both Sides Of The Equation

Technology is rapidly changing the way business is analysed and conducted. Integration of systems is critical with data which is available in one place, an advantage at all levels, including increased reliance on cloud technologies to merge and streamline reservation systems and other core back-end functions.

Technology is also changing the face of the customer experience and of loyalty programmes. Customers increasingly want more for less and they want it faster –, Expedia, trivago, etc., are just to mention a few of the game changers. Opportunities abound for the customer to explore what is available and to compare and evaluate not only what is on offer locally but also beyond our shores. These opportunities require new methods not only for securing transactions but also for tracking and assessing them.

Information Is Critical

The amount of information available is both critical and dangerous with the not so remote possibility of easily losing focus in the ever increasing quagmire of data at the disposal of management. The internal auditor needs data to assess ROI, identify patterns and trends around fraud and help the business react to and predict performance – those in the industry would immediately acknowledge that knowing your RGI, MPI, ARI, RevPar, ARR, RevPAC1, cost-of-sales, stock turnover, average spent per guest etc., are all essential benchmarks.

Analytics play an increasing role in mitigating risk, particularly around loyalty programs. If one has smart systems in place, one can continue to transform processes to manage these risks. It takes a broad IT effort, significant investment and a deep understanding of the business process to achieve this. At the same time this transformation is calling for a natural transformation of the internal auditor.

What Is Needed From The Internal Auditor To Realise This Transformation?

The days when the primary focus was on compliance is over and has opened an incredible opportunity and responsibility for the internal auditor to become a critical partner to the industry, helping operators in the market understand if they are going about addressing the changes they face in the right way. This means not only assessing the effectiveness of control and risk mitigation of revenue leakages at the point of sale (POS) or analysing the efficiency and consistent standard of service of outsourcing arrangements (casual/contracted local/foreign employees – have become a common occurrence in Malta) but also participating proactively in the design of new plans and programs.

The internal auditor can provide a measure of reassurance to internal and external stakeholders that internal control frameworks are adequately designed and operating effectively by:

  • Aligning itself with the organisation’s key business objectives;
  • Improving audit efficiency and effectiveness, and streamlining processes to drive cost savings;
  • Offering broader risk coverage and be proactive about current and emerging risks;
  • Enabling cost efficiencies across all functional areas;
  • Identifying and employing the right internal and external skills; and
  • Creating competitive advantage by contributing to sustainable business improvements.

What Are The Pitfalls?

Diversity – The diversity of the complex issues in the hospitality industry right from rate contracting to pricing strategies, market penetration, engineering, marketing, service delivery, security, IT knowledge, etc., are taxing on the internal auditor who is required to keep abreast of the ever-changing developments in these areas if he wants to add value to the organisation.

IT complexity – The complexity of the information systems with different systems used for various processes/departments such as Opera for PMS, Micros for Food & Beverage, Materials Control (MC) for stores/purchasing, SUN or SAP for financials, etc., In the absence of one Enterprise Resource Planning (ERP) platform, auditing various systems can be complex.

Risk profiling – The uncertainties of risk profiling due to the unpredictability of the industry performance increases the difficulty to plan what risks to audit around with completely new risks emerging which can be far from home than one could imagine.

What Are The Opportunities?

One expects that the hospitality industry will continue to transform itself at incredible speed, in both predictable and unexpected ways, well in the future. The internal auditor has an opportunity to exploit this moment and serve as a dynamic partner to the business. He/she is at a vantage point to act as a strong ally who is already well equipped to support and contribute to innovation and change.

It is vital that the internal auditor provides assurance over systems and controls and gives guidance that is both commercial and adds value. Whilst ways to save costs or increase income and meet regulatory and governance needs is a sine-qua-non, one cannot ignore the fact that especially in the hospitality sector the client is the one with the money and the one who ends up with the experience.


  • 1 RGI (Revenue Generated Index), MPI (Market Penetration Index), ARI (Average Rate Index), RevPar (Revenue per Available Room), ARR (Average Room Rate), RevPAC (Revenue per Available Cover)
4.00 avg. rating (82% score) - 1 vote