Internal Auditors: A Call to Action
The study finds that internal audit budgets and resource levels are beginning to stabilize, which is good news for so many audit shops that have been stretched too thin during the past few years. Also, as organizations recruit to fill key internal audit positions in 2012, they're searching for something a little different than past years. They want internal audit candidates not only with IT, risk management, and data mining capabilities, but, more importantly, with business acumen, analytical, critical thinking and communication skills.
The survey indicates that strategic risks are a new and critical priority for internal auditors. Studies show that strategic risks present the greatest threats to shareholder value, an area that internal auditors frequently overlook. According to the Emerging Trends study, only 57 percent include strategic risk assessments in their annual risk assessment. More than a quarter of respondents concede that their internal audit organization does not formally identify or assess strategic risks.
One of the keys to meeting our stakeholders' needs is to assess and align with their expectations.
According to the study, the coming year marks the fourth straight year that we'll see half of all internal audit groups increase their focus on operational risks. In fact, the only area that seems to be decreasing in importance in the audit plan is Sarbanes-Oxley.
As internal auditors, we have good reason to be proud - to view the proverbial glass as "half full." We have weathered the storm well. Our stature remains strong. We can look forward to a future with ample resources - a future where we are trusted and valued. But, why stop there? Perhaps this is the time to keep filling our glass - to do even more to position ourselves as the indispensable value-adding activity that we know internal auditing to be.
We must ask ourselves, "Are we doing our absolute best to meet our stakeholders' needs?" There's probably room for improvement. Many chief audit executives (CAEs) still lack a seat at the table during top-level discussions on strategic risks and strategic risk management, despite the fact that these are the areas of increased focus for boards, senior management and regulators. In some cases, unfortunately, this may result from a mistaken view that auditors have a narrow view of strategic risks. A full 82 percent of internal auditors state they assess the system of controls in new strategic initiatives - but only nine percent say they assess the propriety or correctness of the strategy and a mere eight percent provide an opinion on the strategic risk management process. Obviously internal auditors must assess and report on internal controls. But evaluation of strategic issues extends well beyond assessing controls, and when an underlying strategy is inherently flawed, assessing the associated controls might not be senior management's most essential consideration.
One of the keys to meeting our stakeholders' needs is to assess and align with their expectations. Without a clear understanding of stakeholder expectations, internal auditors are limited in their ability to meet stakeholder needs or to resolve issues caused by conflicting expectations. The Emerging Trends study finds that most internal audit groups learn of their stakeholders' needs by having ongoing informal discussions with the audit committee chair, holding regular formal meetings with key stakeholders, or having discussions with the full audit committee. Less common strategies for assessing stakeholder needs include conducting formal surveys of stakeholders and gathering the full executive leadership/management team in the same room to assess collective expectations and performance.
In the end, researchers identify five imperatives for forward-thinking CAEs to implement:
- In addition to finding candidates with the right technical competencies, proactively seek professionals with business acumen who are good communicators and have proven analytical and critical thinking skills.
- Encourage existing staff to become strategic players in cross-organizational initiatives and other projects to help elevate the stature of the internal audit department as a business partner.
- Revisit the balance of focus on operational, compliance, fraud, and strategic risks versus financial risks.
- Identify the needs of stakeholders on an ongoing basis and assess how well positioned you are to meet or exceed these evolving needs.
- Be part of executive and board-level discussions on strategic risks and strategic risk management.
In the spirit of filling our internal audit glass beyond half-full, I'd like to add one more imperative to this list. I encourage CAEs to not be satisfied with the progress our profession has made thus far, but to demand more - to push for a seat at the table during top-level strategic discussions, and to ensure that audit efforts are devoted to the key areas, initiatives and processes that are of vital importance to their organization's ongoing success.
Chambers is the global president and CEO of The Institute of Internal Auditors.