Audit Executives Hail From Other Professions, IIA Survey Finds
Chief Audit Executives emerging from non-traditional career paths as audit focus shifts toward strategic risk
ALTAMONTE SPRINGS, Fla. (March 24, 2014) – A growing number of new Chief Audit Executives (CAEs) are recruited from outside the internal audit profession as organizations demand a diversity of business skills to confront emerging strategic risks, according to the latest Pulse of the Profession survey released today by The Institute of Internal Auditors’ Audit Executive Center.
The survey report, “Continually Evolving to Achieve Stakeholder Expectations,” shows that 42 percent of CAEs in North America held positions outside of internal audit immediately prior to becoming CAE. This non-traditional career path, which has its risks and benefits for organizations, aligns with a heightened attention to risk-based planning.
The IIA’s Audit Executive Center conducts the Pulse of the Profession survey annually to assess the state of internal auditing by identifying trends and emerging issues in the profession.
Forty-six percent of the nearly 370 CAEs who responded to this year’s survey rate strategic business risk as the top priority for executive management, while 28 percent consider it the top priority for audit committees. While business strategy remains a relatively small area (6 percent) of the overall audit plan, according to the survey, follow-up interviews with 24 CAEs reveal that internal audit’s approach to audit planning can bridge a perception of misalignment. Successful internal audit functions take into account stakeholder priorities and address them throughout their audit plan.
“Internal auditors must continuously assess the risks facing their organizations and align those assessments with stakeholders’ evolving expectations,” said Richard F. Chambers, The IIA president and CEO. “Our success as a profession is contingent upon not only securing the resources and talent needed to address key risk areas, but also gaining stakeholder trust that our contribution is focused on the right areas.”
As with the emerging CAE career path, competencies for internal auditors are evolving. The Pulse of the Profession survey shows that only 25 percent of CAEs in North America now recruit audit candidates with traditional accounting skills, while 43 percent recruit for business acumen, and 40 percent recruit for industry-specific knowledge. More than 80 percent of CAEs seek new employees with analytical and critical thinking skills, and communications is the second-most demanded competency, at 61 percent.
While the practice of rotating business leaders into the CAE role continues to gain popularity, organizations need to understand the risks as well as the benefits of this trend. CAEs interviewed for the Pulse of the Profession agree that audit executives who come from outside internal audit provide new energy and perspective, deep business knowledge and perspective, and strong internal relationships. On the other side of the discussion, most of those interviewed readily acknowledge that the rotated CAEs’ lack of internal audit experience and inadequate aptitude for governance, risks, and controls could present significant challenges.
Other key findings from the study:
- The “Three Lines of Defense Model,” the model that illustrates the division of responsibilities within an organization’s risk management and internal control functions, is gaining acceptance. However, only 34 percent of CAEs say their organizations have “very clearly defined” essential roles. Based on CAE interviews, organizations generally understand management’s responsibilities, but distinctions are blurred between the second (most commonly risk management and compliance) and third (internal audit) lines of defense.
- Board members are sensitive to risks involving technology, particularly cybersecurity. Indeed, 64 percent of those surveyed indicate board concerns about cybersecurity have increased or significantly increased in the past one to two years. Internal audit’s role in relation to information security involves ensuring that the processes and controls used in these efforts are working effectively.
- Organizations continue to consider internal audit as a critical resource for assurance on risk management and internal controls. In fact, 41 percent of CAEs surveyed predict an increase in internal audit budgets during 2014, while 26 percent project increased staffing. Since 2010, the Pulse of the Profession has reported an optimistic forecast for internal auditing budgets and staffing year after year. Internal auditing continues to sustain pre-recession resource levels in most organizations, indicating continued stakeholder support in terms of overall performance.
“Ultimately, the approach CAEs take when executing their role and managing the internal audit function depends on their understanding of, and alignment with, the expectations of their stakeholders,” Chambers said. “Whether you come from within the profession or not, self-preservation as a CAE begins with understanding the business, applying diversity of experiences, and effectively communicating with your stakeholders.”
A copy of “The Pulse of the Profession North American Report – March 2014: Continually Evolving to Achieve Stakeholder Expectations” can be downloaded from The IIA Audit Executive Center’s website.
About The IIA
Established in 1941, The Institute of Internal Auditors (IIA) is a professional association for internal auditors around the world, with headquarters located in Altamonte Springs, Fla. The IIA serves more than 180,000 members from 190 countries, providing professional development, guidance, and certification. Visit www.theiia.org for more information.
About the Audit Executive Center
An exclusive service developed to support chief audit executives (CAEs) in answering the demands of their evolving roles, the Audit Executive Center empowers its members to perform through delivering unparalleled access to a growing Knowledge Center of nearly 900 pieces of thought leadership and more than 1,200 tools, templates, and planning resources; benchmarking studies and peer-to-peer knowledge sharing opportunities; CPE eligible webinars, roundtables, and networking events; and E-bulletins, news publications, and weekly alerts.