Role of Internal Auditing is Evolving
Opportunities to Enhance Value Remain
ALTAMONTE SPRINGS, Fla. – Many chief audit executives (CAEs) are exploring strategies for enhancing their organizational value, yet opportunities remain to better align planned audit coverage with risks deemed important by key stakeholders, according to The IIA’s semi-annual Pulse of the Profession report, an assessment of the state of the internal audit profession in North America.
“Now is the time for many organizations to take advantage of the generally stable financial and staffing resources at their disposal after several years of declining resources. Clearly, there are ample ways internal auditors can be of more strategic value to organizational stakeholders,” said IIA President and CEO Richard Chambers, CIA, CRMA, CGAP, CCSA. “As the survey results indicate, 2012 offers tremendous opportunities to further enhance internal auditing’s stature and relevance. However, it’s up to chief audit executives to identify stakeholder expectations and properly align audit plans and priorities.”
Significant realignment already is underway, says the report, which is based on an IIA Audit Executive Center survey of 461 U.S.- and Canada-based audit executives. The report notes respondents’ internal audit plans are reflecting more of a rebalancing of coverage among operational, financial and compliance to more clearly align with the risks related to these areas. This is in stark contrast to much of the past decade – during which audit plans tended to focus on financial risks and controls, and compliance with the Sarbanes-Oxley Act of 2002. For example, 27 percent of respondents’ 2012 internal audit efforts are focused on operating risks. This percentage is notably higher than planned coverage of general financial risks (16 percent), compliance risks (15 percent), and Sarbanes-Oxley testing (12 percent).
Important opportunities remain for further rebalancing the coverage of many internal audit functions in accordance with stakeholder priorities, however. For example, respondents’ coverage of strategic business risks and overall risk management effectiveness remain a low 5 percent and 4 percent, respectively. “I think this inattention to risks that clearly are important to many senior executives and directors is a risk for our profession and for us as professionals. I suggest this is something CAEs will want to keep a finger on the pulse of in their organizations,” Chambers says.
Respondent CAEs are recruiting staff with the experience and capabilities needed to address their evolving audit plans, which signals a significant shift from years past where the overwhelming focus was on accounting and finance skills. For example, the top five skills sought by respondents for staff they plan to hire this year are:
- Analytical and critical thinking (73 percent).
- Effective communication (61 percent).
- Data mining and analytics (50 percent).
- General IT knowledge (49 percent).
- Business acumen (46 percent).
“Understanding the organization’s audit needs goes hand-in-hand with selecting staff who understand the business and can deliver results that provide enhanced value to the organization and internal audit’s stakeholders,” Chambers says. “Whether services are delivered in-house or co-sourced, CAEs need to ensure their audit team’s composite portfolio of skills appropriately complements the organization’s risk and control environment and strategic goals.”
The report says the formal reporting relationships of CAEs continue to reinforce internal auditing’s organizational independence and stature. More specifically, 75 percent of survey respondents now report functionally to the audit committee. When asked to describe their relationship with the audit committee, the leading characterizations are:
- There is open dialogue and a two-way flow of regular communication (76 percent).
- The audit committee clearly communicates its support for the internal audit function to the full board and senior management (72 percent).
- The audit committee looks to the CAE for advice and counsel (50 percent).
Still, survey findings suggest opportunities remain for CAEs and audit committees to strengthen their relationships. “CAEs need to properly identify what issues they bring to the audit committee’s attention,” Chambers points out. “The audit committee’s time is limited and, in many organizations, the amount of time allocated for executive sessions with the CAE is brief, at best.” As a result, Chambers recommends that CAEs take maximum advantage of their time with the audit committee; use executive sessions thoughtfully and proactively; and demonstrate true strategic value, business acumen, and insight.”
However, Chambers notes, maintaining good communication and enhancing internal audit’s role in the organization is a shared responsibility that needs further attention. Less than half (42 percent) of the respondents’ audit committees communicate to the external auditor that it expects a high level of communication and interaction with the CAE. Just 23 percent of respondents say their audit committee ensures management involves the CAE in major strategic initiatives. And less than half of the respondents’ audit committees set the CAE’s annual performance objectives (40 percent) and compensation (32 percent).
The IIA Audit Executive Center’s Pulse of the Profession survey report is available for download on The IIA's website.