The Institute of Internal Auditors released a new report at its international conference in London calling on internal auditors to add more value to stakeholders by enhancing their services.
The IIA's Pulse of the Profession report, “Enhancing Value Through Collaboration: A Call to Action,” examines changing expectations among key internal audit stakeholders, based on the findings of four major industry surveys released in the first half of 2014. It then zeros in on five key strategies to meet those expectations, primarily through communication and collaboration with stakeholders.
“Traditionally, internal audit has been reactionary, but that approach is changing,” IIA president and CEO Richard F. Chambers in the report. “Our value to an organization depends on furthering this change in course.”
The report cites industry surveys that suggest expanding the role of internal audit. Stakeholders are seeking, if not demanding, guidance from internal auditing to address strategic and emerging business risks.
But the report also identifies gaps that are sometimes significant in expectations and confidence in the profession’s ability to deliver assurances and service in new areas. The key to enhancing internal audit services, therefore, is for chief audit executives and other auditing leaders to recognize and address those gaps.
“Every company, situation, and leader is different,” said IIA vice president of professional services Gina Eubanks in the report. “Are you ready to sit down with your stakeholders to understand how they define and measure success of internal audit?”
The report recommended five strategies for internal audit success:
1. Improve upon alignment with expectations of key stakeholders. Setting the tone for alignment by working with stakeholders is imperative. According to KPMG International’s Global Audit Committee Survey, 2014, the first step is to “recognize that internal audit is most effective when it is focused on the critical risks to the business, including key operational risks and related controls—not just compliance and financial reporting risks.”
Chief audit executives, or CAEs, should consider presenting strategic plans, spanning three to five years, laying out changing levels of assurance services and advisory services in accordance to what internal control structures will permit.
2. Assume a leadership role in coordinating the second and third lines of defense. The IIA strongly advocates educating stakeholders on the three lines of defense model— management controls, risk management and internal auditing—for dealing with risk. The IIA’s study found confusion over just where those lines are drawn, which could create an opportunity for expectation gaps to grow. In the IIA’s Pulse of the Profession survey, 64 percent of respondents say those lines are not clearly, somewhat, or moderately defined.
3. Enhance internal auditing’s capability to address critical, strategic business risks. As concerns among key stakeholders, chiefly management, audit committees and boards, shift from traditional controls and finance issues to strategic business risks, internal audit must adapt to meet changing priorities.
For example, KPMG International’s Global Audit Committee Survey, 2014, found respondents wanted the audit function to “devote more time and/or sharpen its focus” on areas outside of the corporate governance area typically associated with the internal audit function. Specifically, respondents say selected management process (65 percent), information technology and data management (58 percent), and operational risks (52 percent), and others well ahead of corporate governance (27 percent).
4. Develop and implement knowledge and talent-acquisition strategies. To expand its responsibilities, the internal audit function must possess the requisite talent in non-traditional areas, such as the risk management process, information technology, and operational risks.
The Pulse of the Profession survey found skills being recruited or built into audit functions were more likely to be general than industry specific. CAEs responding to the survey say they are more likely to recruit based on analytical/critical thinking (75 percent), communications skills (58 percent), risk management assurance (44 percent), and information technology (41 percent) versus industry-specific knowledge (36 percent).
Success hinges on not only identifying the skills to meet these changing demands but also in the recruiting strategies to find workers with relevant skills.
“Acquiring the right people is not the end, it’s the means,” Chambers said, “Acquiring the right people is the means toward having the knowledge and capability in the organization to address a full spectrum of risk.”
5. Become a trusted advisor to the audit committee and executive management. The final strategy is the culmination of successfully carrying out the first four, the report finds. Experienced CAEs who succeed in understanding stakeholder expectations, addressing strategic business risk, and nurturing necessary talent can comfortably form advisory relationships with stakeholders. What’s more, those relationships will make it easier to educate these stakeholders about emerging risks and mitigation strategies.
Speeches and Awards at Conference
The IIA’s international conference opened Monday morning in London with a videotaped welcome message from Prince Charles and general session speaker Alastair Campbell, former communications director for British Prime Minister Tony Blair.
Two longtime members of the profession also were recognized with the prestigious Victor Z. Brink Award for Distinguished Service and the Bradford Cadmus Memorial Award.
Roderick M. Winters was honored on the first day of the three-day conference with the prestigious Victor Z. Brink Award for Distinguished Service. Named for one of the IIA’s founders, the award recognizes outstanding service to the profession.
A member of the IIA since 1994, Winters has held numerous international leadership positions, including serving as the 2009-2010 IIA Global Chairman of the Board. He also served on The IIA’s Global Board of Directors, Executive Committee, and Global Nominating Committee and is currently chairman of the International Conference Committee. Winters was named to the IIA Society Emeritus in 2005. Winters is a former general auditor of Microsoft Corp., and worked 11 years for Deloitte & Touche.
The IIA also awarded Andrew D. Chambers with the Bradford Cadmus Memorial Award for his substantial contributions to the global profession. Chambers is a recognized authority on corporate governance and is founder and general editor of the peer-reviewed journal, Blackwell’s International Journal of Auditing. He is a prolific author, having penned more than 20 books, including Chambers’ Corporate Governance Handbook, now in its fifth edition.
Chambers was a visiting professor of internal auditing for six years at Birmingham City University and a full professor at London South Bank University for 11 years. He is professor emeritus of London’s City University, where he was dean of what is now the Cass Business School. More recently, he was professor of audit and control at the University of Hull.
He has served as an IIA director and as a member of The IIA’s Audit Standards Board. Chambers continues to be a valuable resource on public-sector and professional-issues guidance.