When Richard Chambers became president of the Institute of Internal Auditors in January, the fears of financial depression and economic collapse were at their worst.
So one of his first projects was a survey probing for changes in internal auditing.
The results, based heavily on a strong response from large companies, revealed a profession shifting radically in response to the business environment and the demands of stakeholders. The survey was followed up by a panel discussion of top-level chief audit executives, service providers and regulators.
"I've been in this profession for 34 years, and when you've been in it this long, you begin to sense the ebbs and flows and twists and turns," Chambers said. "Internal audit tends to be pretty responsive to its stakeholders. This is one of those times."
The times are under the influence of economic stress, uncertainty and new challenges. Internal audit departments have been responding by expanding their coverage from a tight focus on financial risk to a diversified scope not unlike that of the days before the Sarbanes-Oxley Act of 2002, with attention to the risks associated with not only finance, but operations, liquidity, fraud and compliance.
Fortunately, the burden of complying with SOX lessened once companies had established risk assessment systems and associated documentation procedures. But just as internal auditors met that challenge, they were hit with the challenges of a financial crisis.
Forty-seven percent of respondents reported increased coverage of operational risk, and 56 percent foresee more of it in the future. About a third saw increased coverage of compliance risk, and 47 percent said that they have dedicated more resources to cost and expense containment reviews.
The call for more diversified coverage comes just as IA departments are cutting back on budgets. A third have laid off staff. The layoffs, however, are expected to ease the shortage of qualified professionals available.
Steve Donovan, vice president of internal audit and compliance and ethics at UPS, said that his company is among the many that are trying to do more with less. His worldwide budget has remained steady, but it has been cut a bit in the United States. No one has been laid off, but attrition has reduced numbers as people leave but are often not replaced.
Donovan said that the stress of the macro-economic situation has led to an expansion of audit work. The company has been searching for fraud more aggressively, though no increase has been detected. The department is dedicating more attention to enterprise risk management. Internal auditors are also verifying that company procedures are being executed efficiently.
"Internal audit shops have to be more focused on the added value that we bring to our business partners," Donovan said. "It's not just about auditing. It's about auditing, consulting and training. Auditors in today's world have to make sure they get beyond exception reporting and find ways to take their findings and turn them into valuable information, not just data. That turns our job into consulting ... turning into process owners and giving invaluable insight into why things are working or not working as efficiently or properly as the company wants."
Chambers said that the crisis has taught internal auditors a major lesson about the nature of risk - that even probability risk has to be considered. Auditors have traditionally balanced the probability and severity of risk when assessing the need to take action. In many companies, the probability of financial crisis and a near-total freeze on market liquidity was seen as too improbable to prepare for.
"This [crisis] will likely drive a re-examination of how you do a risk assessment," he said. "The idea that something is a very remote possibility doesn't mean you don't prepare for it. We're hearing people say that they're starting to factor in an additional dimension, maybe around velocity - how quickly risks emerge and how quickly you can respond."
At the time the survey was taken, few companies had received stimulus funds or Troubled Asset Relief Program money from the government, so only 45 percent reported auditing associated risks. Such risks include not only compliance but reputation.
"If you're taking these public funds and not being sensitive to things like where you're holding executive retreats and the kinds of benefits you're paying executives, you face reputation risks, which have been very damaging to some companies," Chambers said. "Practices that in a corporate setting wouldn't raise any eyebrows suddenly find themselves on the front page of newspapers."
(c) 2009 Accounting Today and SourceMedia, Inc. All Rights Reserved.
http://www.webcpa.com/ http://www.sourcemedia.com/
