“Internal auditors can connect the dots across an organization, but they must be better dot connectors,” said Doug Watt, Fannie Mae SVP and chief audit executive, at the recent MetricStream GRC Summit virtual event.
These are challenging times, but they can be a good opportunity for internal audit executives and their teams, noted the panelists during a session entitled, “Auditing in the Era of Crisis and Beyond.”
“This is a tremendous time to be in audit, as we have a great opportunity to demonstrate our relevance and our value,” said Watt. “Audit committees want us to not just look backwards but to be thinking in a forward-looking and well-informed manner and to have a point of view about what risks the company is facing, what could go wrong, and how well prepared they are to address those risks.”
Session moderator Salil Jain, chief client officer for GRC consultant MetricStream, asked panelists which risks and challenges were top of mind during the COVID-19 crisis.
“Liquidity risk has become more crucial now,” said William Onuwa, chief audit executive for RBC Bank. “Learning from the 2008 financial crisis, you want to understand whether you have enough liquidity with the system and the organization.” Onuwa said credit risk resulting from unemployment and government support is another key risk area that varies by entity and industry, and internal auditors need to look more holistically at the models and processes being used to make decisions.
In addition to financial risks, there are significant operational risks. “As more people are working remotely, there is a possibility that process execution falls behind,” Onuwa said. “We are focusing a lot more on risks from changes in work patterns and work locations.” Manual controls become more important in a remote environment and increased cyber-security risks must be managed.
The way work is done is already changing. “From a resource perspective, in the past we have had to be in the office within four walls,” said Gilbert Gitiche, chief audit executive for Freddie Mac. “How you manage working remotely, including interactions with your client and how you deliver your messages, will be critical.”
Internal auditors’ interactions with the business have changed as a result, but the panelists emphasized it is critical to continue to be a business partner and provide real-time advice in the midst of this crisis. To replace human contact, Gitiche and Watt both implemented more frequent informal and formal “touch points” during the work week to allow internal auditors, business teams, and leadership to meet more often and stay connected. In addition, strong technology platforms and collaboration tools allow better connectivity. “We are all in this together, and we’re all figuring out the best way to communicate, but communications need to be quicker and more impactful now,” Watt said.
“One way to continue to be relevant during this crisis is to be nimble and agile in how we adapt and formulate our areas of focus, pivoting our approach and adjusting our programs and methodologies to focus on areas of more risk,” Gitiche said.
Jain asked whether the pandemic has further accelerated the need for use of integrated risk management tools. “The audit of the future is already here in a lot of respects, as we are already employing GRC tools and AI and data analytics tools,” Watt said.
The panelists were excited about using new technologies because it streamlines audit work, makes continuous auditing and monitoring cheaper and easier, and frees up auditors to do more analysis focused on higher risk areas.
“In the audit of the future, an integrated audit is done with good collaboration, with one mind, and a great view of how risks are being managed. Those skill sets are the ones that will be demanded of the auditor of the future.”
Doug Watt, SVP and Chief Audit Executive, Fannie Mae
“The reality is that the auditor of the future is an IT auditor who knows how to audit the business and can give the business process an IT review,” Gitiche said. “It is critical that auditors make the connection between technology and process, but you won’t start reacting to this in the midst of this crisis. You will need to have started before the crisis or learn from it to prepare for the next one.”
The stakes for internal audit organization effectiveness are raised during these unprecedented times. Jain inquired about the implications for the audit organization of the future.
“As we get out of the crisis, we need to continue to look at how our work styles and engagements change,” Gitiche said. “Also critical is how we use and analyze data and make sure it is relevant and how we provide to the board and senior executives perspective that is relevant for making decisions without compromising our independence.”
“A successful audit function will embrace the challenge and rise to the occasion,” Watt said. “In the audit of the future, an integrated audit is done with good collaboration, with one mind, and a great view of how risks are being managed. Those skill sets are the ones that will be demanded of the auditor of the future.”
No comments yet