Internal Audit Struggles as It Attempts to Serve Many Masters

Internal auditors can probably identify with a famous quote by Homer: “If you serve too many masters, you'll soon suffer.”

Under a market-driven mandate to look beyond internal controls, internal audit is finding it tough to determine just where to leverage its expertise and how to act as an advocate for the business, while preserving independence to provide unvarnished assurance.

Getting that balance right is tricky, say those on nearly all sides of the debate, and it's different for every company. Management, audit committees, regulatory demands, and even internal auditors themselves often bring different, sometimes competing, perspectives regarding how the internal audit function can best serve the company's needs.

Apart from new demands on their skills, the traditional workload on internal audit isn't getting any lighter, either. A recent study by Grant Thornton suggests internal auditors have become bogged down in meeting regulatory demands. One-third of chief audit executives said they believed increasing regulation is making it difficult for them to rise above the baseline of assuring regulatory compliance to also provide audit services or advisory services that might help the company improve operations or efficiency.

And then there are the competing ideas about the role and value of internal audit. According to a recent study by PwC, the various groups with a stake in internal audit are operating under different expectations of what internal audit can or should do, and how successful they are in doing it.

The PwC survey, for example, shows nearly 80 percent of board members believe internal audit adds significant value to the company, while only 44 percent of management holds that view. And that gap appears to be growing: In the prior year only 68 percent of board members and 45 percent of management saw significant value. As for internal audit's performance in meeting expectations, only 56 percent of board members and 37 percent of management rank internal audit performance as strong. That metric also declined from the previous year, when 64 percent and 49 percent of directors and managers, respectively, said internal audit preformed at the highest level.

Financial crisis and economic strife have led boards and management alike to call on internal audit to evolve past the internal control checking that marked the Sarbanes-Oxley Act era. They're trying, the data suggests, but are facing new regulatory demands and different performance expectations, making it difficult, says Warren Stippich, partner and GRC leader for Grant Thornton. “Stakeholders have to step back and consider all the competing interests,” he says. “As a deliverer of internal audit, you're darned if you do and darned if you don't when you're trying to build a world-class internal audit function.”

Jason Pett, U.S. internal audit services leader for PwC, says audit committees are generally looking to internal audit to assure compliance with regulatory requirements, while management increasingly wants internal audit to help identify and correct problem with operational effectiveness. “Internal audit has to be a master to all,” he says. “That creates problems. If you're a master to one, there's a clear disconnect in terms of the value you get from the function.”

Denny Beresford, former chairman of the Financial Accounting Standards Board now retired from five corporate boards, says he saw the constant challenge to balance the internal audit function on a “three-legged stool” directed by management, the audit committee, and internal audit itself. With internal audit still reporting to someone within the company for purposes of compensation and performance reviews, internal audit can't be fully independent of management, he says. “Under the best of circumstances, there are communication challenges,” he says.

Pulled in Different Directions

The divergent data on the performance and expectations are disappointing to Bill Watts, principal and internal audit services leader at Crowe Horwath. “Internal audit is not fully positioned today to meet the demands, the perceptions, and the vision of the board,” he says. “It's not necessarily internal audit's fault. The market has shifted so quickly in so many directions.”

“Through interviews, the chief audit executives need to try to boil down what internal audit should be doing. They need a clear theme, and they need to drive alignment early in the year.”

—Jason Pett,

U.S. Internal Audit Services Leader,

PwC

The recent data gives internal audit a new mandate to become more proactive in communicating with both management and the board about where the department is focusing its resources, says Pett. “Through interviews, the chief audit executives need to try to boil down what internal audit should be doing,” he says. “They need a clear theme, and they need to drive alignment early in the year. You're not going to have perfect agreement, but you need alignment.”

In a PwC Webcast to discuss the firm's survey results, John Fazio, who chairs the audit committee at Sequenom and Heidrick & Struggles International, said he doesn't ever expect to see perfect alignment of the expectations and performance assessment of internal audit because management is naturally closer to the process. He says constant communication with the internal audit department is crucial to getting better insight into what's happening.

Fazio, for example, says he gets better insight into the brief highlights in an internal audit report, especially in seeing areas that management would perhaps prefer to gloss over. “When reports are getting sanitized, I will find that out through the communication process,” he says. “Then I know some of the questions I need to ask during an audit committee meeting to bring out some of the points that were written down or reduced a bit because of management sensitivity to them.”

EXPANDING THE EXPECTATION SET

Below are two charts from PwC comparing stakeholder perceptions of internal audit departments with Assurance Provider expectations and those with Trusted Advisor expectations.

Source: PwC.

Sanitizing is perhaps a strong term for Phil Wedemeyer, chairman of the audit committee at Atwood Oceanics, a $1 billion offshore drilling company. “I haven't had a situation that amounted to anything where internal audit was filtering out things that were important,” he says. “I'm sure some have.” Certainly there's always plenty of talk about the reporting structure for internal audit and to what extent it affects what the audit committee sees and hears from internal audit, he says. “Part of their job is to communicate in a way that's comprehensive, not edited, not filtered. If I felt they were doing that, I'd have a real problem with that.”

Wedemeyer definitely sees different expectations from management and the audit committee, with audit committees focused primarily on controls. “I look at that as a bedrock reason for having internal audit,” he says, “to provide independent assurance within the company about how controls are operating.” The idea of trying to drive internal audit to more of an advisory role is perhaps appropriate for larger companies, he says, but companies on the smaller end of the spectrum are more focused on the assurance aspects.