The long, informal history of internal auditing is evolving into its own set of best practices, as regulatory obligations push companies to new extremes of compliance, a comprehensive study has found.
Preliminary results from a first-of-its-kind, global review of internal auditing conducted by the Institute of Internal Auditors shows that the group has neatly positioned itself as the leading voice in a fast-growing profession, with 82 percent of respondents saying they follow, at least in part, the group’s International Standards for the Professional Practice of Internal Auditing (Standards).
That’s a key finding for the IIA, which has watched its membership surge 72 percent during the past five years to 141,000. The IIA was founded in 1941, but internal auditing has long stood in the shadow of other accounting professional associations, such as the American Institute of Certified Public Accountants.
Burnaby
“I actually found it surprising how much compliance there was, especially in emerging countries,” says Priscilla Burnaby, a professor of accounting at Bentley College and one of the lead researchers on the IIA project.
In addition to outreach efforts by the IIA, companies and their auditors are being motivated to embrace best practices by a global push for more stringent corporate governance after several high-profile cases of company fraud, Burnaby says. More stock exchanges are requiring that companies have better internal control structures, and to do that, she says, they need more internal auditors.
The rise of the Internet and the increasing use of shared information online also have heightened companies’ awareness of the need for tight security systems. Internal auditors have the ability to help with control issues related to these processes.
And of course, Burnaby adds, Sarbanes-Oxley has had a huge effect. “A lot of organizations are international today. If they want to list in the U.S., they have to be in compliance with U.S. rules and regulations,” she says. “SOX really affects every entity that deals with the U.S.”
Internal auditors’ overall compliance with IIA standards also underscores an important challenge facing the IIA and the auditing profession as a whole: finding a strategy to ensure that auditing doesn’t allow its fast-growing pace to undermine the quality of the work it is called on to do.
Vincenti
“The profession is not just growing in numbers, but in the expectations of what internal audit should look at,” says Dominique Vincenti, executive director of the IIA Research Foundation. “We have new fields to investigate, and we need to gain enough professionalism quickly to meet the expectations of senior management. The findings about the profession’s fast pace of growth causes a challenge to keep the level of professionalism high.”
Maintaining high standards of consistency and compliance with the IIA’s guidelines will become increasingly important in the next three years as more auditors expect their responsibilities to expand into risk management (almost 80 percent of those surveyed) and corporate governance (63 percent).
Internal auditors worldwide also see rising responsibilities in fraud protection and prevention, disaster recovery, emerging markets, environmental sustainability, executive compensation, and intellectual property.
“A lot of things are going to change and the scope of internal audit is going to get bigger,” Vincenti says.
Mapping Out IA Challenges
The study, known as the Common Body of Knowledge, or CBOK, was commissioned by IIA Research Foundation and conducted around the world in 17 languages. More than 9,300 internal auditors participated in 91 countries. A comprehensive report on the complete findings will be published in October.
The IIA Research Foundation now plans to repeat the CBOK study every three years, to help provide the auditing profession with updated and relevant guidance on an ongoing basis.
To meet the challenges presented by the auditing profession’s fast-paced growth, the IIA says it will continue to examine ways to support its practitioners. The IIA recognizes, for example, that it may need to reduce the amount of time it takes to publish new guidance on issues as they arise, Vincenti says. “We can’t wait,” she says. “Sometimes we have too long of a cycle for developing new things.”
Executives such as chief auditing officers will, in turn, need to focus on retaining and developing staff and finding ways to gather the budgetary resources necessary not only to expand their team but to help them maintain skills and acquire new ones.
“Chief auditing officers will be spending more time on human resource issues,” Vincenti says. “There is a huge shortage [of talent] everywhere, and it’s not going to get better. IA departments worldwide will face the challenge of operating with less-than-optimal staff, both in quality and quantity. Being able to recruit and staff a team with competent people who have the right mix of competencies” will get tougher.
Last year the IIA launched a new academic initiative intended to improve the quality, breadth, and depth of training available to the profession globally. The group reassessed colleges and universities with which it had a relationship, and from that process identified 20 institutions to develop education partnerships with. In particular, four of these institutions, including the University of Pretoria in South Africa, Erasmus Universiteit Rotterdam in The Netherlands, and University of Texas-Dallas and Louisiana State University in the United States, offer a robust curriculum in internal auditing.
The IIA works with other schools in developing their curricula, updating textbooks, and conducting research in the field.
In February 2008 the IIA will also move its certification program, the Certified Internal Auditor system, and three specialty exams onto a computer-based testing platform. The CIA exam tests candidates on their internal auditing competencies and knowledge of the IIA standards. More than 400 sites on six continents will offer this computer-based system, which will make it easier for the IIA to reach its constituents, and do so in the practitioner’s native language. All IIA exams will be offered in 15 languages.
“All the CBOK data we have is going to feed every single business unit of the IIA and its affiliates to revise and reshape the content of what we have,” Vincenti says. “CBOK is going to really be the primary fuel to all the things the IIA is going to do in the next months and years, up until the next CBOK in 2009.”
The IIA last conducted a study in 1996. At that time, only 20 affiliates participated, with a total of 136 responses.
“We moved from that to 91 countries and almost 10,000 respondents,” Vincenti says. “Now we’re sitting on all this data and we can feel the pressure. We cannot waste that. We need to truly use this data for all it can give us.”
No comments yet