Latest internal audit studies suggest path forward for leaders

Like daffodils blooming in springtime, the latest crop of internal audit studies reveal some promising insights into the trajectory of the profession and suggestions to build more momentum.

The debate centers around a key finding in PwC’s annual “state of internal audit” study, which revealed that roughly half of those who have a stake in what internal audit provides see “significant value” in the internal audit function. That suggests, of course, roughly half also do not see significant value emerging from internal audit.

“We saw that as a glass half full instead of a glass half empty,” says Mark Kristall, an internal audit partner at PwC focused on compliance and risk management solutions. Elsewhere in the study, PwC finds roughly half of stakeholders also want to see internal auditors not just as historical scorekeepers, checking boxes on what happened or didn’t happen in compliance with some policy or procedure.

“They want internal auditors to be trusted advisers,” says Kristall. “Stakeholders wouldn’t be asking for more if they weren’t getting value. That’s a rising floor of expectations. It’s stakeholders’ expectations rising as internal audit does more.”

It’s a touchy subject for internal auditors, whose role in public companies has grown and changed over many years. The change has been especially dramatic over the last decade as internal auditors inherited the brunt of the burden to comply with internal controls compliance under Sarbanes-Oxley, then have struggled since to evolve to new responsibilities that provide greater value.

When PwC’s study emerged, headlines focused on the half of stakeholders who don’t see significant value in internal audit, which is a drop from last year’s study. That fails to take in a complete picture of the state of affairs, says Richard Chambers, president and CEO at the Institute of Internal Auditors.

“It is true the bar is being raised for internal audit, as it has continuously throughout the history of the profession. The fact that stakeholders continue to expect more is a good thing, not a bad thing. It’s a natural bend in the road.”

Richard Chambers, President, Institute of Internal Auditors

“It is true the bar is being raised for internal audit, as it has continuously throughout the history of the profession,” says Chambers. “The fact that stakeholders continue to expect more is a good thing, not a bad thing. It’s a natural bend in the road.”

IIA’s latest study revealed nearly a third of corporate internal audit functions added staff in 2016, and roughly the same number plan to add staff in 2017 as well. “I am convinced that today's boards and corporate executives do not spend substantially more on risk, control, and governance processes unless they are getting value,” Chambers observed recently in an IIA blog post.

Looking deeper into the PwC data, the latest study suggests that internal auditors who help organizations navigate disruption are perceived as contributing greater value than those who don’t. The biggest disruptors companies identified where they need help from internal audit is in new regulation, changes to the business model or strategy, cyber-security and privacy threats, financial challenges, and advances in technology. Of significant note, internal controls over financial reporting appear nowhere on the list.

Subscribe | Sign up for a free 10-day trial to sample the benefits of a Compliance Week subscription: the latest print magazine, subscriber-only newsletters, unlimited access to content, and more.

Agility is the key, says Kristall. Internal audit functions that are agile—or adept at identifying emerging risks and shifting audit plans accordingly—are seen in the highest regard. The study suggests 88 percent of stakeholders who describe their internal audit functions as agile also report getting significant value out of internal audit. “That’s a huge number,” he says. “Of all the respondents, 18 percent fall in that agile bucket. Organizational stakeholders want more of that.”

The two key characteristics that seem to make an internal audit function agile are preparation and adaptability, says Kristall. “It’s about getting a little ahead of the curve in business,” he says. “Looking at the talent model a little differently. Looking at the tools and technology enablers. What are you leveraging from the business to understand what’s happening? Do you understand the overall economic environment your company is operating it? What industry trends are impacting your organization? What does that do to your audit plan?”

INTERNAL AUDIT VALUE

Below is an excerpt from PwC’s Internal Audit Profession Study’s executive summary.
Not surprisingly, PwC’s 13th annual State of the Internal Audit Profession Study confirms that Chief Audit Executives (CAEs) remain firm in their desire to grow their value to their organizations. What is perhaps surprising, however, is that Internal Audit appears to be losing ground in trying to keep pace with stakeholder expectations. Stakeholders reporting that Internal Audit adds significant value dropped from 54% in 2016 to only 44% in 2017, reaching its lowest level in the five years we’ve been tracking this metric. Adding pressure to the situation is that half of stakeholders who already receive significant value from Internal Audit indicate that they still expect more value than they are currently receiving. Our study uncovered several factors—including ongoing compliance burdens and pressure to do more with less—that appear to contribute to the decline in perceived internal audit value. The good news is that, despite this, many stakeholders support Internal Audit taking a more value-added role. Internal audit leaders can take advantage of this empowerment and leverage the sponsorship of stakeholders to advance their functions.
Source: PwC

Chambers recently authored a book giving audit leaders some advice on how to evolve from compliance checker to trusted adviser. He explores the key attributes associated with audit leaders who seem to have scaled that mountain successfully, and he identifies nine that seem most common among those leaders.

Those include not only ethical resilience and intellectual curiosity, but also a focus on results and an open mindedness. Such internal audit leaders are good at forming relationships and communicating. They are critical thinkers, and they know how to use technology to their advantage, Chambers observes. “Regardless of the organization you’re in, those characteristics are critical if you want to be a trusted adviser.”

Warren Stippich, national managing partner of quality and risk for advisory services at Grant Thornton, says internal audit is making progress in meeting new mandates from organizations. Where departments might be lacking, he advises leaders to tune in more closely with the mandate of the audit committee. As younger auditors enter the field with their more natural penchant for technology, the internal audit profession is making gains there as well, he says. “And we’re also seeing more audit executives coming from operations,” he says. “That helps drive alignment. That’s a different angle on the value proposition.”

Adapting audit strategy based on study data is also a little tricky, says Dawnella Johnson, a risk consulting partner with Crowe Horwath. “Sometimes value, like beauty, is in the eye of the beholder,” she says. “It can be unique depending on who you’re talking to. That puts internal audit in a challenging position.”

In any given organization, the needs of audit committees and other business leaders will differ and may not even be consistent within a single entity. Some may see internal audit “as a stakeholder to be managed,” Johnson says. “People want internal audit to be a collaborative partner but sometimes internal audit is sidelined in an organization. You may need to do some bridge-building before you have the chance to give insights that people really want you to give. There’s an element of trust and credibility. It’s a lot easier for stakeholders to acknowledge they are getting value when they trust the role of internal audit and feel like they have credible information.”