The corporate and regulatory environment has changes so much in the past several years that it has made internal audit leaders everywhere take stock of their own programs and get a fresh understanding of what their greatest new challenges and opportunities might be. One thing is for certain: Chief audit executives cannot rest on what they have done in the past. Chief audit executives need to look ahead and see what risks are developing and help their organizations build a proper response to them.
To examine this further, we spoke with Doug Anderson, former corporate auditor for Dow Chemical, who has joined the Institute of Internal Auditors as its new managing director for CAE solutions. Doug spoke to the challenges of helping to drive internal audit to be more forward-looking, how to properly harness the power of technology, dealing with shortages of personnel, and more.
How does an internal audit leader become more forward looking?
Hindsight is very much the purview of internal audit. That’s how we were trained. By scope, we have also been looking at things that happened in the past. But internal audit should not be limited in that way. We’re looking at whether risks are being properly managed in the organization with the right risk mitigation techniques. That’s very much real time, so it should be forward-looking.
It takes the right leadership to scope out the audit work in the right way and assure people are not stuck in the mindset of only looking at the past. It takes chief audit executives and directors that can turn the battleship around if it is heading in the wrong direction. You have to set the stage and have the right culture, and that could very well mean changes in people. The scope of the audit is not just about seeing if all the transactions had the right pre-approvals, but whether this system of controls is going to make sure we don’t do something seriously wrong.
Does that mean more use of data or data analytics?
Data is an important part of it. It’s so much easier for organizations to gather huge quantities of data, and computing power is so much more accessible to crunch the data. It’s a different dynamic than it was 10 years ago. The CAE should be asking whether the organization is handling and collecting the right data for the right reasons. Is the organization using data appropriately, or just cherry picking it and analyzing it to support strategic decisions? That’s something internal audit needs to explore.
ABOUT DOUG ANDERSON
Former Dow Chemical corporate auditor and internal auditing educator Doug Anderson, CIA, CRMA, is the managing director for CAE solutions at The Institute of Internal Auditors.
Anderson’s focus is on serving the unique needs of chief audit executives across all of The IIA’s product and service offerings.
In addition to extensive corporate experience, which included overseeing a staff of 73 at Dow’s global internal audit function, Anderson brings an impressive volunteer and teaching history to the post. Most recently, he was an accounting and finance executive-in-residence at Saginaw Valley (Mich.) State University and served as a consultant to the AEC.
Indeed, Anderson has been a high-profile ambassador for the profession, serving on the Standing Advisory Group of the Public Companies Accounting Oversight Board (PCAOB) and the COSO ERM Update Project Advisory Group. He also served on The IIA’s Board of Directors Executive Committee, The IIA’s North American Board of Directors, and as chairman of The IIA’s Professional Issues Committee. He was a member of both the Common Body of Knowledge (CBOK) and IPPF Relook committees.
Internal auditors are fairly good at looking at data, but how can we harness the power of data analytics to help us accomplish what we are trying to do? Data can tell you a lot about the risks that are present in a company. Data can also cut out manual audit procedures, using data to replace testing that is maybe not adding a lot of value.
There are some that have this view that data analytics is going to retire traditional auditing—that we will all have this big computer that is auditing everything in real time. I’m not sure I believe that. I’m more about how data is focusing auditors’ attention rather than replacing auditors.
It’s no secret that the internal audit profession is understaffed. What’s the solution to that ongoing problem?
When I was a chief audit executive, I got some heat because I was perennially understaffed. The audit committee challenged me on it. I can commiserate with the problem, but you can’t accept people who can’t do the job. Hiring the wrong people leads to crummy work, and then you lose stature in the organization. If you have an internal audit function that has a good reputation for taking care of people, for giving them exciting and interesting work, then you can start drawing people within the organization into internal audit. Build a culture so you can attract people internally. They understand the business well. You can train them on the audit activities. You have to invest in them. Good internal audit people are pricey. The only thing more expensive is hiring the wrong person. Hold out for the right person and go to third parties to fill the gaps.
When resources are constrained, how do you make the case for a bigger budget to invest in people this way?
The proper order here is to prove your value, and then you will get the resources you need. Focus on the most important things, and show the value. So if someone wants you to audit the employee cafeteria, that’s not going to excite anyone, and there’s no real risk there. So drop that off the audit plan. Include in the scope the most important, impactful issues in the company. Take that to the audit committee, and bring insight, not just hindsight. Provide more insightful observations, and then start talking about the things you’d like to do that you don’t have the resources to do. Say very transparently: this is what I can get done, and this is the stuff I can’t do because of a lack of resources. If the audit committee is comfortable with that, that’s their call.
The problem is when the CAE isn’t transparent about that and tries to operate under the fiction that everything is getting done without the resources to do it. You have to change the quantity of audit work, not the quality. The quality has to be there to provide value to the organization. I’m a very strong believer that if you do quality audit work, then it’s the audit committee’s call as to how much more they want to resource you. It’s a scope discussion, not a resource discussion.
Surveys have suggested internal auditors are not adequately independent within their organizations. How should the CAE approach that concern?
Every chief audit executive needs a champion within who values independence and objectivity for the internal audit function. That can be the CEO or the CFO, and of course an audit committee that supports internal audit as well. It’s not just about reporting structures. You can have the right reporting structure and have serious challenges to independence and objectivity, and you can have the wrong reporting structure and have excellent independence and objectivity. As long as the chief audit executive is tied into the strategy and leadership of the company, is attentive to objectives, and has the support of the board, it can work.
Relationships are critical for the chief audit executive. If you have the right relationships, that helps you establish independence and objectivity. You handle critical issues through discussion, through relationships, not just on paper or by position titles. If you have to suffer through a reporting structure with someone who’s not a strong champion, you need to get yourself reporting to the right person, or you need to build strong relationships with others around you who can support you. And if you are in a position where you are not allowed to be independent and objective, not allowed to succeed, you might have to leave. That might be the only answer.