Budget, staff projected to rise for internal audit departments

Companies are devoting more money and staff to internal audit.

Half of companies are maintaining their internal audit budget, and 41% plan to increase their spending, according to The Pulse of the Profession, a twice-annual survey of North American audit executives by The Institute of Internal Auditors (IIA).

That’s the highest percentage of projected increases since the survey began in 2008. Also, the number of companies projected to shrink the internal audit budget (9%) is at a low point, beating the previous low of 14% from four years ago.

Twenty-four percent of companies plan to increase staffing in the internal audit department, 71% plan to maintain staffing, and 5% plan to decrease staffing.

The numbers are in stark contrast to the resources devoted to internal audit during the recent economic downturn. In 2009, 29% of companies planned to decrease budgets, and 19% planned to decrease internal audit staff, the report showed.

The survey shows that audit coverage in 2013 could continue to lag in two main areas: risk management effectiveness and strategic/business risks. Just 4% of the coming year’s audit coverage will concentrate on strategic/business risks, the survey showed, and 5% would be devoted to assurance of risk management.

The top areas of risk coverage are:

• Operational (24%)
• Compliance (14%)
• General financial (13%)
• Sarbanes-Oxley Act (SOX) compliance (12%), IT (12%), and “other” (12%)

Richard Chambers, the IIA’s CEO, expects risk associated with mobile technology to rise in importance. He also has simple advice for chief audit executives (CAEs) in budgeting for future coverage: Follow the risk.

“Certain areas of coverage will ebb and flow, depending on what areas of risk are emerging,” Chambers said. “No matter how large your department, no matter your constraints, follow the risk. [CAEs] should devote resources to the most significant risks.”

Recruiting a different skill set

Audit executives in the survey plan to focus most predominantly on two skills when seeking to add audit staff: analytical or critical thinking and communication.

This reflects a continuing change in role for the internal auditor, where the ability to clearly analyze and convey data is growing more important, as are soft skills. Seventy-seven percent of respondents said analytical/critical thinking is a key skill they’ll seek in recruitment, and 66% said that about communication skills. Data mining and analytics was next at 47%. In the previous survey, analytical/critical thinking was chosen as a key skill by 73% of respondents, and communication by 61%.

“It reflects the kind of skills that are needed to address those key areas of risk,” Chambers said. “Accounting skills is seventh on the list (29%); that’s not a primary area. During peak SOX coverage, it would have been a much higher-rated skill. I would expect that those would change and evolve as coverage does.”

Whistleblowers

The survey of 545 CAEs and internal audit directors in the United States, Canada, and the Caribbean focused several questions on companies’ hotline and whistleblowing processes since the SEC announced the Dodd-Frank Act’s whistleblower program in August 2011.

Employee whistleblowing has remained essentially unchanged since the program was enacted. Seventy-eight percent of respondents said they had little to no concern over employees’ circumventing internal whistleblowing processes; just 2% said they were highly concerned. Additionally, 84% said hotline complaints or tips had remained stable since August 2011.

The top type of complaint to hotlines related to personnel management (38%). The total related to fraud and corruption, including misuse of assets, was 20%.

The report offered three tasks for CAEs to address in the coming year:

• Continually focus and leverage scarce resources commensurate with their organization’s risk profile.
• Look carefully at planned audit coverage with particular attention to aligning that coverage to the key risks of the organization consistent with stakeholder expectations, especially as it relates to the areas of strategic/business risks and risk management effectiveness.
• Continue to recruit skills that align with emerging audit coverage and the talent needs of the present and future.

—Neil Amato (namato@aicpa.org) is a JofA senior editor.