Alignment is key for internal audit to deliver more value

The demands on internal audit have increased significantly in recent years as technology has advanced, regulation has become more rigorous, risks have emerged, and companies have sought more business insights from internal audit teams.

“That bar continues to rise,” FedEx Chief Audit Executive Robert King, CPA, said Tuesday during a PwC webcast. “And quite candidly, as you go down that journey and become seen in your organization as more of a trusted adviser, they continue to raise that bar, because they ask, ‘What more you can do?’ ”

Senior management at many companies sees internal audit functions struggling to keep up, according to PwC’s newly released global survey report on the state of the internal audit profession. Although 68% of board members said internal audit provides significant value, just 45% of senior management respondents agreed.

Some disparity in those numbers is to be expected; board members may appreciate internal auditors more because they deliver information that might be new to the audit committee but that management already is aware of. Nonetheless, King said, there are opportunities for internal auditors to deliver more value for their organizations.

He said the internal audit function at FedEx, a global parcel delivery organization based in the United States, has followed a process to develop additional value for the company in addition to the traditional assurance function. It’s important, though, that the quality of internal audit’s assurance deliverables to the audit committee does not suffer as the function adds value in other areas.

“That’s always number one for us, that they need that control-level assurance that things are operating as they need to be,” King said.

The keys to adding value beyond controls assurance, King said, are people, process, communication, and relationships. He said internal audit functions looking to add more value should:

• Perform a resource analysis. What skills does the internal audit function possess, and how can those skills be used to produce more value? What skills are missing? Should the team recruit new employees to fill those gaps, or co-source? All these questions should be asked, King said. “To be able to continue to deliver value, we have to have the right resources,” King said. “It starts with people.”
• Have a blueprint. “We have to have a mission, a strategy in what we’re trying to accomplish, and articulate that across those respective [internal] customer groups,” King said. “This is what our expectations are in this particular area. This is how we plan to deliver that.”
• Communicate. Once the value is added, internal audit needs to make other functions realize it, King said. Each year, when he presents to the audit committee, he describes where internal audit added value. “It’s not all cost savings,” King said. “It’s not all about a cost recovery or dollar figure. It’s about process change, it’s about risk mitigation, it’s about areas that we feel like we’ve added value.”

The relationship portion of the value proposition can be a tricky one for internal audit, King said, because of expectations of objectivity and independence. But he said having relationships with the business units helps internal audit function more effectively because of a better understanding of strategy and risks.

Open dialogue

Those relationships and a dialogue start with the chief audit executive and the senior management team, which does not want to be caught off guard when the internal audit head makes a presentation to the audit committee, King said. King also encourages staff members to build relationships with other functions in hopes that employees of other functions will feel comfortable calling the internal audit team to ask, for example, about a potential controls concern.

Michelle Hubble, PwC’s internal audit performance improvement leader, said leading chief audit executives pursue regular dialogue with the business because it helps them align with the needs of their internal customers.

“More likely than not, [it] starts out as some sort of structured plan, monthly or quarterly,” Hubble said. “But then it just becomes part of their culture. And once it becomes part of your culture, you’ve succeeded on that journey of not just providing basic assurance services, but providing insight, helping solve problems, and really focusing on what matters most to management.”

The area of data analytics currently provides an area of excellent opportunity for internal audit to provide additional value, King said.

“You want to deliver value to your senior management team?” King said. “Bring in business insight because of data you’ve been able to manipulate and come to a conclusion to give them insight that they didn’t have before. Tremendous value. They immediately see you as a partner, and that’s a win for them.”

It’s a win for the internal audit team, too. Internal audit can elevate its status in the organization by getting those wins and building on them, King said. Internal audit functions whose duties are limited may have difficulty moving to a more value-added role overnight.

But over time, taking advantage of opportunities to add value can raise the profile of internal audit in the organization. Figuring out what the business units need—and the skills internal audit needs to fill those needs—is the first step, King said.

“Align those expectations,” he said. “Where is value to your organization? They’re asking for more. But in what ways are they asking for more? Is it just more in the assurance area? Is it more in the emerging areas that you need to focus on? And do you have those capabilities? You have to make sure you get alignment on that.”

—Ken Tysiac (ktysiac@aicpa.org) is a JofA senior editor.