How internal audit can meet growing expectations

Broadening duties in a rapidly changing business environment make it imperative for the internal audit profession to evolve, according to a new research report.

Although audits of operations still make up the largest portion of internal audit plans for 2014, the percentage of internal audit coverage devoted to operations dropped to 24% from 29% in 2013, according to the Institute of Internal Auditors’ Pulse of the Profession global survey.

Financial audits (8%, down from 14% in 2013) also represent a decreasing portion of the internal audit plan.

Increased areas of internal audit focus in 2014, according to the survey of 1,935 audit professionals around the world, include:

• Risk management effectiveness (10%, up from 7% in 2013).
• Business strategy (8%, up from 5%).
• Corporate governance (5%, up from 4%).

The largest increase, though, was reflected in “other” areas not represented in the survey, which rose to 11% of 2014 internal audit coverage from 6% in 2013. This appears to show that internal audit plans are focused more on areas outside of previous norms.

Internal audit teams appear to be moving to meet these new challenges. The types of skills internal audit chiefs are attempting to build on their staffs indicate a desire to master new duties in a collaborative way. The 1,160 global chief audit executives participating in the survey said the skills they are recruiting or building the most are analytical/critical thinking (75%) and communication skills (44%).

As internal auditors wrestle with these changes, they usually are fortunate not to be struggling with diminishing resources. Twenty-seven percent of all survey respondents said internal audit’s staffing is increasing in 2014 over 2013 at their organizations, while just 1 in 10 said staffing is decreasing. Meanwhile, 39% said internal audit’s budget is increasing in 2014, while just 14% said budget is decreasing.

The IIA suggests that in order to deploy these resources effectively and deliver maximum value, internal audit needs to employ five key strategies:

• Improve alignment with expectations of key stakeholders. A recent PwC report made a similar recommendation. The IIA report recommends that chief audit executives consider presenting strategic plans of three to five years that describe changing levels of assurance and advisory services that are aligned with internal control structures.
• Assume a leadership role by coordinating the second and third lines of defense. Just 36% of chief audit executive respondents said their organization has very clearly defined lines of defense. The IIA advocates educating stakeholders on the three lines of defense—management controls, risk management, and internal auditing—in order to avoid confusion.
• Enhance internal audit’s ability to address critical, strategic business risks. Global chief audit executives in the IIA survey said strategic business risks were the top focus of both audit committees and executive management, followed by operational risks. But although business strategy is a growing part of internal audit plans, internal audit pays far more attention to operational issues.
• Develop and implement knowledge and talent-acquisition strategies. Organizations must identify the skills to meet changing demands and recruit workers who possess those skills, the IIA said.
• Become a trusted adviser to the audit committee and executive management. Educating these groups on emerging risks and mitigation activities is one way for chief audit executives to use their expertise to provide value, according to the report.

—Ken Tysiac (ktysiac@aicpa.org) is a JofA editorial director.