10 imperatives for internal audit

Internal audit is playing an important role in helping businesses succeed in an environment where technological innovation and global interconnectedness present rapidly moving challenges and opportunities.

Organizations rely on internal auditors for insight on operational, business, and strategic risks that are emerging at an accelerating rate. Internal auditors can keep pace by developing new skills, improving relationships, and leaning on technology.

“Internal audit needs to demonstrate its willingness and ability to overcome the new challenges posed by today’s dynamic business environment,” Richard Chambers, president and CEO of The Institute of Internal Auditors (IIA), said in a news release.

A report released Tuesday, Driving Success in a Changing World: 10 Imperatives for Internal Audit, provides direction for internal auditors in this challenging environment. The report, developed by the IIA Research Foundation, identifies 10 key areas where internal audit can excel to meet new challenges:

• Anticipate the needs of stakeholders. In developing audit plans, just 62% of internal audit departments consult with divisional or business heads, the report says, and just 56% consult with audit committees, according to a survey of chief audit executives (CAEs). Improving communication channels can help internal auditors better anticipate expectations.
• Develop forward-looking risk management practices. Just 34% of internal audit plans are updated three or more times a year, CAEs said. Failure to update plans frequently may put internal audit at risk of overlooking important changes in the business environment.
• Continually advise the board and audit committee. Sixty-nine percent of CAEs report functionally to their audit committee, according to global survey data. Formal communication channels and working behind the scenes to advise audit committees can help keep the board up to speed, according to the report.
• Be courageous. To gain credibility across the organization, internal auditors must have the courage to tell stakeholders the truth, whether they want to hear it or not, the report says. This means internal audit must be prepared to handle conflict.
• Support the business’s objectives. More than half (57%) of practitioner survey respondents said their internal audit department is fully or almost fully aligned with the strategic plan of their business, according to the report. A lack of alignment with strategy can make it difficult for internal auditors to demonstrate the value they add to their organizations.
• Identify, monitor, and deal with emerging technology risks. Audit activities in cybersecurity and social media are expected to increase over the next few years. Technology risks are always evolving, and internal auditors need to keep pace with that evolution, the report says.
• Enhance audit findings through greater use of data analytics. Technology is allowing internal auditors to analyze complete data sets instead of samples and to improve efficiency and sophistication in auditing data-rich areas.
• Go beyond the IIA’s standards. A strong quality assurance and improvement program, as required by the standards, demonstrates a commitment to quality. Internal audit also can go beyond the standards to deliver specific, high-value activities for the organization, the report says.
• Invest in yourself. Internal auditors cannot rely just on their employers for training, as a recent survey shows training programs in the smallest internal audit departments often are not fully developed. Technical skills and knowledge of the business or organization are of critical importance.
• Recruit, motivate, and retain great team members. Getting the right mix of skills in the internal audit department is important, according to the report. Many organizations are using bonuses for motivation and retention.

—Ken Tysiac (ktysiac@aicpa.org) is a JofA editorial director.