Four Urgent Keys to Transforming Internal Audit

We are living in transformative times. Technology is accelerating the pace of change to breakneck speeds, demanding that we adapt, adopt, and accept change as a way of life. This brave new world requires organizations, institutions, and individuals to become adept at reinventing themselves.

For internal audit, this dynamic reality is adding complexity and urgency to our work. Change causes disruption, and the organizations we serve work best when disruption is minimized. Invariably, internal audit will be asked to do more, requiring us to pivot to stakeholder demands as we have done before. However, the pressures driving change and disruption today cannot be eased by simply relying on what we’ve done in the past.

Indeed, our profession must undergo transformation, and transformation means doing different things, not doing the same things differently.

The IIA’s 2018 North American Pulse of Internal Audit, titled The Internal Audit Transformation Imperative, continues the tradition of offering cutting-edge analysis and insights on our profession. Unveiled this week at The IIA’s annual General Audit Management (GAM) conference in Las Vegas, this year’s Pulse taps into the views of more than 600 North American chief audit executives (CAEs), directors, and senior managers to provide a snapshot of the profession. Importantly, it identifies four keys to begin transforming the profession.

1. Internal audit must become agile. Our profession’s history of successfully pivoting when the need arose was reactive. Stakeholder demands changed our focus or direction, and we responded. We no longer have that luxury.

We must become proactive and agile, effectively anticipating change and disruption that could impact our organizations. However, data from the Pulse survey suggests we are far from ready. Just 45 percent of CAEs currently consider their internal audit departments to be very or extremely agile.

Creating agile internal audit functions requires changing our mindset, preparing to quickly refocus on disruptive risks and opportunities, prioritizing our work to what matters most, creating teams with the right blend of skills, and coordinating with other resources in the organization.

2. Internal audit must pursue innovation. Disruption offers two options for internal audit: re-envisioning the function or relying on past practices. The latter is a recipe for failure. In order to successfully battle disruption, we must pursue innovation, and that means challenging the status quo. We must be willing to question the way we do the things we do.

However, just 32 percent of CAEs strongly agree that their internal audit functions challenge their own status quos, according to Pulse. Responses relating to other innovation activities were equally troubling, with just 13 percent of respondents strongly agreeing that they adopt new technologies or processes, and 36 percent strongly agreeing that they seek new ways to gather evidential information.

This weak commitment to innovation is particularly alarming when we consider that respondents identified themselves as the key drivers of innovation within the function. Only about a third mentioned executive management and/or the audit committee as key innovation drivers.

The path forward on innovation centers on recognizing the need for self-assessment and challenging how we meet our objectives. Embracing technology also supports innovation. According to the survey, electronic workpapers and data analytics have been implemented by many functions; however, these technology-enabled advances are decades old and are no longer innovative. Finally, we cannot blame a lack of resources for failing to innovate. Like agility, innovation requires a mindset change.

3. Internal audit must redefine its talent. Creating teams with the right blend of skills is key to becoming agile and innovative. The troubling news from the Pulse survey is that 72 percent of CAEs say they have gaps to fill.

The path forward on talent may be the most challenging. For example, CAEs report significant challenges in recruiting personnel with cybersecurity and privacy/data mining and analytical skills. Still, there are clear steps we can take to make sure we have the right people in place to meet stakeholder demands, innovate, and be agile.

Pulse identifies six keys that support getting the right people in place, including developing a talent strategy, seeking candidates with different backgrounds, and including future-focused training and development. But one of the most important is to make sure internal audit’s scope drives staff competencies. Too often, the work internal audit functions take on is dictated by the skills they have on staff. This is a dangerous practice that works against innovation and agility.

4. Internal audit must inspire board engagement. The news from Pulse is positive on growing CAE involvement with boards and audit committees. Nine in 10 audit committee meetings are attended by CAEs, and more than eight in 10 CAEs have unfiltered access to their audit committees at all times.

But interaction must translate into board commitment to the function, and those figures are not as encouraging. For example, slightly more than half of CAEs questioned strongly agree that the audit committee will forcefully support them if there is a dispute with management.

The path forward to strengthen board engagement includes getting the board more involved in assessing internal audit’s resources and performance. Doing so will enable them to better support our work. We also must improve the audit committee’s understanding of the risks the organization faces. Finally, we must encourage candid discussions about situations where the CAE disagrees with management.

Pulse’s call for transformation is not a negative assessment or critique of the profession. We should be encouraged and take pride in the strides our profession has made in raising its status within organizations. Stakeholders today certainly have a better appreciation for internal audit and the value it can bring.

Instead, it is a clarion call for the profession to take the next step in its evolution. Our successes of the past will not be enough to carry us forward. We must transform to keep pace, and we must do it now.

As always, I look forward to your comments.