The State of Internal Audit: Facts vs Conjecture

It is a truism that negative news tends to generate more attention, and of late there has been too much of it directed at internal audit. I wouldn’t go so far as to characterize it all as “fake news,” but much of it is “hyped news” at best. Whether it’s a media headline trumpeting a purported decline in stakeholder confidence in internal audit or pundits characterizing the profession in such stark terms as the next Blackberry, a few sensational “sound bites” can easily become fodder for those who are quick to relegate the profession to irrelevancy.

Naysayers about internal audit are nothing new. Last year, I reviewed some documents from the files of IIA founders in 1941. Among the letters they received when news broke of The IIA’s pending formation was one from another professional body. The letter warned that internal audit was not a genuine profession and that the interests of internal auditors should continue to be served by the nation’s accounting bodies.

In the 76 years that have followed, internal auditing has ascended to a level of stature in the corporate and public sectors unimaginable to the skeptics of that era. While the progress the profession has made is beyond debate, progress brings challenges. As E.E. Cummings observed: “Nothing recedes like progress.”

No one has been more open and transparent about challenges and opportunities facing our profession than I have been. Along with other leaders of The IIA, we have continuously challenged internal auditors to acknowledge and address any shortcomings that surface. Internal audit should never shy away from fair critique of its work. However, superficial interpretation of data about the profession can quickly morph from valid encouragement for continuous improvement to destructive criticism.

One data point that has quickly been seized upon, from the PwC 2017 State of the Internal Audit Profession Study, is a reported sharp drop in the percentage of stakeholders who believe internal audit adds significant value to their organizations. This figure already is being misused as an example of the profession’s loss of prestige.

Nothing could be further from the truth.

Over the past year numerous surveys have pointed to internal audit’s growing influence and clout in the C-suite and with boards.

• The IIA’s 2017 North American Pulse of Internal Audit finds 29 percent of internal audit functions added staff in 2016. In addition, 30 percent of internal audit functions expect to add staff in 2017, the highest percentage expecting an increase over the past five years. I am convinced that today’s boards and corporate executives do not spend substantially more on risk, control, and governance processes unless they are getting value.
• The IIA’s Common Body of Knowledge (CBOK) Stakeholders Study found 64 percent of stakeholders want internal audit to have a more active role in assessing strategic risks.
• The CBOK report also finds significant support of internal audit providing advisory services.
  • 73 percent of respondents say internal audit should consult on business processes.
  • 71 percent say it can facilitate and monitor effective risk management.
  • 66 percent say it should alert management to emerging issues and changing scenarios.
• KPMGs 2017 Audit Committee Pulse Survey found 56 percent of respondents want to expand audit plans on key areas of risk, and 49 percent want to expand the audit plan to include assurance on the organization’s risk management processes.
• A deeper read of the PwC report reveals analysis that the best internal audit functions (described as agile) are more likely to be involved in assisting the organization with operational disruptions, new regulations, changes in business models or strategy, technology, brand/reputational incidents, and more.
• PwC’s leaders have also noted that “a lot is expected of internal audit” and that is really a good thing. As one of the firm’s leaders has stated, “I would rather have a rising floor of expectations than to be seen as irrelevant.”
• The percentage of chief audit executives reporting directly to the board or audit committee continues to grow (83 percent in 2016 versus 76 percent in 2013).

Each of the statistics cited above points to a profession that is growing in influence and prestige. Yet these “good news” facts rarely are touted with the same élan as the single figure from this year’s PwC report.

Clearly, I take strong exception to our profession being portrayed in such a negative and misleading light. I will be the first to acknowledge that we are at a point in history where strong stakeholder demands require significant changes in what we do and how we accomplish it. But this is not the only time when there have been serious challenges facing organizations.

Modern history is replete with examples of times that brought great pressure and disruption to organizations. Our profession was not only able to pivot quickly to changing stakeholder needs, but also to steadily march toward gaining a higher level of confidence from our stakeholders, as well as a more prominent seat at the governance table. I believe the current increase in demands from internal audit’s stakeholders is evidence that we are closer than ever to achieving trusted advisor status.

The realities of a dynamic and volatile global environment constantly impacted by changing geo-politics, complex trade and finance issues, and technological advances are raising the bar for our profession. Indeed, internal audit is in a vulnerable position where we are being asked to evolve at a pace that is challenging for all and troubling for some.

But what cannot be lost in this challenge (or the gloom-and-doom attitude of faultfinders) is that stakeholders are demanding more of internal audit because they recognize it as an increasingly vital and valuable partner in the fight for sound risk management and governance.

Though not included in ​any headlines, PwC’s report observed that “Chief Audit Executives (CAEs) remain firm in their desire to grow their value to their organizations.” At The IIA, we stand as a ready resource for those who see opportunities to lead their internal audit functions forward.

As always, I welcome your comments.