To Be “Agents of Change,” Internal Auditors Must Embrace Change

One of my favorite quotes in motivating internal auditors of the urgency to change when warranted is drawn from the Danish philosopher Soren Kierkegaard, who noted, “All change is preceded by crisis.” While I do not believe the profession faces a full-blown crisis in 2016, there are certainly imperatives to change as there always are for professions that are growing and evolving.

A great resource to gauge what those imperatives are is The IIA’s annual North American Pulse of Internal Auditfrom the Audit Executive Center, which has become an important tool for CAEs who have come to rely on its trending data.

Data in the recently released Pulse report reflects the continuing evolution in our profession – particularly the trend toward financial and compliance audits making up less of the audit plan (down 10 percent since 2012) and the steady growth in the percentage of CAEs reporting functionally to audit committees or boards (up 7 percent since 2013 to 83 percent).

These two trends reflect much bigger changes in the profession that manifest themselves in varied ways. As risk in the marketplace becomes more dynamic and complex, stakeholders are turning to internal audit to apply their deep knowledge of the organization to the emerging risks it faces. As pressures on boards and audit committee members grow, audit committee members recognize the direct reporting line helps them gain greater assurance and insight on the effectiveness of risk management and control within the enterprise.

We must acknowledge that the same factors driving those two trends create new demands on internal audit practitioners. The key message of this year’s Pulse, “Time to Move out of the Comfort Zone” addresses four areas where those new demands are peaking — cybersecurity, data analytics, auditing culture, and developing interpersonal skills. While the title of the 2016 Pulse might seem a bit provocative, even ominous, I see this as an opportunity to clearly define where the profession must go to grow and succeed — and avoid the “real crisis” that Kierkegaard spoke of.

As stakeholders call on internal audit to do more, the profession must be prepared to invest in the talent, training, and tools necessary to meet those demands. The report’s conclusion includes this prescient observation, “It is time for internal audit to move beyond being capable of handling old risks and align with the strategic objectives of the organization, stepping into the role of trusted adviser.”

I have written that the history of our proud profession reflects that we do not shrink from new challenges. Indeed, we thrive on them. I encourage readers of the Pulse to take its message to heart and develop a step-by-step plan to move out of your comfort zones. Here are a few suggestions to get you started.

Carefully examine the data from each of the four focus areas covered in the Pulse report. In addition to providing valuable data gleaned from a survey of 486 CAEs, directors, and senior managers, the Pulse lays out clearly the challenges practitioners face in the four focus areas and arms you with data to help understand and address them.

For example, in the area of auditing culture, the survey finds that a significant minority of respondents, 35 percent, do not feel internal audit has the full support of executive management to assess all levels of the organization. Viewed another way, 65 percent feel they do have management support to fully assess culture. No matter which group you fall into, the data is valuable to demonstrate to management how the organization compares to others with regard to auditing culture.

Share the findings and your observations with management and the audit committee. As we execute increasingly complex and shifting audit plans, it is easy to overlook that management, boards, and audit committees rely on us to provide perspective on the wide array of risks they must oversee. It is important for us to connect the dots for them, and sharing key trends in the profession with management and the board provides benchmarks for them and adds to your credibility.

Identify how these findings relate to your organization. Every internal audit function is different, with resources, maturity level, staff experience, and relations with management and audit committees all contributing to make them unique. Identify how your audit function can best accomplish moving out of its comfort zone by including management, the audit committee, and/or the board in these discussions and gaining their participation and support.

Apply the same analysis to your individual skill ​sets. Just as the data provides an opportunity to assess how internal audit functions rate, it also should provide insights into how well individual practitioners are prepared to meet new demands. Here I must turn to the simple, yet powerful, theme of current IIA Global Chairman, Larry Harrington — “Invest in yourself.”

Larry has shared this message in his travels around the globe during the first six months of his tenure as chairman and eloquently encouraged practitioners to become “agents of change.” In many ways that message is the same one offered by this year’s Pulse. After all, agents of change must be willing to move out of their comfort zones and change themselves. To paraphrase George Bernard Shaw, progress is impossible without change, and internal auditors who cannot change themselves cannot change anything.

As always, I welcome your comments and observations.