Internal audit: Golden oldies or latest tunes?
Innovative internal audit groups share how they balance the past and future
Rock stars and internal auditors have more in common than you might think. That’s just one of the insights gleaned from Deloitte’s third annual Global Chief Audit Executive (CAE) Forum. Another insight? The internal audit (IA) function can be both a stabilizing influence and a catalyst for change.
- The internal auditor’s conundrum
- Move beyond the mandate
- Dispel stereotypes
- Push into new directions
- Where to start?
The internal auditor’s conundrum
Consider the case of a musician with a new album. Out on tour, the performer wants to fill the set list with the latest cuts. But the fans turn out for the old hits. How can the artist send the crowd home happy, while simultaneously remaining true to the muse?
Internal audit functions face a similar dilemma: Their old “hits”—retrospective and assurance-based audits with a focus on compliance—provide reassuring familiarity to their audience of CFOs and audit committee members. But the new “music”—delivering valued advice and predictive, analytical, technology-enabled insights—gets the auditors’ blood pumping.
Attaining an equilibrium between tried-and-true and cutting-edge, between a focus on the past and on the future, is critical to keeping both music fans and business executives happy and artists and auditors fulfilled.
Move beyond the mandate
One might argue that today’s typical internal audit function adequately satisfies its mandate: providing assurance with a focus on the past. Why not just coast along, doing what you’ve always done?
Because the future beckons.
IA is uniquely positioned to help guide the organization into a future fraught with risk and rife with opportunity. But before it can help the organization, internal audit must change itself.
A makeover, however, shouldn’t be so extreme that it renders you unrecognizable. As internal audit executives look to remodel their shops, they would be wise to retain some of the familiar trappings that formed their identity initially.
At the same time, many chief audit executives would be happy to expunge some negative perceptions and persistent stereotypes that tarnish their profession, such as belief that the internal audit function:
- Adopts a “police” mentality
- Uses a punitive report structure and approach
- Lacks relevant business experience
- Excessively focuses on compliance
- Works reactively
- Offers little appeal to top talent
- Suffers from high turnover
Push into new directions
Seats aren’t given, they’re taken. Make some noise, throw some elbows, raise some eyebrows. Push the internal audit function in new directions. Deliver unexpected insights. Ask uncomfortable questions. While IA shops can’t put the past completely in the rearview mirror, the function can turn its gaze toward the future, where the risks and opportunities reside.
Where to start?
Here are a few tools that innovative internal audit groups are adopting:
- Data visualization tools can be leveraged to make data speak and tell its secrets, helping to intercept issues before they become problems and yield insights that become opportunities.
- Robotic process automation (RPA), deployed for processes that are clearly defined, repeatable, and rules-based, can result in significant time savings. The implications of RPA for internal audit apply both to the function—automating selected audit procedures, thereby freeing up IA staff for higher-value activities—and to the larger organization—auditing RPA usage within the business.
- Blockchain holds the promise of making information more secure and transactions less costly. A decentralized, widely distributed, encrypted network of ledgers or databases, blockchain can cut out intermediaries (such as banks, businesses, and governments) while enabling financial transactions, supply chain auditing, intellectual property protection, smart contracts, identity management, stock trading, and more. Internal audit must be ready to advise and assess.
- Agile Internal Audit, which is characterized by a greater focus on individuals and interactions; increased collaboration with customers; an emphasis on outcomes rather than processes; a nimble and responsive approach to change; a preference for simplicity over complexity; and a willingness to continually reevaluate assumptions, priorities, and findings.
What other developmental areas hold promise and greater enlightenment for internal audit? Participants at the Global CAE Forum described a variety of strategies that have yielded success.
- If internal audit intends to broaden its mandate, it must also broaden the talent mix.
- Internal audit can help defend the organization’s brand and reputation by asking questions before a crisis hits. If reputation risk isn’t currently considered a top-tier concern at your organization, it’s up to IA to make it so.
- Provide insights into areas of emerging risk. Most executives are focused on the day to day. It’s up to IA to cast a view farther afield to identify emerging concerns and opportunities.
- Pay increased attention to your cybersecurity. Take your IT audit results to the board and indicate areas where IT needs additional focus and attention. And leverage the IT tools, capabilities, and training resources of the organization to benefit your own IA shop.
- To address 21st-century issues, teams need to become more flexible. Devote more resources and attention to the most important risks.
Embrace the role
The notion that rock stars and internal auditors share commonalities may not be so far-fetched after all. Consider: Until relatively recently, no one envisioned that a staid, behind-the-scenes profession could spawn a true celebrity. Yet veteran auditors will remember early in the 21st century when an internal auditor was named a “Person of the Year” by Time magazine, raising the profile and stature of the profession to unimagined heights.
But you don’t have to land on a magazine cover to be considered a star. That recognition will come from a few adjustments, more or less. That is:
- More future and less past
- More innovation and less tradition
- More diversity and less homogeneity
- More collaborator and less cop
- More pictures and less numbers
- More agility and less stasis
Business is undergoing a dramatic shift. The internal audit function can help lead the way. Embrace the new role and it will embrace you too.
Download the full report to learn more about what innovative internal groups are doing and the internal audit tools they’re leveraging.
For information about our services, visit Internal audit: Where insights lead.
Nine ways to respond to stakeholder’s needs
Audit transformation through innovation and technology