Internal audit: Soaring through turbulent times

KUALA LUMPUR, 17 February 2021 — Today’s challenging business environment shares many similarities with a bumpy flight scenario, although perhaps adding a smoldering cigarette in the lavatory, a belligerent inebriate coach, and a leaking hydraulic line in the engine compartment would provide a more-precise comparison to the multiplicity of threats currently facing businesses across the globe.

The sudden onset of the global crisis is almost as notable as its severity, as entirely new problems swiftly merged with and amplified already-simmering issues. While no one is under the illusion that internal audit (IA) can solve all the world’s problems, the function nonetheless has a major role to play in helping organisations cope.

Faced with COVID-19 and its cohorts, IA must now report faster, engage with stakeholders more quickly, and find new ways to add value—while simultaneously replacing processes that have historically been manual, ad hoc, and unsustainable.

Internal audit playing the advisory role
Today, IA functions of all stripes—from cutting-edge to traditional shops—engage in advisory work alongside their traditional assurance role. “The advisory role should be treated as one of the initiative for an IA function in providing a value-added services to the audit committee and the organisation as a whole,” said Muzafar Kamal, Internal Audit, Risk Advisory Executive Director of Deloitte Malaysia.

“While embarking the journey in playing a more active role in advisory, IA function should always maintain the independency and objectivity in retaining the “Third Line of Defense Function”; i.e. providing assurance on the effectiveness of governance, risk management, and internal controls within an organisation. The advisory role should be confined to providing advice solely from internal control, risk management, and governance perspective based on its experience and familiarity with the business process and organisational structure of an organisation,” he added.

Broaden the skillsets of internal auditors
According to Deloitte's 2020 survey of audit committee chairs and members, 96% said internal audit needs to broaden its skillset. While many audit committee interviewees emphasised the need for specialised skills — in cyber, artificial intelligence, analytics, and more — many others stressed the necessity of generalised business knowledge and rounded skillsets. Muzafar shares that, “in terms of hiring initiative, the IA function should consider a “Purple Person”; i.e. a person who possesses a combination of technical skills; e.g. analytics and business skills; e.g. business knowledge and soft-skills. For the existing team members, the Chief Audit Executive (“CAE”) should continue focusing on the Team’s development by having a structured training programme for upskilling purpose; i.e. providing the necessary training to equip the team members with the necessary skillsets, particularly on technology as well as analytics and business skillsets.”

Leveraging on technology to accomplish more with flat budgets
“The availability and quality of data are pertinent attributes that the IA function needs to focus on, on top of having the right team with the right skillsets in its’ analytics journey,” said Muzafar. He continued by adding that, “one of the option that the IA function may want to consider is having a structured plan in rolling out the analytics into its’ IA activities; i.e. identify suitable area where there is quality data available and treat it as “Pilot Programme” before embedding analytics as part of the audit. Once this approach is proven successful, a larger scale roll out can be considered, in tandem with the awareness of the Organisation’s on the application of analytics within the IA function’s audit activities as well as the availability of quality data and readiness of the IA function; i.e. in terms of analytics tool available and having the right team with appropriate skillsets to embed analytics in its IA activities.”

The emergent threats of 2020 had emphasised a critical need for IA to elevate its game. While IA can’t singlehandedly calm the storm, it surely can help immensely, not only to keep the enterprise aloft, but piloted toward a new era of greater resiliency, responsiveness, and, even in trying times, profitability.

About Deloitte Malaysia

In Malaysia, services are provided by Deloitte PLT (LLP0010145-LCA) (AF0080), a limited liability partnership established under Malaysian law, and its affiliates.

© 2021 Deloitte PLT