Internal audit: Golden oldies or latest tunes?

The internal auditor’s conundrum

Consider the case of a musician with a new album. Out on tour, the performer wants to fill the set list with the latest cuts. But the fans turn out for the old hits. How can the artist send the crowd home happy, while simultaneously remaining true to the muse?

Internal audit functions face a similar dilemma: Their old “hits”—retrospective and assurance-based audits with a focus on compliance—provide reassuring familiarity to their audience of CFOs and audit committee members. But the new “music”—delivering valued advice and predictive, analytical, technology-enabled insights—gets the auditors’ blood pumping.

Attaining an equilibrium between tried-and-true and cutting-edge, between a focus on the past and on the future, is critical to keeping both music fans and business executives happy and artists and auditors fulfilled.

Back to top

Move beyond the mandate

​One might argue that today’s typical internal audit function adequately satisfies its mandate: providing assurance with a focus on the past. Why not just coast along, doing what you’ve always done?

Because the future beckons.

IA is uniquely positioned to help guide the organization into a future fraught with risk and rife with opportunity. But before it can help the organization, internal audit must change itself.

Back to top

Dispel stereotypes

​A makeover, however, shouldn’t be so extreme that it renders you unrecognizable. As internal audit executives look to remodel their shops, they would be wise to retain some of the familiar trappings that formed their identity initially.

At the same time, many chief audit executives would be happy to expunge some negative perceptions and persistent stereotypes that tarnish their profession, such as belief that the internal audit function:

• Adopts a “police” mentality
• Uses a punitive report structure and approach
• Lacks relevant business experience
• Excessively focuses on compliance
• Works reactively
• Offers little appeal to top talent
• Suffers from high turnover

Back to top

Push into new directions

​Seats aren’t given, they’re taken. Make some noise, throw some elbows, raise some eyebrows. Push the internal audit function in new directions. Deliver unexpected insights. Ask uncomfortable questions. While IA shops can’t put the past completely in the rearview mirror, the function can turn its gaze toward the future, where the risks and opportunities reside.

Back to top

Where to start?

Here are a few tools that innovative internal audit groups are adopting:

• Data visualization tools can be leveraged to make data speak and tell its secrets, helping to intercept issues before they become problems and yield insights that become opportunities.
• Robotic process automation (RPA), deployed for processes that are clearly defined, repeatable, and rules-based, can result in significant time savings. The implications of RPA for internal audit apply both to the function—automating selected audit procedures, thereby freeing up IA staff for higher-value activities—and to the larger organization—auditing RPA usage within the business.
• Blockchain holds the promise of making information more secure and transactions less costly. A decentralized, widely distributed, encrypted network of ledgers or databases, blockchain can cut out intermediaries (such as banks, businesses, and governments) while enabling financial transactions, supply chain auditing, intellectual property protection, smart contracts, identity management, stock trading, and more. Internal audit must be ready to advise and assess.
• Agile Internal Audit, which is characterized by a greater focus on individuals and interactions; increased collaboration with customers; an emphasis on outcomes rather than processes; a nimble and responsive approach to change; a preference for simplicity over complexity; and a willingness to continually reevaluate assumptions, priorities, and findings.
  

Back to top

Participant insights

What other developmental areas hold promise and greater enlightenment for internal audit? Participants at the Global CAE Forum described a variety of strategies that have yielded success.

• If internal audit intends to broaden its mandate, it must also broaden the talent mix.
• Internal audit can help defend the organization’s brand and reputation by asking questions before a crisis hits. If reputation risk isn’t currently considered a top-tier concern at your organization, it’s up to IA to make it so.
• Provide insights into areas of emerging risk. Most executives are focused on the day to day. It’s up to IA to cast a view farther afield to identify emerging concerns and opportunities.
• Pay increased attention to your cybersecurity. Take your IT audit results to the board and indicate areas where IT needs additional focus and attention. And leverage the IT tools, capabilities, and training resources of the organization to benefit your own IA shop.
• To address 21st-century issues, teams need to become more flexible. Devote more resources and attention to the most important risks.

Back to top

Embrace the role

The notion that rock stars and internal auditors share commonalities may not be so far-fetched after all. Consider: Until relatively recently, no one envisioned that a staid, behind-the-scenes profession could spawn a true celebrity. Yet veteran auditors will remember early in the 21st century when an internal auditor was named a “Person of the Year” by Time magazine, raising the profile and stature of the profession to unimagined heights.

But you don’t have to land on a magazine cover to be considered a star. That recognition will come from a few adjustments, more or less. That is:

• More future and less past
• More innovation and less tradition
• More diversity and less homogeneity
• More collaborator and less cop
• More pictures and less numbers
• More agility and less stasis

Business is undergoing a dramatic shift. The internal audit function can help lead the way. Embrace the new role and it will embrace you too.

Back to top