Internal auditors must focus more attention on strategy

Strategy is a critical part of finding the next wave of growth, but companies are not always confident in their strategic assumptions, according to a report by the Corporate Executive Board (CEB).

The report says that, during the past ten years, two-thirds of incidents causing market-value drops of 50% or more occurred because of corporate strategy missteps.

So it’s no wonder that chief auditors regard contingency planning and strategy development and execution as top concerns.

Recent disruptive events, the report says, have put companies on high alert about the risk of catastrophic or systemic disasters. But not all companies have contingency plans to handle these types of events. Amongst chief auditors, 47% found control deficiencies during their audits of contingency planning processes. The key pain points of contingency planning, according to the report, are:

• Macroeconomic crisis preparedness: Companies have a hard time understanding how a major event, such as a possible break-up of the euro zone, would affect their supply chain and their customers. Management should be encouraged to explore “what-if” scenarios.

• Catastrophic systems failures: With more companies depending on complex and interconnected IT systems, they are more exposed to critical breakdowns that could interrupt business continuity.

• Massive data breaches: A loss of sensitive data isn’t just a financial issue; it can create a trust problem for companies. The report says, and other research indicates, that IT security breaches are on the rise (by a factor of ten in the UK in the past five years, for example), so companies must be vigilant in guarding against cyber-attack or inadvertent leaking.

At the same time, 90% of chief auditors consider risks associated with strategy – both the planning and execution – to be significant.

The CEB report, 2013 Audit Plan Hot Spots, advises internal auditors to be on the lookout for three trends related to strategy:

• Uncertain growth assumptions: Eighty per cent of companies rank growth acceleration as important or very important. But as companies face an ever-changing economic landscape, they “lack confidence in their current strategy assumptions to help identify and fund significant growth bets,” the report says.

• Senior management decision paralysis: Fifty-nine per cent of strategy executives see slow decision-making as a main hindrance to growth, the CEB’s research shows. With companies often unable to take the financial hit of a failed initiative, there is more aversion to risk. So as companies spend more time and resources “bulletproofing” their decisions, delays can often cost the company. Strategy executives estimate that the waiting costs a company up to 50% of its growth rate.

• The strategy-execution gap: The CEB cites research from Robert Kaplan and David Norton, the creators of the Balanced Scorecard, stating that just 5% of employees understand their company’s strategy and how it affects their work. “This problem, while not new, is particularly acute today because companies now need to much more quickly mobilize their workforces to exploit new growth opportunities,” the report says.

For internal auditors to add value in the strategy realm, the report says, internal audit should periodically test strategic assumptions as well as the processes a company has in place to adapt strategy in response to changing business conditions. Also, internal audit should evaluate the communication processes to make sure strategic plans turn into strategic execution.

Also on the list of hot spots this year:

• Corruption and bribery: As business grows more global and international anti-corruption legislation is more aggressively enforced, pressure is on organisations to communicate and live up to company standards.

• Tax management: As regulatory requirements grow, tax departments are under pressure to disclose more information.

• Basic operation controls: Rapidly changing business conditions, including increased employee turnover, make effective oversight and execution of operations more difficult.

• Project management: Nearly two-thirds (63%) of firms recently experienced a project failure, even though companies are trying to drive growth through large-scale projects.

• Third-party relationships: The CEB says that almost 55% of CAEs identified control deficiencies in relationships with contract workers or outsourcing service providers.

• Talent management: A battle for talent is unfolding globally, even though unemployment remains high.

• Tone at the middle: While a code of conduct is good, that message from the top is often not enough as middle managers are influencing behaviour more.

• Reputation risk: Shifting stakeholder expectations and instant transparency through social media heighten exposure to dents in reputation.

Related CGMA Magazine content:

“Internal Audit: The Importance of Being ‘Soft’”: Companies are increasingly turning to internal auditors to identify operational risks, provide business advice and analyse information at the speed of light. With so much on internal auditors’ plates, effective communication can easily be overlooked. Here’s a look at why communication is such a vital tool.

“Four Steps to Formalise Internal Audit’s Strategic Impact”: Internal audit is evolving from a strict compliance function, but its strategic alignment with business strategy has yet to be formalised and documented in many organisations. Here are four steps to develop a formal strategy document for the internal audit function.

“More North American Companies Rewarding Internal Auditors With Pay Raises, Perks”: A greater percentage of companies are giving raises to the internal audit department, which reflects the increasing role in recent years as regulatory demands have also increased. An Institute of Internal Auditors survey also showed that those with specialty skills were likely to be paid more.

—Neil Amato (namato@aicpa.org) is a CGMA Magazine senior editor.