How audit committees can help transform internal audit

More often than not, management believes internal audit doesn’t contribute significant value or perform well on core attributes.

That’s according to PwC’s ninth annual State of the Internal Audit Profession Study. While 79% of board members believed internal audit was contributing significant value, just 44% of management agreed. The survey polled about 1,100 chief audit executives (CAEs) and about 630 stakeholders – chief executives, audit committee chairmen, other board members, and senior finance and risk managers – in 60 countries.

It would appear that internal audit is at a crossroads, with more regulatory challenges and an ever-growing job description but not always the experience and training to meet those demands. A recent report by the Institute of Internal Auditors (IIA) and Robert Half listed seven attributes of effective internal auditors, many of which include a shift toward including “soft skills” on top of the more technical basics and were echoed in the PwC research.

For internal audit departments to evolve into the sort of analytical, cross-departmental communicating machine that key stakeholders envision, the PwC report offers four questions audit committees should ask themselves to enable internal audit departments to grow into the new role.

1. Are internal audit’s expectations clear or high enough? The report showed that while board members had a generally higher opinion about the internal audit department’s work, the board also had lower expectations. And the majority of audit committee members in the survey saw value in internal audit while also considering its performance to be lacking on topics such as promoting quality improvements and innovation. Then there’s management’s generally lower opinion of internal audit. Therefore, audit committee members need to be honest with themselves about their guidance and their expectations.

2. Is critical business risk coverage aligned with your views on risk? This question should be considered from two perspectives: To what extent is internal audit aligned with overall risk coverage in the current plan? What areas of risk should internal audit be responsible for covering in the future?

3. Does internal audit have a strategic plan and the resources needed to deliver value? The three most common underperforming attributes, according to the report, are having the right talent, leveraging technology and promoting quality improvements and innovation. If resources are lacking for any of those facets, then that’s where audit committees should start.

4. Is the audit committee enabling internal audit to be what it should be? The committee should be holding internal audit accountable. Use key performance indicators to monitor and evaluate progress.

Additionally, the report urges management to expect more and CAEs to deliver more. That’s only part of the solution to address the expanding role, IIA Chief Executive Richard Chambers said. The auditor, especially someone just starting in the role, must go beyond the training and goals provided by the organisation.

“This is a profession that is rich with opportunity, if candidates come into the profession with the idea that they’re going to learn as much as they can – about the organisation, about risk, about internal controls, about governance,” Chambers said.

Related CGMA Magazine content:

“Budget, Staff Projected to Rise for Internal Audit Departments”: A fall 2012 survey by the IIA shows that most companies planned to maintain or increase staff and budgets for internal audit. The report also listed the top risk categories audit executives planned to focus on in 2013.

“Internal Audit: The Importance of Being ‘Soft’ ”: Companies are increasingly turning to internal auditors to identify operational risks, provide business advice and analyse information at the speed of light. With so much on internal auditors’ plates, effective communication can easily be overlooked.

—Neil Amato (namato@aicpa.org) is a CGMA Magazine senior editor.