In a world of rapid change on almost every front at which organizations must adapt and grow or risk decline and their ultimate demise, everybody faces the same reality — either continuously improve their efforts to contribute sustainable value or be left behind. The chief audit executive (CAE) is no exception. As the risks and complexities companies face change, so do the focus, skill sets and capabilities needed by internal audit.
Key Considerations
In the digital age, internal audit must innovate and transform itself into an agile, multiskilled and technology-enabled function — a “next-generation” function. It must be able to recognize emerging risks and changes to the organization’s risk profile quickly and efficiently enough to incorporate them into the audit plan in a timely manner, so they can be addressed in the assurance that the function delivers. To deliver stronger assurance and more valuable insights to the business in an efficient manner, a next-generation function embraces a holistic approach that focuses on competencies, qualities and components falling into three broad categories:
Traditional methodologies, long-trusted standalone point solutions addressing specific needs and conventional thinking, simply can’t accomplish these tasks efficiently at the speed of change that is occurring. Many CAEs see that internal audit tools and techniques are evolving rapidly, stirring excitement about transformation possibilities and innovation within the function. When polling at various webinars and conference presentations, as well as in independent research, Protiviti has found that a strong majority of participants consistently indicate that they are undertaking next-generation auditing initiatives.
What does this mean, and why should the board care? Next-generation internal audit functions have three essential objectives — improve assurance by increasing focus on key risks; make internal audit more efficient; and provide deeper, more valuable and timelier insights from audit activities and processes. These objectives are easy to understand. However, the mechanisms to implement such changes vary across a range of innovative approaches, tools and governance processes and are intertwined with the innovative culture the CAE tailors to the organization’s needs and his or her vision of what next-generation internal audit should look like.
Our research indicates that three out of four functions are undertaking some form of innovation or transformation effort, but also that the adoption of next-generation capabilities is in a relatively early stage. In many instances, implementation of the governance mechanisms, agile methodologies and enabling technologies that comprise the next-generation internal audit model has occurred in an ad hoc manner so far. The message is clear for a significant number of functions that have yet to begin their next-generation journeys: It’s time to get started.
Common technology activities and tools implemented in next-generation transformations include:
These digital activities and tools enable internal auditors to translate an increasingly overwhelming amount of data into a meaningful, impactful analysis. Coupled with divergent and critical thinking, these capabilities have the potential to steepen the value-delivery curve significantly for internal auditors.
The annual audit planning process directors are familiar with has become a relic of the past. Rarely will an audit plan be executed in its entirety before fresh insights and developments emerge, creating the need for changes to it. The above digital pathway will lead to the observations and recommendations that board members, senior executives and other stakeholders will value and can act upon quickly in the digital age.
Directors can’t be indifferent to the CAE’s level of awareness of digital techniques and tools available for next-generation audit. The reality is that companies are moving to cloud computing and adopting AI, machine learning and other digital practices to conduct business at the speed of innovation. As they do so, an agile methodology enabled with the right skills, resources and technology helps the CAE sustain internal audit’s relevance by providing assurance to the board and other stakeholders on the risks that matter most in the most efficient manner. The board should accept nothing less.
You can read more on this topic in this issue of Board Perspectives: Risk Oversight and explore these tools on KnowledgeLeader:
Setting the Audit Committee Agenda Questionnaire
Enterprise Risk Assessment Process Questionnaire
Internal Audit Strategic Focus Questionnaire