2020: building the value of internal audit

Over the past ten years internal audit and the institute have come on leaps and bounds, with the profession increasingly being viewed as essential to the success of organisations. The challenge now is to build on the progress we have made. I believe the key to this is ensuring that internal audit continues to demonstrate that it is relevant, with a clear strategic focus on the future.

A significant milestone of the past decade was attaining our Royal Charter in 2010. The public recognition this brought was important. It showed how, following the financial crisis, internal audit was increasingly viewed as vital to protecting the assets, sustainability and reputation of organisations. Furthermore, we are champions of the public interest and we must ensure this remains the case.

Another milestone was launching our Financial Services Code in 2013. This has played a pivotal role in enhancing the scope, skills and status of internal audit in financial services firms. Within two years of its implementation the number of heads of internal audit attending executive committees had increased from 48 per cent to 84 per cent, and the number with a rank equivalent to CFO had doubled. This is why we are now developing a similar code for other sectors.

The introduction of this Internal Audit Code of Practice next year will be vitally important, but what else is on the horizon? How do we ensure that our profession continues to adapt and remain relevant for the future?

One big debate at the moment concerns the future of corporate governance, prompted by high-profile corporate collapses, many caused by governance deficiencies. The failures of BHS, Carillion, Patisserie Valerie and  Thomas Cook is fuelling debate about whether the corporate governance framework is fit for purpose. Much of the focus is on external audit, and the Brydon Review will publish its final report shortly.  But we must ensure that internal audit is also recognised as part of the solution to some of the governance, control and risk management issues identified within our major businesses.

Whenever there is a corporate crisis regulators and policymakers should ask “where was internal audit?” If they do not, internal audit could become irrelevant. We need to bang the drum for professional internal audit and contribute to the debates of the day. The Chartered IIA must voice our opinions on the future of audit and corporate governance, and contribute to debates on the future of the economy, business and wider society. But what should internal auditors do to harness opportunities created by the future of audit debate?

First, we must provide greater insights, with more of a strategic focus. In particular, we should look beyond immediate risks to our business, at new and emerging risks. For example, is the organisation’s business model relevant to the 21st century and is internal audit asking difficult questions about this? Is it prepared for climate change risks? Has it tried scenario planning for managing and mitigating myriad political and economic uncertainties? These are just a few areas where internal audit can add greater value.

Another issue is whether internal audit spends  too much time auditing “traditional” areas such as compliance, financial controls and reporting. In our Risk in Focus 2020 research  only 15 per cent of heads of internal audit put financial controls as one of their top five risks, yet 51 per cent say it is one of the areas on which they spend most time. A third listed macroeconomic and political uncertainty as a top five risk, but only four per cent spend most time and effort on it.  We need to ask whether we are auditing the right risks.

Artificial intelligence and data analytics can play a big role in helping us to focus resources on new and emerging risks, while new technology can free up time for us to add more value. We need to be more agile in the way we work as well as how we audit, so we can respond to  risks as they begin to emerge. And we must be more willing to be disruptors in our organisations, asking challenging questions and calling out issues we uncover.

As a new decade dawns, we at the institute are looking forward to working with you to ensure that internal audit remains relevant. That means building on progress we have already made and further enhancing our role in good corporate governance.

This article was first published in November 2019.