Internal audit: beyond compliance
Increasingly under the spotlight, power and utility companies are demanding more of internal audit. But as expectations grow, so do cost pressures – how can this important function meet the challenge? Torsten Vesper reports.
Volatility, financial instability and the pace of technological change have consumers, investors and regulators demanding greater visibility into what utilities are doing.
Internal audit must meet these expectations, taking on a broader mandate that goes beyond compliance. It needs to offer operational business insights as well as advice on the current and emerging business risks faced by the sector.
Our global survey of chief audit executives (CAEs) shows that more than half of respondents are aware of these expectations, believing that their mandate will expand over the next two years.
However, while they expect their role to increase, only about one-third of respondents expect their budget to rise in line with these added responsibilities. Critically, most CAEs admitted that significant skill gaps were preventing them from stepping up to their expanded role.
Internal audit should focus on four key areas in order to meet the current needs of power and utilities companies:
1. Expanding the internal audit mandate
Developing – and regularly revisiting – a risk-based annual audit plan that balances assurance and compliance with insights and strategic advice will help meet increasing stakeholder expectations.
2. Shifting the scope
Technology, big data and expansion into emerging markets mean the internal audit function of utilities must take a proactive approach to addressing compliance requirements and also serve as a strategic advisor.
3. Increasing competency requirements
To meet its expanding role, internal audit must either cultivate additional skills in-house or turn to third parties to provide these competencies.
4. Evolving the function composition
Leveraging resources within an organization or bringing in specialized skills will ensure the right people are in place to perform efficiently and effectively.
Doing more with less?
While expanding the role of internal audit is challenging in itself, it comes at a tough time for utilities. As cost pressures force many companies, particularly in Europe, to reduce operational costs and cut staff, internal audit now finds itself expected to do more but with fewer resources.
A reduced internal audit function will not only struggle to fulfill an expanded mandate but is in danger of missing critical compliance risks.
In our experience, more and more utilities are partnering with third parties such as EY to fill the gap between needs and existing skills. In this year’s survey, 82% of respondents across all sectors and 95% of utilities surveyed said they co-sourced or outsourced some or all of their internal audit functions – a significant increase compared to 2012 figures.
Our survey shows that the skills most in demand are:
- Data analytics
- Business strategy
- Risk management
- Deep industry experience
Utilities are realizing that third-party resources bring sector-specific and international experience, as well as critical skills, including IT, and insights into emerging risks. They also receive ongoing training and are up–to-date on leading practices.
Respondents indicate that much of this co-sourcing or outsourcing is at senior managerial levels, highlighting the value of experience.
Third-party resources also offer a fresh perspective, as well as the additional soft skills that are as important as purely technical auditing skills. To be a strategic advisor to the business, auditors need to be able to think critically, apply business knowledge and clearly articulate insights to management.
Check your performance
The CAEs of most utilities regularly review their internal audit efficiency via the quality assessment required every five years by the Institute of Internal Auditors. This is a relatively easy way to ensure basic compliance requirements are being met.
But those utilities with high-performing internal audit functions are doing more. We work with leading utilities such as RWE to implement functional performance assessments that help these companies benchmark against best practice drawn from our global experience in the sector.
The findings from these assessments support utilities to better position their internal audit functions to match organizational needs.
Striking a balance
The internal audit function of utilities needs to strike a balance between meeting assurance and compliance requirements and broadening its role to offer strategic insights to the business.
In a period of cost pressures, third-party resources may be a cost-effective way to fill skill gaps and make the most of this opportunity to add lasting value.
For more information