Eighty percent of global chief audit executives acknowledge room for improvement with internal audit functions
New research from Ernst & Young, The future of internal audit is now (pdf, 2.5mb) , highlights that 75% of respondents believe strong risk management has a positive impact on their long-term earnings performance and an equal percentage believe that their internal audit function has a positive impact on their overall risk management efforts.
And yet, as the global survey of 695 chief audit executives (CAEs) and C-suite executives also reveals, 80% of organisations acknowledge that their internal audit function—a key player in managing risk—has room for improvement.
This finding is particularly important for African companies as they gear up to take advantage of the opportunities offered by Africa’s strong growth prospects. “During Ernst & Young’s last Strategic Growth Forum in Africa, held in March 2012, we heard that seven of the 10 fastest-growing economies globally over the next five years will be in Africa. This begs the question: Are internal audit functions in Africa geared to be strategic advisers to their organisations during this time of rapid growth?” says Edward Okaro, Ernst & Young Risk leader for Africa.
Okaro says that the Strategic Growth Forum identified the top risks facing African countries going forward. Among these risks, the Forum noted are the infrastructure gap, regulations and compliance, developing a successful growth strategy, the ability to operate across Africa at a low cost and political uncertainty. “Internal audit will have to help organisations navigate these risks—and they will need the right skills to do so effectively,” Okaro adds.
Aligning internal audit strategy to the business
The survey identifies that the key priorities of both CAEs and stakeholders have clearly shifted from compliance and financial controls to risk coverage and business relevance. Future focus areas becoming more relevant to achieving business objectives cited by respondents include improving the risk assessment process and enhancing the ability to monitor emerging risks. Additionally, reducing overall internal audit function costs without compromising risk coverage and identifying opportunities for cost savings in the business were also cited.
In order to focus on risks that matter, create value and help the organisation achieve its objectives, internal audit functions need to align their strategy to that of the overarching organisational strategy. However, 61% of respondents reported that they had no documented mandate that aligns internal audit to the organisational strategy.
Commenting on this approach, Randall Miller, Ernst & Young Advisory Global Risk Leader says, “Internal audit can use the organisation’s overarching organisational strategy to identify the risks that matter most in the context of the organisation’s risk appetite. Elements of the organisational strategy will vary by industry and are very specific to the business but to remain relevant, internal audit needs to use risk assessments based on the organisation’s strategic objectives.”
Improve the risk management process
Internal audit risk assessments, regulatory requirements and enterprise risk assessments are the top three drivers of the audit plan, and internal audit is playing a more prominent role in organisational issues, such as major capital projects (49%), IT systems implementations (42%), mergers and acquisitions (37%) and material contracts (32%). Technology also remains a key area of focus for internal audit functions, comprising 18% of the current audit plan.
Improving the risk assessment process is the number one priority of CAEs and stakeholders alike. Identifying risks that are truly significant to the business is the first step to effective risk management and monitoring. Today’s internal audit functions are focused on enterprise-wide risk coverage, leadership engagement and direct linkage to strategy to increase the relevance of the risk assessment. As well, most leading organisations are incorporating a quantitative component.
Forty-six percent of respondents indicated that their internal audit functions perform annual updates, or none at all, leaving themselves unprepared for events that could crop up throughout the year including transactions, new product launch or retirement, new market entry, patent expiry and litigation.
Jonathan Blackmore, Ernst & Young Risk leader for Europe, the Middle East, India and Africa, comments, “No longer an annual process, the audit plan must be refreshed regularly, with triggering events and leading functions are developing a “three + nine” plan: a three-month frozen window and nine-month fluid plan.”
Assess skills and manage talent
Nearly one-fifth of respondents indicated that they would like to see improvements to internal audit reporting by putting issues into perspective relevant to the risk and identifying trends. Thematic audits are one way of doing this and are making resurgence as stakeholders increasingly want to know the implications, magnitudes and insights that audit findings convey.
As the role of the internal auditor evolves and stakeholder expectations rise, internal audit functions increasingly require competencies that exceed the more traditional technical skills, such as the ability to team with management and business units on relevant business issues.
When asked which areas of the respondent’s internal audit function had defined competency plans for staff development, 58% indicated a plan for technical internal audit skills, 54% have a plan for business or industry acumen and only 47% have a plan for business management and leadership. Surprisingly, 8% indicated no defined competency plan at all.
“African internal audit teams should put staff development plans in place to ensure that they can provide the right support to companies wanting to compete with global players as Africa’s growth takes off,” Okaro says.
Two main approaches that internal audit functions can take to attract the right capabilities include an auditor rotation program across business units or functions in other parts of the organisation and a guest auditor program for high-performing employees from other parts of the business to gain internal audit experience.
Miller summarises, “With the right internal audit-focused strategy in place, internal audit can add value to the business by becoming strategic advisors, identifying efficiencies across the enterprise, supporting key business initiatives and quantifying internal audit’s return on investment.
Blackmore concludes, “The future of internal audit is not on the horizon. It’s here and internal audit functions need to act now to remain relevant to the business, or be left behind.”
About the survey
In December 2011, Ernst & Young commissioned Forbes Insights to conduct a global survey of 695 stakeholders and audit professionals about the evolving role of internal audit. Respondents included chief audit executives (CAEs), C-suite executives and board members representing organisations with global revenues of US $500 million or more and spanning 26 industry sectors.
About Ernst & Young’s Advisory
The relationship between risk and performance improvement is an increasingly complex and central business challenge, with business performance directly connected to the recognition and effective management of risk. Whether your focus is on business transformation or sustaining achievement, having the right advisors on your side can make all the difference. Our 25,000 advisory professionals form one of the broadest global advisory networks of any professional organisation, delivering seasoned multidisciplinary teams that work with our clients to deliver a powerful and superior client experience. We use proven, integrated methodologies to help you achieve your strategic priorities and make improvements that are sustainable for the longer term. We understand that to achieve your potential as an organisation you require services that respond to your specific issues, so we bring our broad sector experience and deep subject matter knowledge to bear in a proactive and objective way. Above all, we are committed to measuring the gains and identifying where the strategy is delivering the value your business needs. It’s how Ernst & Young makes a difference.
About Ernst & Young
Ernst & Young is a global leader in assurance, tax, transaction and advisory services. We make a difference by helping our people, our clients and our wider communities achieve their potential.
Ernst & Young refers to the global organisation of member firms of Ernst & Young Global Limited, each of which is a separate legal entity.
Ernst & Young is a company comprising of 150 directors and has a staff complement of over 2000 in offices throughout the country. We have made significant progress with its transformation and are the leaders amongst the Big Four with 47.3% of its staff and 25.3% of its ownership being black, 53.6% of its total staff being female and 28.6% female ownership. In addition, we have 41.6% black director representation on our Leadership Board.
We have been proactively responding to the globalisation of our clients by integrating our country practices across Europe, the Middle East, India and Africa. Our Africa integration has exceeded our expectations and we currently enjoy a presence in 33 African countries.