Continuing evolutions in the global corporate governance environment have raised the profile of the role played by Internal Audit. The increasing demands being placed on Internal Audit reveal the evolving requirements of both management and the Audit Committee. Against this backdrop, many New Zealand organisations are looking around as they seek to uncover where ‘good practice’ might lie.
New research by PricewaterhouseCoopers sheds light on this and asks how reassurance is given that risks are being managed – particularly focusing on the role of Internal Audit. In light of both heightened investor awareness and the increasing public demand for professional standards of corporate governance, PricewaterhouseCoopers undertook 45 structured interviews with, predominantly, Audit Committee chairs from New Zealand’s public and private sectors to understand their views on the effectiveness of Internal Audit.
The survey results show there are few simple answers and the role of Internal Audit continues to be an area of debate. At one extreme, some organisations allocate extensive Internal Audit effort to detailed compliance. This effort continues to identify significant weaknesses in core financial and supporting IT processes and as such supports back-to-basics philosophy. At the other extreme, some organisations are looking for defined dollar payback from Internal Audit effort in terms of savings identified.
An alternative approach argues that focus should be on assurance and control over the major risks facing the organisation. Since in most organisations these risks are strategic and operational, rather than financial, the end result for Internal Audit is very different.
This disparity was reflected in comments of the Audit Committee chairs that we interviewed which ranged from “Internal Audit should ensure all expenditure is appropriately controlled” to “Internal Audit needs to look over the horizon and ensure we are positioned to best manage and control emerging risks.”
Going into further detail about the effectiveness of Internal Audit, the responses show:
Over one quarter of respondents indicated that Internal Audit performed excellently against their expectations. However, for 34 percent of organisations Internal Audit scored ‘average or below’ in meeting the chairs’ expectations: “Internal Audit tends to attract people with good process skills, who may not be suited to the fast-changing environment which is increasingly the norm,” one said.
Of particular interest is that the above results are broadly similar regardless of whether the function is in-house or outsourced, despite the fact that for outsourced functions chairs place greater reliance on Internal Audit. These results reinforce the need to ensure key stakeholder expectations are both clearly articulated and aligned with the plan of work and structure of Internal Audit.
The results also indicate that there is scope for Audit Committees to focus further on:
• Being crystal clear on their expectations of Internal Audit, what is required for ‘met expectations’ versus ‘significantly exceeded expectations’.
• Defining the ‘value’ Internal Audit is expected to provide for each of its stakeholders (fundamental assurance over the basics/process improvement/cost reduction etc) and what the appropriate balance is between those.
• Enhancing processes for assessing Internal Audit effectiveness and measuring whether or not ‘value’ is being added.
So who will be the Internal Audit leaders in the future?
There was fair degree of consensus around key characteristics of high performing head of Internal Audit. The ideal individual, in addition to knowing their trade and being knowledgeable about the business, will be an effective communicator across all levels of the organisation: “A skilled diplomat, respected and able to work the organisation,” or “Challenging but fair, able to draw the line between the perfect solution and the pragmatic solution,” respondents said. Interestingly, approximately third of respondents were looking for an individual who was ‘a strategic thinker, innovative and adaptable’.
Underpinning the above, three key themes emerged around the chairs’ expectations to which Internal Audit will need to respond:
• Look forward not back. In the increasingly fast-changing business environment in which we operate, Internal Audit will need to take more proactive approach in anticipating future changes, events and issues and how those will impact the risks and controls of the organisation. They will need to get better at joining the dots across the organisation and spotting emerging trends and themes. They should have key role in supporting the board and Audit Committee to identify and respond to the risk, and control impacts of the future changes.
• Increase agility. Coupled with more forward-looking perspective, Internal Audit will need to be more agile and flexible, potentially moving from the traditional ‘annual plan’ to ‘rolling quarterly plan’. We heard frequent comments to the effect that Internal Audit did review because it was on the plan despite circumstances changing as result of which the effort would have been better directed elsewhere.
• Audit what you should, not just what you can. To respond effectively to the above expectations, Internal Audit is likely to need to ‘up skill’ to ensure it is able to deliver what is required. Particular areas that were frequently cited include IT risks and controls, project effectiveness, treasury and process improvement.
So how will Internal Audit be structured to deliver against these expectations?
Approximately half of the organisations taking part in the survey were fully or predominantly outsourced. Given that only 28 percent of participants considered outsourcing to be the optimal model, the results imply an emerging trend towards co-sourcing model which would operate along the following lines:
• Establish the right plan, balance of fundamental assurance and value-add.
• Build in contingency to account for likely changes and to allow flexibility.
• Ensure clarity on, and buy into, what is not being covered.
• Identify the right resources, volume and skill types to deliver the plan.
• Deliver the components which you can competently in-house.
• Co-source the remainder with one or more suppliers, establishing preferred supplier relationships where possible.
• The above steps drive the budget rather than allowing budget to drive coverage.
Many chairs are interested in enhancing the performance and effectiveness of their Internal Audit functions. However, finding suitable candidates is proving tough in the current highly competitive New Zealand labour market.
Certainly in the short to medium term, the skills shortage in New Zealand is likely to reinforce the move towards co-source type model for Internal Audit.
This article is an extract from the PricewaterhouseCoopers survey, full copy of which can be obtained from [email protected] or via the website at www.pwc.co.nz”
Nick Betts is director in the PricewaterhouseCoopers national Internal Audit team.
