Richard Chambers President and CEO Institute of Internal Auditors

A growing number of new Chief Audit Executives (CAEs) are recruited from outside the internal audit profession as organizations demand a diversity of business skills to confront emerging strategic risks, according to the latest Pulse of the Profession survey released recently by The Institute of Internal Auditors' Audit Executive Center.

The survey report, "Continually Evolving to Achieve Stakeholder Expectations," shows that 42 percent of CAEs in North America held positions outside of internal audit immediately prior to becoming CAE. This non-traditional career path, which has its risks and benefits for organizations, aligns with a heightened attention to risk-based planning.

The IIA's Audit Executive Center conducts the Pulse of the Profession survey annually to assess the state of internal auditing by identifying trends and emerging issues in the profession.

Forty-six percent of the nearly 370 CAEs who responded to this year's survey rate strategic business risk as the top priority for executive management, while 28 percent consider it the top priority for audit committees. While business strategy remains a relatively small area (6 percent) of the overall audit plan, according to the survey, follow-up interviews with 24 CAEs reveal that internal audit's approach to audit planning can bridge a perception of misalignment. Successful internal audit functions take into account stakeholder priorities and address them throughout their audit plan.

"Internal auditors must continuously assess the risks facing their organizations and align those assessments with stakeholders' evolving expectations," said Richard F. Chambers, The IIA president and CEO. "Our success as a profession is contingent upon not only securing the resources and talent needed to address key risk areas, but also gaining stakeholder trust that our contribution is focused on the right areas."

As with the emerging CAE career path, competencies for internal auditors are evolving. The Pulse of the Profession survey shows that only 25 percent of CAEs in North America now recruit audit candidates with traditional accounting skills, while 43 percent recruit for business acumen, and 40 percent recruit for industry-specific knowledge. More than 80 percent of CAEs seek new employees with analytical and critical thinking skills, and communications is the second-most demanded competency, at 61 percent.

While the practice of rotating business leaders into the CAE role continues to gain popularity, organizations need to understand the risks as well as the benefits of this trend. CAEs interviewed for the Pulse of the Profession agree that audit executives who come from outside internal audit provide new energy and perspective, deep business knowledge and perspective, and strong internal relationships. On the other side of the discussion, most of those interviewed readily acknowledge that the rotated CAEs' lack of internal audit experience and inadequate aptitude for governance, risks, and controls could present significant challenges.

Other key findings from the study:

    --  The "Three Lines of Defense Model," the model that illustrates the
        division of responsibilities within an organization's risk management
        and internal control functions, is gaining acceptance. However, only 34
        percent of CAEs say their organizations have "very clearly defined"
        essential roles. Based on CAE interviews, organizations generally
        understand management's responsibilities, but distinctions are blurred
        between the second (most commonly risk management and compliance) and
        third (internal audit) lines of defense.

    --  Board members are sensitive to risks involving technology, particularly
        cybersecurity. Indeed, 64 percent of those surveyed indicate board
        concerns about cybersecurity have increased or significantly increased
        in the past one to two years. Internal audit's role in relation to
        information security involves ensuring that the processes and controls
        used in these efforts are working effectively.

    --  Organizations continue to consider internal audit as a critical resource
        for assurance on risk management and internal controls. In fact, 41
        percent of CAEs surveyed predict an increase in internal audit budgets
        during 2014, while 26 percent project increased staffing. Since 2010,
        the Pulse of the Profession has reported an optimistic forecast for
        internal auditing budgets and staffing year after year. Internal
        auditing continues to sustain pre-recession resource levels in most
        organizations, indicating continued stakeholder support in terms of
        overall performance.

"Ultimately, the approach CAEs take when executing their role and managing the internal audit function depends on their understanding of, and alignment with, the expectations of their stakeholders," Chambers said. "Whether you come from within the profession or not, self-preservation as a CAE begins with understanding the business, applying diversity of experiences, and effectively communicating with your stakeholders."

A copy of "The Pulse of the Profession North American Report - March 2014: Continually Evolving to Achieve Stakeholder Expectations" can be downloaded from The IIA Audit Executive Center's website.

About The IIA
Established in 1941, The Institute of Internal Auditors (IIA) is a professional association for internal auditors around the world, with headquarters located in Altamonte Springs, Fla. The IIA serves more than 180,000 members from 190 countries, providing professional development, guidance, and certification. Visit www.theiia.org for more information.

About the Audit Executive Center
An exclusive service developed to support chief audit executives (CAEs) in answering the demands of their evolving roles, the Audit Executive Center empowers its members to perform through delivering unparalleled access to a growing Knowledge Center of nearly 900 pieces of thought leadership and more than 1,200 tools, templates, and planning resources; benchmarking studies and peer-to-peer knowledge sharing opportunities; CPE eligible webinars, roundtables, and networking events; and E-bulletins, news publications, and weekly alerts.

The Institute of Internal Auditors (The IIA)