Richard Chambers President and CEO Institute of Internal Auditors

Dramatic changes in business, driven largely by rapid technological advancements, require the internal audit profession to adapt its techniques, skill sets, and scope of work if it hopes to enhance services in the new dynamic.

A new report, released by The Institute of Internal Auditors (IIA) Audit Executive Center at The IIA’s 73^rd International Conference in London, offers a bold strategy to meet those demands and help the profession thrive.

The 2014 The Pulse of the Profession identifies strategies for advancing internal audit in a report titled “Enhancing Value Through Collaboration: A Call to Action.” The report examines changing expectation from key internal audit stakeholders based on the findings of four major industry surveys released in the first half of 2014. It then zeros in on five key strategies to meet those expectations, primarily through communication and collaboration with stakeholders.

“Traditionally, internal audit has been reactionary, but that approach is changing,” IIA President and CEO Richard F. Chambers, CIA, CGAP, CCSA, CRMA, says in the report. “Our value to an organization depends on furthering this change in course.”

Indeed, the Pulse report finds agreement within industry surveys for expanding internal auditing’s role. Stakeholders are seeking, if not demanding, guidance from internal auditing to address strategic and emerging business risks.

But it also identifies gaps — sometimes significant — in expectations of and confidence in the profession’s ability to deliver assurances and service in new areas. The key to enhancing internal audit services, therefore, is for chief audit executives (CAEs) and other heads of audit to recognize and address those gaps.

“Every company, situation, and leader is different,” IIA Vice President of Professional Services Gina Eubanks, CIA, CCSA, CRMA, says in the report. “Are you ready to sit down with your stakeholders to understand how they define and measure success of internal audit?”

Beyond its analysis of the four major surveys, the report’s thrust is promoting five strategies for internal audit success:

Improve upon alignment with expectations of key stakeholders.

Setting the tone for alignment by working with stakeholders is imperative. According to KPMG International’s Global Audit Committee Survey, 2014, the first step is to “recognize that internal audit is most effective when it is focused on the critical risks to the business, including key operational risks and related controls — not just compliance and financial reporting risks.”

CAEs should consider presenting strategic plans, spanning three to five years, that lay out changing levels of assurance services and advisory services in accordance to what internal control structures will permit.

Assume a leadership role in coordinating the second and third lines of defense

The IIA strongly advocates educating stakeholders on the three lines of defense model – management controls, risk management, and internal auditing – for dealing with risk. The IIA’s study found confusion specifically over just where those lines are drawn, which could create an opportunity for expectation gaps to grow. In The IIA’s Pulse survey, 64 percent of respondents say those lines are not clearly, somewhat, or moderately defined.

Enhance internal auditing’s capability to address critical, strategic business risks

As concerns among key stakeholders, chiefly management, audit committees and boards, shift from traditional controls and finance issues to strategic business risks, internal audit must adapt to meet changing priorities.

For example, KPMG International’s Global Audit Committee Survey, 2014, found respondents wanted the audit function to “devote more time and/or sharpen its focus” on areas outside of the corporate governance area typically associated with the internal audit function. Specifically, respondents say selected management process (65 percent), information technology and data management (58 percent), and operational risks (52 percent), and others well ahead of corporate governance (27 percent).

Develop and implement knowledge and talent-acquisition strategies

To expand its responsibilities, the internal audit function must possess the requisite talent in non-traditional areas, such as the risk management process, information technology, and operational risks.

The Pulse of the Profession survey found skills being recruited or built into audit functions were more likely to be general than industry specific. Specifically, CAEs responding to the survey say they are more likely to recruit based on analytical/critical thinking (75 percent), communications skills (58 percent), risk management assurance (44 percent), and information technology (41 percent) versus industry-specific knowledge (36 percent).

Success hinges on not only identifying the skills to meet these changing demands but also in the recruiting strategies to find workers with relevant skills.

“Acquiring the right people is not the end, it’s the means,” Chambers says, “Acquiring the right people is the means toward having the knowledge and capability in the organization to address a full spectrum of risk.”

Become a trusted advisor to the audit committee and executive management

The final strategy is the culmination of successfully carrying out the first four, the report finds. Experienced CAEs who succeed in understanding stakeholder expectations, addressing strategic business risk, and nurturing necessary talent can comfortably form advisory relationships with stakeholders. What’s more, those relationships will make it easier to educate these stakeholders about emerging risks and mitigation strategies.

About The IIA

Established in 1941, The Institute of Internal Auditors (The IIA) is a professional association for internal auditors around the world, with headquarters located in Altamonte Springs, Fla. The IIA serves more than 180,000 members from 190 countries, providing professional development, guidance, and certification.