How to handle new challenges facing internal auditing

We have discussed what internal audit is and is not and looked at an overview of the principles that guide internal auditing over the past month. Today, I would like us to explore the current status of the internal audit profession and where it is headed so that we, as internal auditors in Rwanda, can position ourselves to ensure that we remain relevant and add value to our stakeholders. Annually, PricewaterhouseCoopers (PwC) carries out a survey on the state of the internal audit profession. In 2012, PwC released the 8th Annual State of the Internal Audit Profession Study, which focused on the rising importance of risk management and the increasing expectations of internal audit’s contribution to the effort. For this study, PwC adopted an “outside-in” look at the internal audit profession through points of view of nearly 100 stakeholders, including board members and chief executives, in one-on-one interviews, over 660 stakeholders and 870 chief audit executives through an online survey. The study was carried out in 64 countries globally and covered 16 industry sectors. Rwanda did not participate in this study. However, stakeholders will be invited to participate in future surveys. The key message that came from respondents was that the risk environment had changed and was perceived as having gotten riskier. They observed that risk profiles in the past years had been changing in complexity (due to linkages between global trade, financial markets and supply chains), unpredictability (owing to privacy breaches, environmental factors and financial uncertainty), variety (because of global diversification and culture challenges) and speed (thanks to social media and the ability for messages to reach wide audiences fast). Being resilient by effectively managing these risks is a key priority for most chief executives and heads of institutions around the world. Stakeholders indicated that they valued internal audit’s contribution and recognised its importance in the organisation. However, they also believed that internal audit pays too little attention to the majority of risks affecting the organisation, suggesting that there is a misalignment of internal audit effort and stakeholder value obtained. They indicated that they wanted more from internal audit and saw the function as having an important role to play in monitoring top risks by focusing on all critical risk areas, providing an insightful and objective viewpoint and providing concise and clear communication. Given the change in the risk landscape and higher stakeholder expectations, the “floor” for effective internal audit has now risen. Over and above focusing on risks related to operations, which is what most auditors do, internal auditors need to understand the strategy and objectives of their organisations and the key risks that could impede achievement of these objectives, then design their audit plan to cover these key risks. This is often referred to as the risk-based approach to internal audit. Internal auditors need to ensure that they navigate the new risk landscape by thinking and acting strategically, aligning resource allocations to areas of greatest risk and leveraging from the second line of defense (risk management functions). They need to provide deeper insights by investing time to understand the business of their organisations, delivering advice and best practices and leveraging the use of specialists when required. They also need to build trust with stakeholders through ongoing dialogue, simplify reporting thereby making it consumable and also by taking a holistic view of risks by ‘connecting the dots’. To reach this floor, internal auditors will need to exhibit eight key attributes; focus on critical risks and issues, align value proposition with stakeholders’ expectations, match their talent model to the value proposition, as well engage and manage stakeholder relationships. Others are enable a client service culture, deliver cost-effective services, leverage technology effectively and promote quality improvement and innovation. From the study, both stakeholders and internal auditors identified two key barriers that keep internal audit from rising to this new floor, that is organisational and cultural resistance and a lack of internal audit resources and expertise. However, respondents also cited lack of appropriate mandates for the internal audit function, lack of awareness of internal audit’s capabilities by stakeholders and lack of budget. Focused success and the personal effectiveness of the chief audit executive are key to building trust and overcoming organisational and cultural resistance. It is important to have the chief audit executive or head of internal audit as an executive role and building respect and trust-based relationships. A sound talent development strategy, rotation of staff with the business and effective use of co-sourcing are the best methods of addressing resource and expertise gaps. I would like to close our discussions on internal auditing by leaving you with a few questions to ponder: How well-aligned is your audit plan with the critical risks facing your organisation? Do you, as internal audit, provide a point of view to help the organisation or business improve its responses to risk? How effectively do you, as internal audit communicate, with your stakeholders? Are you performing at the new floor? The writer is a risk assurance services manager at PricewaterhouseCoopers Rwanda Limited