A ‘Coming Out’ for Internal Audit

18.02.2011
Before the Sarbanes-Oxley Act of 2002 -- the government’s response to the infamous years of Enron, WorldCom and Adelphia -- the internal audit function focused largely on financial reporting and compliance. “It wasn’t surprising,” says Paul Sobel, chief audit executive with Georgia-Pacific and an Institute of Internal Auditors director and executive committee member. While internal auditors can offer a range of skills, he says, they “are known to be well-versed in financial controls and reporting.”

But while those skills remain critical, several other issues are rising in importance these days, shifting the focus of many internal auditors’ responsibilities, and requiring some slightly different abilities. Those are the findings of a report by the , based on input from more than 13,500 survey participants in 107 countries.

Respondents identify several areas that expected to assume greater importance over the next five years: corporate governance, enterprise risk management, strategic reviews, ethics audits, and the migration to International Financial Reporting Standards. While regulatory compliance and audits of financial risks and internal controls remain important, they’ve receded some. Many companies have become more skilled in these areas, reducing the level of attention needed from internal audit, Sobel says.

‘Follow the Risks’

These shifts reflect internal audit’s ongoing need to align itself with the risks companies are facing, notes Richard Chambers, the IIA’s president and CEO. “The trends we see are indicative of what we view as the big enterprise risks facing the corporate and public sector.” While many people assume that internal audit essentially is an extension of the external audit process, that’s not necessarily the case, he adds.

Given the financial crisis of the last two years, investors and creditors increasingly expect companies to implement sound corporate governance policies, along with strategies for managing operating risk. Internal auditing is adjusting its focus to help companies meet these needs. For instance, internal auditing may check that a company’s processes for issuing contracts incorporate proper controls. “The mantra I espouse is, ‘Follow the risks,’” Chambers says.