But while those skills remain critical, several other issues are rising in importance these days, shifting the focus of many internal auditors’ responsibilities, and requiring some slightly different abilities. Those are the findings of a report by the , based on input from more than 13,500 survey participants in 107 countries.
Respondents identify several areas that expected to assume greater importance over the next five years: corporate governance, enterprise risk management, strategic reviews, ethics audits, and the migration to International Financial Reporting Standards. While regulatory compliance and audits of financial risks and internal controls remain important, they’ve receded some. Many companies have become more skilled in these areas, reducing the level of attention needed from internal audit, Sobel says.
‘Follow the Risks’
These shifts reflect internal audit’s ongoing need to align itself with the risks companies are facing, notes Richard Chambers, the IIA’s president and CEO. “The trends we see are indicative of what we view as the big enterprise risks facing the corporate and public sector.” While many people assume that internal audit essentially is an extension of the external audit process, that’s not necessarily the case, he adds.
Given the financial crisis of the last two years, investors and creditors increasingly expect companies to implement sound corporate governance policies, along with strategies for managing operating risk. Internal auditing is adjusting its focus to help companies meet these needs. For instance, internal auditing may check that a company’s processes for issuing contracts incorporate proper controls. “The mantra I espouse is, ‘Follow the risks,’” Chambers says.
As these shifts have occurred, the internal auditor’s profile has grown, says John Higbee, a member of the audit committee with Rex Energy Corp., based in State College, Pa. Just a few decades ago, internal audit rarely was considered members of a company’s leadership team. Not any more. “They’re looked upon by the audit committee as their eyes and ears,” Higbee says.
What’s more, because they analyze processes across departments and look “into the bowels of the organization,” internal auditors can help companies operate more effectively, says Mary Beth Vitale, chair of the audit committee with CoBiz Financial, a Denver-based financial services firm. “They have a unique view of the company.”
Arm’s-Length No More
At the University of Colorado, the change has been noticeable, says Joseph Tinucci, assistant treasurer. Until a few years ago, internal audit’s role “was to review after-the-fact, stay an arm’s length away from any processes or procedures they reviewed – that is, not give any advice – and find problems.” More recently, the audit function has taken a more consultative approach; for instance, they’ve helped set up security and internal controls as new systems have been implemented. “This change in perspective – from corporate cop to internal consultant – is refreshing and long overdue,” Tinucci says.
In order for these changes to occur, however, the skill set required of the internal audit staff has to change, as well. While knowledge of accounting principles remains important, it’s no longer enough, Chambers says. Industry expertise is critical in enabling auditors to offer sound insight into risk management and operating processes. Strong interpersonal skills also are key; with them, internal auditors are better able to steer their colleagues in the right direction, rather than focus on fixing problems after they’ve occurred, Vitale adds.
Sobel offers his thoughts on what these changes mean for CFOs: “CFOs and CEOs can raise the bar for the internal audit executive and say, ‘Given the challenges in the evolving business environment, we will need more from you and your function in the upcoming years.’”