©Saklakova/ISTOCK/THINKSTOCK
Stakeholders have many important questions to ask as expectations change for internal audit functions. Do we have the specialized skills and capability to address the most relevant organizational risks? Have we embedded analytics in everything we do? And most importantly: does our internal audit department have the impact we expect?
Through the years, there is a reluctant acceptance that internal audit does not enjoy as much influence as it could. Many heads of internal audit are challenged in securing the types of skills and capabilities they need to be highly effective. Others say internal audit is not positioned properly within their organization to have the maximum possible impact. And, too often, internal audit is reduced to a compliance function, unable to focus on the greatest opportunities and risks.
Speaking about a recent survey of Chief Audit Executives conducted by Deloitte, "Evolution or irrelevance? Internal Audit at a crossroads," Terry Hatherell, Internal Audit Leader, Deloitte, said, “Only 28 percent of the heads of internal audit believe that their internal audit organizations are having strong impact and influence within their organization. And 16 percent of those chief audit executives believe that their internal audit departments are having little to no impact and influence, and that is very concerning and very troubling.”
Oftentimes, internal audit departments do not have the right skills and capabilities to undertake the kinds of activities to be relevant and impactful within their organization. In response to this challenge, more internal audit heads plan to use alternative resourcing models in the coming three to five years to gain the kinds of skills they need.
Co-sourcing, for instance, is a popular option. “Our research shows that co-sourcing to get the specialized skills that are needed will continue to be the most prevalent model,” Hatherell says. “Additional alternative resourcing models such as guest auditor programs and rotation programs were highlighted in the research.”
Though many internal audit departments are embracing analytics to drive deeper insight and provide greater foresight, others are barely scratching the surface. Hatherell points to a lack of understanding of what he calls “the art of the possible.”
“Many internal audit departments would say that they're using analytics, but they're using analytics that have been around for 20-plus years,” Hatherell says. “In our research, one of the findings was that most heads of internal audit would rate their capability from an analytics standpoint at the basic level, meaning they're just using analytics in simple profiling and sampling. In the many follow-up discussions that we've had with heads of internal audit, they're just not aware of the more advanced analytics and predictive tools that leading internal audit departments are using to provide greater value, to provide deeper insight, and to provide foresight to their stakeholders.”
Another challenge hindering analytics adoption is data quality, which nearly half of the respondents cited as one of their biggest barriers to using analytics. Addressing data quality begins with developing a roadmap, says Hatherell. “Determine where we, as internal audit, want to be from an analytic standpoint in terms of our capabilities, the tools that we use, how we use it in our methodology and approach, and then put a plan in place to get there, notwithstanding any concerns that may exist with respect to data.”
Most advanced internal audit departments started analytics initiatives with a pilot. “We believe that those internal audit departments that aren't using analytics simply need to get started and choose a pilot, and use that pilot to overcome some of their fears, to allow them to see the tangible benefits that result from using analytics in their internal audit activities.”
Stakeholders must reflect on whether their internal audit departments are having the kinds of impact and influence they'd like to see, and whether some of the challenges identified in the research exists within their organizations. Now is the time to ask the tough questions, says Hatherell.
“Just yesterday I was meeting with a number of board members as well as CFOs in one of the roundtables that we have. I would characterize their response as surprised, reflective, and concerned, and from the discussion, I believe they will go back and ask the tough questions of their internal audit departments to try and understand whether they have the same challenges that our research has borne out.”