The strategic Potential of Internal Audit Risk

June 2017

The Strategic Potential of Internal Audit Deliver Greater Value to Senior Management and Boards

A white paper by William C. Watts, CIA

Audit / Tax / Advisory / Risk / Performance

Smart decisions. Lasting value.™

The Strategic Potential of Internal Audit

Internal audit committees have an opportunity to deliver greater value to organizations due to powerful changes reverberating throughout the world. Major shifts are occurring politically, resulting in trade-related and regulatory ramifications, and digital advances have radically altered business operations.

Internal audit departments should be aware of changes happening on multiple fronts: Geopolitics. Internal audit committees should be aware of external risks in order to anticipate the potential effects on organizational strategy and performance. The rise and fall of emerging markets, for example, can have a major impact on organizations that are sourcing materials from abroad.

Regulations. Along with national rules and regulations, internal audit departments need to keep up with new global regulations that could affect overseas operations and possibly also be enacted in the United States.

2

June 2017

Corporate reporting. Regulators in many parts of the world are looking for additional narrative of accounting and transactional events, including details on the significance of nonfinancial risks. Companies may need to provide deeper analysis of results, comparative benchmarks, and performance metrics.

To deliver higher-value insight, internal audit departments need to develop a “triple strength” advantage: • Industry-specific knowledge and insight • Skills to audit and mitigate risks • Technology savvy for improved performance and risk management

Crowe Horwath LLP

Challenges to a More Strategic Role Performing the usual compliance-related duties while also helping to manage risks for improved business outcomes, internal audit committees face numerous challenges: • Technology advances – big data, analytics, cloud computing, mobile devices, electronic sensors, the Internet of Things, robotics, and more – can drive higher performance yet also introduce additional risks.

• Stakeholders and events sometimes redirect and strain resources, making it difficult to complete an audit plan. Profit pressures may mean departments expect internal audit committees to do even more with less.

• International locations require knowledge of cultures, business practices, local laws, and regulations, and may require fluency in another language.

• Multiple functions – such as compliance, legal, and finance – conduct risk assessments with specific agendas, thereby fragmenting and sometimes duplicating efforts.

• Governance, risk, and compliance tools may be outdated, with niche solutions lacking smooth integration.

• A tight talent market makes it difficult to rebalance areas of expertise.

One of the first steps when looking for ways for internal audit committees to add value to an organization is to review the internal audit mandate, which reflects the expectations of management and board members. In addition, internal audit departments need experienced staff who are equipped with the requisite skills and industry and technology knowledge.

Operational improvements are needed, and, to change long-held perceptions, internal audit departments also will need to find ways to effectively communicate their increased value.

crowehorwath.com

3

The Strategic Potential of Internal Audit

Update the Mandate for Internal Audit Business executives in multiple industries indicate they are open to internal audit committees volunteering information proactively rather than waiting to be asked.

But internal audit committee members may lack the experience and knowledge to offer higher-level business advice.

Demand is now growing for internal audit departments to add value to an organization through consulting on business operations.

Updating the mandate will call for realignment of audit coverage with the major business and operational initiatives and risks facing an organization.

Some historic perspective may help to explain why. In the early years of the new century, the complexity of the SarbanesOxley Act of 2002 shifted the focus of internal audit departments to financial controls. The recession of 2007-2009 prompted additional controls. In response, internal audit departments hired staff who possessed formidable accounting and financial skills but were short on business and industry acumen.

An existing mandate may call for internal audit professionals to be part of the team looking at areas such as system implementations, complexity of transactions, and major change initiatives. But internal audit committee members now need to be cognizant of additional opportunities and risks in extended global enterprises:

Updating the internal audit mandate will call for realignment of audit coverage with the major business and operational initiatives and risks facing an organization.

4

June 2017

• International expansion • Relocation of data infrastructure to the cloud • Coordination with third-party suppliers, their vendors, and subcontractors throughout the world Given limited resources, there is a definite need to leverage technology when possible to free up time to focus on higher-risk, more complex areas. Taking this approach can enable internal audit to focus on strategic areas such as acquisitions, divestitures, joint ventures, new regulations, and international expansion.

Crowe Horwath LLP

Get Creative in Assembling Talent Attracting and retaining top talent will help improve perceptions of internal audit. The demand for high-quality talent, however, exceeds supply, a condition that is likely to continue. Organizations compete for talented internal auditors with internal audit providers and professional services firms around the globe, as well as with other business units within the organization.

Expertise is needed in areas such as cybersecurity and third-party risk management, and will be needed in the coming years to manage as-yet-unknown hazards. Consequently, there is great need for people who might not have traditional backgrounds in audit and finance, yet who are business-minded, analytical thinkers and strong problem solvers.

With a highly competitive market for talent, it might be advisable to look beyond traditional recruiting methods. In addition to time-tested hiring methods, organizations could also increase training, supplement internal audit committees with professionals from other departments, and build relationships with professional services providers. Retaining high-quality talent calls for training programs that are tailored to each industry sector and that provide the right skills to internal audit professionals.

Also, consider reversing the career model in which employees are plucked from internal audit for employment in business units.

Instead, consider recruiting people from the organization’s business units. Employees with engineering and technology talent, for example, might be persuaded to become internal auditors.

Emphasizing opportunities for growth and career development can help make internal audit a destination rather than a mere rest stop or stepping stone.

crowehorwath.com

5

The Strategic Potential of Internal Audit

Build Operational Flexibility and Speed Addressing operational improvement, internal audit can become a dynamic and proactive department, anticipating and adapting to change with the organization and its business environment.

To do this, internal audit departments must deepen their knowledge of the business, its industry, and competitors.

Internal audit professionals can build on relationships with members of the audit committee, executive management, and leaders of business units. To be understood and perceived favorably, internal audit committee members should be sensitive to the preferred modes of communication used by business managers.

Internal audit departments can spark conversations by abandoning standard questionnaires in favor of open-ended questions such as: • Why are we doing this? • What are the expected results? • How will we accomplish this?

Answers to open-ended questions are likely to provide insight into strategic objectives and business priorities.

6

June 2017

To keep pace with dynamic business environments, internal audit departments need to turn away from large and unwieldy operating models that make it difficult to respond effectively to event-triggered risks and changes. For example, internal audit committees should refresh risk assessments and audit plans throughout the year to allow them to pivot and reallocate resources based on changing risks. The ability to rapidly alter course is essential to making internal audit more effective.

Experience and anecdotal evidence indicate that investments in technology are consistent markers of highly effective internal audit departments. Internal audit may need to update governance, risk, and compliance tools, and improve integration with niche solutions.

Technology solutions, in addition to reducing time-consuming manual effort, also offer automated analysis of data in real time. Data analytics can lead to insight to improve operational performance and identify emerging risks. Internal audit leaders are adopting proactive approaches to fraud prevention such as automated risk assessments and monitoring in real time, and data analytics for early detection.

Crowe Horwath LLP

Measure and Communicate Internal Audit’s Value To secure a place at the strategy table, an internal audit department must measure and communicate its value to management, and be open to ways to provide a greater contribution.

An internal audit committee can re-evaluate standard metrics – such as the amount of time needed to issue reports or to resolve audit findings – to emphasize how it can have an impact on the bottom line. Additional metrics might include cost recoveries, process improvements, and reduced-cycle times.

To demonstrate greater relevance, an internal audit committee can align its performance metrics and audit plans with business strategy and key organizational initiatives. A value scorecard can be tied to metrics used elsewhere in the organization so internal audit is evaluated with similar performance indicators.

Conducting annual assessments of perceived quality helps to detect gaps between current and desired states, and to spur improvement ideas and plans. An expanded review of quality could go beyond adherence to internal audit standards to consider knowledge, methodology, technology, and staffing.

An internal audit department also can combine all aspects of assurance in an organization into a single comprehensive report that covers external audit, compliance, legal, regulatory, finance, and strategic issues. A consolidated report could deliver comprehensive assurance that also conveys the efficiency and higher business value of internal audit.

crowehorwath.com

7

Opportunity Is Knocking Rather than merely following orders and established routines, internal audit departments have an opportunity to become a more proactive force in the organization. Some of the prerequisites for earning a place at the strategy table include revising the internal audit mandate, beefing up staff capabilities, and aligning operational changes with the achievement of business objectives. By linking knowledge of controls and risks to strategic objectives, internal audit professionals can work productively with stakeholders to assume the right risks at the right time.

Learn More Bill Watts Principal +1 614 280 5227 william.watts@crowehorwath.com

crowehorwath.com

In accordance with applicable professional standards, some firm services may not be available to attest clients.

This material is for informational purposes only and should not be construed as financial or legal advice. Please seek guidance specific to your organization from qualified advisers in your jurisdiction. Š 2017 Crowe Horwath LLP, an independent member of Crowe Horwath International crowehorwath.com/disclosure

RISK-17010-027A