Internal Audit Value Proposition – Time to Question the Status Quo
Imran Zia – MSc, ACA ,FCCA,CIA,CISA,CFE,CRMA,GRCP, Director, Audit & Assurance
Government of British Columbia, Canada

Internal Audit Value Proposition – Time to Question the Status Quo

Internal audit has taken great strides towards maturity. The profession is evolving rapidly, however, as internal auditors we must stay ahead of the curve to remain competitive and stay relevant. Corporate failures are becoming characteristic of the new millennium. This new reality has challenged the perception and tolerance of key stakeholders towards the organizational management of risk.

Globally, the audit profession is in dire need of paradigm re-alignment to help key stakeholders in meeting soaring risk governance expectations. To survive and thrive, the internal audit function needs a much higher tolerance and preparedness for uncertainty. The profession must quickly respond and adapt to the “new normal”; agile and future-focused internal auditing.

The pandemic has pulled back the curtain to show us a glimpse of the future. It has put on display the amazing speed of emerging risks; the global interconnectedness of businesses and society; and how we react to adversity as internal audit professionals.

Staying Ahead of Risk

The only sustainable advantage internal audit can create for itself is staying ahead of risk. We need to focus more on business objectives and strategies rather than having a siloed view of risk registers. We need to focus more on success rather than avoiding failure.

Rather than asking, “What can go wrong”, we now need to ask, “What needs to go right”.

This change of focus brings a whole new domain of value creation into perspective.

We should put more emphasis on auditing the risks that impact today and tomorrow, not limiting our focus to what has happened in the past. Focus on preventing internal control or risk issues proactively, rather than identifying them when they already exist. Let’s picture internal auditors as a crime scene investigator. They arrive at the crime scene only to point out there’s a dead body; by then damage is already done; and internal audit is just reporting it. Isn’t the real value tied to preventing a crime from being committed in the first place? The real value-addition would be ensuring there are adequate controls that would prevent a dead body.

This means seeing our success as linked to the success of management. If management implements a new system without sufficient controls or security, when we had the opportunity to warn them, it reflects as a failure on internal audit’s part. Either we failed to identify the issue, to persuade management it was important, or to work with them on corrective actions that addressed the problem.

Is there value in learning that the road in front of the house you lived the last year is being repaired? You would only want to know about road conditions where you are likely to drive now or in the future. Similarly, internal audit needs to provide assurance on the risks of today and tomorrow. Telling management what the problem in the past has been has limited value. I would say, my interest is in the future because that’s where I’m going to spend rest of my life.

 

Delivering the Value that is Greatest to Our Clients

The board and upstream management really want to see internal audit add value to the business. We need to make sure that we deliver the value that is greatest to our audit clients; and for most of our board and audit committee, that is assurance that risks are being managed at desired levels.

Here’s an example that might help understand my point of view. If you’re about to jump out of an airplane and I’m the only other person in the cabin, what’s more valuable to you?

  • I inform you that I have looked at your procurement process and there is an opportunity to save 15 percent the next time you purchase a parachute, or
  • I inform you that I have checked your parachute using the recommended safety checklist (which you approved) and everything checks out well.

The point is that there’s a huge value in assurance. An executive or board member will place high value on the peace of mind he will obtain from an assurance engagement that tells him/her that the controls over a risk of importance to him/her are operating effectively as desired. When you’re running a business, you need to know that the controls over the risks that might impair your ability to succeed can be relied upon. You need to know that the enterprise will perform as you need it to if you are to achieve your objectives. This precisely is the assurance & comfort that is expected of us; and we must provide this to our stakeholders.

 

Becoming a “Likeable” Auditor

I feel that the most significant non-financial cost may be the negative reputation of internal audit function throughout the organization. We should invest heavily in relationship building with all key stakeholders. Studies indicate that if an auditor is likable and delivers a well-organized argument, managers tend to comply with his suggestions, even if they disagree and the auditor lacks supporting evidence. Maintaining a likeable personality and establishing a good relationship with key stakeholders does help internal audit a great deal and it is quite achievable.

We must focus on developing meaningful relationships with key stakeholders, as these are an important prerequisite for increasing internal audit’s influence and persuasiveness. Being persuasive requires more than just technical expertise and simply having facts to support a perspective. Persuasive auditors leverage their relationships with others and the information they possess to get others to act on corrective action plans and implement suggestions for increased efficiency.

The Way Forward

We are going through challenging times of rapid change & evolution. The future may bear little resemblance to the past, and only the most forward-thinking audit professionals will survive the transition. Vision to conceive long-term is going to be the difference between success and failure. To survive & thrive, internal auditors must be able to predict the weather, rather than just reporting it.

Xpertsleague Admin
Latest posts by Xpertsleague Admin (see all)