The new normal of internal audit.

Internal audit has taken great strides towards maturity. The profession is evolving rapidly, however, as internal auditors we must stay ahead of the curve to remain competitive and stay relevant within the business. The path from impossible, to probable, to new normal used to take years. Now it seems like a new normal emerges more often. Traditional methods that have been commonly leveraged are becoming outdated sooner than expected, and in audit that leaves us in the “in-between.” Corporate failures are becoming characteristic of the new millennium. This new reality has challenged the perception and tolerance of key stakeholders towards the organizational management of risk.

Rapidly accelerating pressures are fueling the need for the internal audit profession to transform its thinking from being financial controls-centric to shareholder value-centric. Globally, the audit profession is in dire need of paradigm re-alignment to help key stakeholders to meet soaring risk governance expectations. To survive and thrive, the internal audit function needs a much higher tolerance and preparedness for uncertainty. The profession has to quickly respond and adapt to the “new normal”; agile and future-focused internal auditing.

The following are some pertinent areas that will allow you to respond and adapt to the new normal.

Staying Ahead of Risk

The only sustainable advantage internal audit can create for itself is staying ahead of risk. We need to focus more on business objectives and strategies rather than having a siloed view of risk registers. I’ve noticed that risk registers mostly don’t depict residual risks and are not tied to a company’s top value creation objectives. We need to focus more on success rather than avoiding failure.

Further, we as audit professionals should put more emphasis on auditing the risks that impact today and tomorrow, not limiting our focus to what has happened in the past. Focus on preventing internal control or risk issues proactively, rather than identifying them when they already exist. For example, picture internal auditors as a crime scene investigators. They arrive at the crime scene only to point out there’s a dead body. They don’t attempt to draw any conclusions tied to how the crime was committed if there was a motive, or how the person was killed. Is there any value in that?

More importantly, isn’t the real value tied to preventing a crime from being committed in the first place? In this example, the real value-add would be ensuring there are controls that would prevent a dead body. This means achieving success is linked to management. If management implements a new system without sufficient controls or security, when we had the opportunity to warn them, it reflects as a failure on internal audit’s part. Either we failed to identify the issue, to persuade management it was important, or to work with them on corrective actions that addressed the problem.

Is there value in learning that the road in front of the house you lived in last year is being repaired? You only want to know about road conditions where you are likely to drive now or in the future. Similarly, internal audit needs to provide assurance and consulting advice on the risks of today and tomorrow. Telling management what has been a problem in the past has limited value. I would say, my interest is in the future because that’s where I’m headed.

Delivering the Greatest Value to Audit Clients

The board and upstream management really want to see internal audit add value to the business. We need to make sure that we deliver the value that is greatest to our audit clients — and for most of our board and audit committee clients, that is assurance that risks are being managed at desired levels.

Here’s an example that might help understand my point of view. If you’re about to jump out of an airplane and I’m the only other person in the cabin, what’s more valuable to you?

  1. I inform you that I have looked at your procurement process and there is an opportunity to save 25 percent the next time you purchase a parachute, or
  2. I inform you that I have checked your parachute using the recommended safety checklist (which you approved) and everything checks out well.

The point is that there’s a huge value in assurance. An executive or board member will place high value on the peace of mind he will obtain from an assurance engagement that tells him or her that the controls over a risk of importance to him or her are operating effectively as desired. When you’re running a business, you need to know that the controls over the risks that might impair your ability to succeed can be relied upon. You need to know that the enterprise will perform as you need it to if you are to achieve your objectives.

Managing Reputation

I feel, that the most significant non-financial cost may be the negative reputation of internal audit function throughout the organization. We should invest heavily in relationship building with all key stakeholders. Studies indicate that if an auditor is likable and delivers a well-organized argument, managers tend to comply with his suggestions, even if they disagree and the auditor lacks supporting evidence. It’s evident that maintaining a likeable personality and establishing a good relationship with key stakeholders does help internal audit a great deal and it is very much possible and achievable.

Too many people succumb to the belief that being likeable comes from natural, unteachable traits that belong only to a lucky few; the good-looking, the fiercely social, and the incredibly talented. It’s easy to fall prey to this misconception. When I speak to smaller audiences, I often ask them to describe the most likeable people they’ve ever worked with. People inevitably ignore innate characteristics (intelligence, extraversion, attractiveness, and so on) and instead focus on qualities that are completely under people's control, such as approachability, humility, and positivity. We must focus on developing these traits as these are an important prerequisite for increasing internal audit’s influence and persuasiveness. Being persuasive requires more than just technical expertise and simply having facts to support a perspective. Persuasive auditors leverage their relationships with others and the information they possess to get others to act on corrective action plans and implement suggestions for increased efficiency.

The Way Forward

We are going through really challenging times of rapid change & evolution. The future may bear little resemblance to the past, and only the most forward-thinking audit professionals will survive the transition. Vision to conceive long-term is going to be the difference between success and failure. Internal auditors must be in a position to predict the weather, rather than just reporting it.

This November I’ll be speaking on the topic of “Adapting to the New Normal for Internal Audit” at MISTI’s SuperStrategies Conference & Expo. My session will put a new spotlight on the evolving role of internal audit professionals. We’ll discuss how to develop the future focused internal audit function to concentrate on where the risk is going to be, rather than where it’s been. We’ll also explore how internal audit functions can accelerate their evolution from where they are to where they should be – defining their True North.


 The Roaming Platypus