Anniversaries always present an opportunity to look back fondly and to look forward hopefully. As The IIA celebrates its 75th anniversary, many practitioners find themselves doing exactly that — reflecting on the role and structure of internal audit when it was first organized as a profession and envisioning a future filled with challenges and responsibilities its earliest members may have never imagined. The experts surveyed here — featured on this issue’s cover — represent different countries, industries, and experiences, and have a wide range of views about internal auditing. We asked each of them to talk about an issue that captures the profession’s essence as it moves toward a century of formal organization. Overall, they emphasize change, both in what’s expected of the internal audit function and in the tactics practitioners have at their disposal to carry out their evolving responsibilities.
IIA President and CEO Richard Chambers, in fact, stresses that, from his perspective, internal audit has been in “evolutionary mode” since The Institute was created. “In the early era, we were focused on hindsight,” he says. “As we evolved, we also started to provide insight. Ultimately, the future of internal audit has to include a component of foresight.” That means, he adds, that the art of internal audit is “looking behind, around, and ahead.” With that 360-degree view of the enterprise, an internal auditor can better provide perspective on the risks lying ahead. That’s what will keep the profession focused on the future for the next 75 years.
Angela Witzany, CIA, CRMA, QIAL
Head of Internal Audit, Sparkassen Versicherung AG — Vienna
Senior Vice Chairman, IIA Board of Directors
Keeping talented internal auditors happy is a priority for Angela Witzany. Indeed, she points out, as difficult as finding exactly the right person can be, the tough part of managing exceptional auditors starts once the hire has been made. For example, internal audit is often but one of the stops on a years-long journey to another part of the enterprise — maybe an operational unit or the finance department or the C-suite. “By combining as much technology-based training as possible with an emphasis on soft skills — like broader strategic thinking and a better customer focus — internal audit leaders can prepare their team members for future career possibilities, not just the job at hand,” Witzany says. Also, she stresses, it’s critical to provide a clear path to straightforward promotions for internal audit hires. A recent report from The IIA Research Foundation — Job Satisfaction for Internal Auditors: How to Retain Top Talent — backs her up, pointing out that higher job satisfaction and lower turnover often result when companies put those paths in place. But not every internal audit hire has aspirations to executive success; many simply want to be career internal auditors. “That type of talent needs to be managed, too,” Witzany stresses. “Many new hires have their sights set on internal audit for the long term, and those ambitions should be supported whenever possible.” Regardless, remaining mindful of the diverse needs and interests of staff is paramount to retaining a talented audit team and to meeting the ever-increasing demands of today’s organizations.
Audley Bell, CIA, CPA, CISA, CFE
CAE, World Vision International — Baldwin, N.Y.
You wouldn’t have to go far to find internal audit practitioners who’d agree with Audley Bell that the transformation from compliance-based to risk-based audit represents the most significant operational change the profession has seen in The IIA’s 75 years. “Although value was being derived from the compliance audit approach,” he explains, “many key stakeholders felt the potential of the internal audit function was not being realized. Very little time was spent engaging and collaborating with them.” For those who are still looking to make the transition, he advises starting by seeking input from management, business owners, internal audit staff, and the audit committee. “While it is not possible to satisfy the needs of all stakeholders,” he says, “the objective should be to address those that would yield the greatest value to the organization.” Under risk-based internal audit, practitioners often find increased opportunity for career and professional development and enhanced knowledge of the organization’s operations, he adds. “Most importantly, auditors are better prepared to add value to the organization.” Bell says it also took a while for key stakeholders across the globe to see and appreciate the benefits of the change. But it is now widely accepted — and the benefits are “visible within the organization.”
Karen Brady, CIA, CFE, CRMA
Corporate Vice President of Audit and Chief Compliance Officer, Baptist Health South Florida — Coral Gables, Fla.
Member, IIA North American Board
For Karen Brady, the time has come to give back to the profession through volunteering — something she says younger practitioners may not appreciate the value of. “I don’t think they understand that not only is it important for the profession to volunteer and advocate, but it’s good for the individual, also,” she explains, noting that the contacts established when volunteering are “invaluable.” Volunteers meet peers to discuss issues and compare situations, she says, adding that “in certain circumstances you can meet individuals who may become clients — or even future employers!” Brady points out as well that involvement in professional organizations can raise auditors’ knowledge about internal audit, at a time when it’s more important than ever to be at the forefront of emerging practices. “The one thing that remains constant is the tremendous opportunity we have to learn from one another about issues that impact everyone in the profession,” she says. “In the end, it’s a genuine love for and dedication to the profession that brings volunteers together to elevate internal audit and enhance professionalism.”
Jenitha John, CA (SA), QIAL
CAE, FirstRand Ltd. — Sandton, South Africa
Increasingly, internal audit operates in conjunction with other important assurance functions within an organization. Jenitha John says internal audit should take the lead in making sure that combined assurance is well-coordinated. Combined assurance, she says, is about integrating, coordinating, and aligning the efforts of management and internal and external assurance providers to optimize and maximize the level of risk, governance, and control oversight over its risk landscape. “Internal audit must step up to the challenge and spearhead discovery and execution,” she says. “The internal audit function is well-positioned and has an established network within an organization, which is beneficial in influencing the design of the combined assurance framework.” Topical issues from the CEO, the chief operating officer, and the audit committee chair will influence the agenda of the combined assurance program, she adds, but “certain types of risk warrant more input from specialists and lend themselves to knowledge transfer to internal audit if the combined assurance methodology is adopted.”
Graduate Student,Albers School of Business and Economics — Seattle University
Who better to look to the future of internal audit than a student who’s just beginning to appreciate what the profession has to offer? Zachary Kodjo is pursuing a master’s degree in professional accounting. After attending The IIA’s Leadership Retreat and Conference in September 2015, Kodjo says, “the message I took away from all the speakers is that internal auditors in every organization should partner with management and stakeholders to improve the business.” He says the best internal auditors are those who are empathetic, because “they need to understand the challenges that managers face to advise them.” He adds that it’s up to his generation of practitioners to craft the future of the enterprise. “Change in internal audit needs to start at the bottom,” he says. “Students should try to contact industry professionals to get their take on the challenges unique to internal audit.” It’s important, he says, that students realize the profession is about more than understanding and applying rules — it’s about building strong relationships.
Larry Harrington, CIA, QIAL, CRMA, CPA
Vice President, Internal Audit, Raytheon Co. — Waltham, Mass.
Chairman, IIA Global Board of Directors
There’s no better investment than the investment you make in yourself and your career, Larry Harrington says. But not enough internal auditors follow that advice. “Today, people have the attitude that once they graduate from college, they’re no longer responsible for their own education,” he says. “Companies aren’t investing enough, so you have no choice but to invest in yourself. It’s up to you to spend your own dollars to accelerate your career.” Indeed, he recommends that internal auditors devote a percentage of each paycheck to that aim. “At the end of the day, we’re responsible for ourselves,” he adds. “If you don’t invest in yourself, you can’t grow as an individual.” The particular skills internal auditors should invest in, he suggests, include, first and foremost, soft skills — specifically, the verbal and written communication skills that provide the ability to persuade people. “No one has to do what an internal auditor tells them to do,” Harrington notes. “You have to persuade them.” He also stresses interviewing skills, pointing out that it’s not the first question that usually gets the answer — it’s the second and third. And of course, internal auditors need to invest in internal audit skills, including understanding how to be more efficient and effective in practice — and, because they audit every function in a company, they must also learn more about each of those functions. “Read publications and go to conferences,” he urges, “to attain the knowledge and expertise that adds value.”
Director, Audit, Google Inc. — Mountain View, Calif.
If there’s been a lesson learned consistently by each generation of internal auditors over the last three-quarters of a century, it’s that practitioners must be able to adapt to rapid change. That’s truer than ever today. “The global business environment is changing the fastest through innovative technology that is disrupting traditional industries and creating new opportunities,” says Lisa Lee. “Government regulations are having to adapt to these changes in the business environment, and stakeholders are growing accustomed to, and demanding, change, as well. But both of these are following the changes in the business environment.” For internal auditors who want to be prepared for the next 75 years of rapid change, Lee says, that means focusing on two key aspects of internal audit practice: making sure work objectives are clear and ensuring constant communication. “Clarity on the objective allows for focus on the end goal regardless of whether the scope or approach changes,” she says. “Constant communication ensures the team stays in synch, can navigate ambiguity, and can make on-the-fly adaptations to the work plan so the objective is still achieved, regardless of the changes.” And that’s not optional moving forward. Rather, Lee says, these practices are critical to ensuring that internal audit teams remain relevant and add value.
Richard Chambers, CIA, QIAL, CGAP, CCSA, CRMA
President and CEO, The IIA — Altamonte Springs, Fla.
Richard Chambers says that focusing on stakeholders’ expectations — and aligning the internal audit function to better meet them — is a hallmark of the profession as it hurtles toward 100 years of formal organization. And one of the key areas of alignment, for him, is around strategy risk. “Increasingly, board members and management are appreciating the risk that not having an effective strategy for the company represents,” Chambers says. As such, internal audit departments are tasked more and more with providing assurance on the effectiveness of managing strategy risks to avoid the fate of companies — like Borders Bookstores, Kodak, and Blockbuster — that “suffered because they didn’t adapt their strategy,” he adds. “They were giants in their markets because they had strong business models, but they failed to see the evolution that was happening around them and thus failed to adapt.” That’s why, he stresses, getting internal audit involved in assessing whether the company has an effective strategy is vital, as is determining whether management has adequately assessed the risks around strategy. In all cases, Chambers says alignment has to be rooted in communication, and it starts with strong relationships. “It’s important for a CAE to possess relationship acumen, or the ability to build relationships with board members and executive management so a level of trust exists that will foster communication,” he says. “Once that’s there, a good CAE will be able to constantly calibrate internal audit’s capabilities and performance against stakeholder expectations.”
Director, Internal Audit, Four Seasons Hotels and Resorts — Dubai, United Arab Emirates
Sushant Janakiraman stresses the importance of internal auditors having an understanding of the business they’re auditing. His internal auditors usually have an operational finance background, so “they have spent a number of years understanding the vital relationship between hotel operations, accounting, and financial decision making,” he explains. The accounting arm of a hotel business supports multiple functional areas, he adds, such as front desk, restaurants and bars, retail, procurement, and IT. Janakiraman says that when internal auditors understand those operational roles, it adds significant value to the review process, enabling them to better comprehend subsequent challenges. One specific area of added value is a profound understanding of policies in delivering intended results. “Working through an operational environment, one gains a firm understanding of policies and procedures established within the organization and by government regulators,” he says. “In the auditing sphere, this becomes the yardstick against which future performances are gauged.” He notes that the evolving nature of internal audit clients also brings about policy changes — and keeping them relevant becomes an important part of the function. Such fluidity, he says, “becomes easier having had experiences with our end customers and by understanding internal processes.” In that scenario, he stresses, internal audit adds value by not only being engaged to provide assurance services, but also to evaluate process effectiveness.