Internal auditors better get fit. Digitally fit, that is. They will need to be in top shape to take action in digital transformation initiatives.
Digital fitness means embracing new technology to gain insights that can help digital transformation. It can make risk professionals "important partners and leaders in helping their organizations get better benefits from their digital initiatives," says Jim Woods, global risk assurance leader at PwC.
But many internal audit, risk, and compliance functions are falling short, according to PwC's latest Risk in Review Study. The global study surveyed more than 2,000 board members, CEOs, and senior executives, as well as internal audit, compliance, and risk professionals.
Woods says internal audit and other risk functions are at a "critical juncture" in which automation, data analytics, and other technologies are transforming businesses. But new risks are transforming organizations, as well. "Digital transformation is also driving the potential for identifying risk and making smarter decisions," he adds.
Woods points to findings from PwC's most recent CEO survey in which about one in five CEOs said they receive risk exposure data that is comprehensive enough to make long-term decisions. That number hasn't increased in 10 years.
"Dynamics" is what PwC labels internal audit, compliance, and risk functions that are in the top quartile of surveyed organizations. These functions are developing digital capabilities faster, are confident in taking risks that are consistent with their strategies, manage transformation-related risks more effectively, and are getting better-than-expected value from digital investments than their peers.
The Risk in Review study outlines six components of digitally fit organizations. Internal audit functions might consider them a fitness regime.
All-in on the Organization's Digital Plan
Dynamics have aligned their function's digital strategy with that of their organization, enabling them to provide "strategic advice and assurance over the new and changing risks that digital transformation brings," the report notes. Three-fourths of dynamic functions seek specific outcomes from their digital investments, and 73% change performance metrics to support behaviors and manage against an "aspirational" digital operating model. Less than half of other organizations do those three things.
Boost Digital Skills and Talent
Auditors and risk professionals in dynamic functions have become data-driven and use digital tools to provide risk insights at the pace of the organization's transformation efforts, the report says. Executives say their organizations need critical thinking, technology, analytics, cybersecurity, project management, and change management skills. Eight in ten dynamic functions use performance metrics to assess and reward new digital ways of working, and seven in ten have created a talent management program to hire digital personnel or enhance the skills of existing people.
Find the Right Fit for Emerging Technologies
Overall, one-third of surveyed functions are using technologies such as artificial intelligence (AI), the Internet of Things (IoT), and robotic process automation. Dynamics are more likely than other functions to automate their activities to free people to work on more valuable analyses and to expand risk coverage. Thirty-six percent of dynamic functions use IoT sensors to respond to risks, and 39% use AI for population testing, controls, or risk modeling. Those are more than double the percentages of other functions.
Enable the Organization to Act on Risk in Real Time
To support transformation decisions, internal audit and other risk professionals must provide insights about a fast-changing set of risks that can impact the organization quickly. Nearly three-fourths of dynamic functions are redesigning current processes to deliver services and developing new services for stakeholders. Half are using intelligent automation or machine learning to prioritize risks.
Engage Decision-makers of Key Digital Initiatives
Audit and risk functions that provide the most value to transformation projects are in communication with decision-makers, participating in key meetings and consulting on projects and plans. About eight in 10 dynamic functions use dashboards or visualization tools to provide more strategic risk reports to the board. A similar number influence strategic decisions about digital initiatives.
Provide a Consolidated View of Risks
Dynamic audit and risk functions collaborate across the lines of defense on digital projects. With this component, the numbers are small, though. One in five dynamic functions have a common policy framework and a single set of risk metrics or key performance indicators. About one-fourth provide consolidated reports to the board.