As I commented in my recent blog posts on Feb. 10 and Feb. 25, internal auditing is sometimes accused of being reactive rather than proactive when addressing emerging risks. Changing that perception is important for the profession as it moves forward. However, as a recent IIA survey reveals, the profession has much to be proud of when it comes to demonstrating its agility and versatility in the face of a dynamically changing environment. Conducted during the first week of March, the survey solicited the insights of more than 360 respondents — 70 percent of which are chief audit executives (CAEs) — on how the current economic conditions impacting the profession in North America and the coverage that internal auditing is providing in the corporate sector. It is noteworthy that 34 of the participants are CAEs at Fortune 100 companies.
Internal auditing has significantly shifted its focus in the past year. The most significant outcome of the survey is its validation that the current economic crisis is not only impacting the resources of internal audit functions — more than half have experienced budget reductions in the past year — but that internal audit activities are transitioning coverage away from risks that received extensive focus in recent years and focusing more on risks emerging from the changing economic conditions. The areas with the most pronounced increase in coverage are cost reduction/containment and operational risks — 47 percent of respondents report an increase in each of these areas. Given the financial stress facing many North American companies, it is not surprising that risks associated with operations and cost containment are on the rise. What is reassuring, though, is the speed and agility with which internal auditing is refocusing its efforts to address these risks.
The survey also reflects several additional areas where internal audit coverage has increased in the past year, including company exposures to third-parties in financial distress (39 percent), effectiveness of risk management (35 percent), compliance risks (33 percent), credit risks (33 percent), and liquidity risks (27 percent). The severity of the risks became increasingly evident during the past year for each of these areas, and yet a sizable percentage of internal audit functions were able to adapt their audit plans to address them swiftly.
The survey results also indicate that the larger the company, the quicker the internal audit activity appears to be in adapting to emerging risks. When analyzing the responses of Fortune 100 CAEs specifically, 62 percent increased coverage of operational risks in the past year (compared with 47 percent overall) and 61 percent increased their coverage of cost/expense reduction opportunities (compared with 47 percent overall).
It looks like a lot more change of focus is on the horizon. While the agility and speed with which internal auditing adapted to emerging risks in the past year is impressive, it is nothing compared with the projections for the future. More than half of all survey respondents (56 percent) predict they will increase their coverage of financial and operational risks yet again during the next 12 months. In addition, nearly half of all respondents project they will increase their coverage of cost/expense containment and assessing the effectiveness of risk management efforts during the coming year.
Although the overall survey results paint a positive picture of the internal audit profession, there are some opportunities for enhancement. For example, only about 20 percent of corporate internal audit functions indicate they increased their focus on reputational risks during the past 12 months, and less than 20 percent expect to increase their coverage of this risk during the coming year. As I pointed out on March 4, in an era when reputational risks for the corporate sector have never been higher, internal auditing needs to play a key role in providing assurance that these risks are being considered by management. In addition, almost 45 percent of those internal audit functions whose companies have received Troubled Asset Relief Program (TARP) or government stimulus funds indicate they have not yet addressed related risks as part of their audit coverage. While these initiatives are very new, there is little time for internal audit functions to waste in addressing these risks as part of their overall audit coverage.
Additional resources related to The IIA’s survey:
IIA Global Audit Information Network Knowledge Alert: “The Financial Crisis and Its Impact on the Internal Audit Profession,” (available to members of the IIA's Audit Executive Center) www.theiia.org/download.cfm?file=30180 (PDF).