Internal Audit Effectiveness

Overview

There is clear agreement among internal audit leaders that significant change will characterize auditing environments in Asia Pacific for years to come, a direct reflection of strong economic growth. Competition is intense as more and more companies expand and go public, increasing regulatory oversight and placing greater pressure on internal control frameworks and those responsible for them.

A PricewaterhouseCoopers’ survey of internal audit leaders in Asia Pacific (Internal Audit 2012) suggests that internal audit functions in this region will soon experience stepped-up requests for assistance from their chief stakeholders. Directors and executive management alike are turning to internal audit and other staff functions for help in the areas of corporate governance, risk management, fraud prevention and detection, and ethics, as well as internal controls. At this point, however, relatively few Asia Pacific internal audit groups have made the necessary adaptations to respond effectively to such requests.

In today’s environment, corporate governance activities, such as internal audit, command center-stage attention. New regulations mandate that effective, verifiable governance activities assume a much higher organizational profile. For example, if a complex company is required to maintain a sound system of internal controls to safeguard shareholders’ investments and the company’s assets to comply with the Singapore Code of Corporate Governance, an ineffective internal audit function may be viewed by the company’s external auditor as a sign that a significant deficiency or even a material weakness in internal controls exists. This could impact the auditor’s opinion and potentially damage the reputation of the company. Furthermore, the Code of Corporate Governance also requires companies listed on the Singapore Exchange to establish an independent internal audit function. Of course, the mere presence of an internal audit function says little about its capabilities.

The real question is — what can an internal audit function do to be most effective as a key player in corporate governance? An internal audit function can achieve heightened levels of effectiveness if it (1) aligns strongly with stakeholder needs, (2) achieves best-in-class capabilities, (3) complies with applicable professional standards, and (4) measures results.

Align Strongly with Stakeholder Needs

Internal audit needs to understand the expectations of its primary stakeholders - senior management and the audit committee – and align its activities accordingly. This alignment ensures that internal audit functions and key stakeholders share the same priorities when it comes to applying internal audit resources to risk management and control. For example, do the audit committee, management and internal audit have the same view of the role of internal audit in ongoing corporate governance activities? Once internal audit aligns itself with the priorities of its key stakeholders, the function needs to establish solid lines of communication with senior management and the audit committee. With good communication, internal audit can also ensure that its priorities continue to match those of its key stakeholders as they evolve.

Achieve Best-in-Class Capabilities

Highly effective internal audit groups view Best-in-Class auditing practices as key to their success as well as the success of their companies. To keep pace with organizational changes, and to meet the heightened expectations of key stakeholders, an internal audit function needs to achieve proficiency in its operations, processes and skill sets.

Typically, top-performing internal audit groups exhibit a strong commitment to the following areas:

Resources: Best-in-Class internal audit departments identify the skills and resources they need to achieve organizational objectives.

They expand their risk management, compliance, business and product capabilities to build on their core internal audit and control competencies. They use flexible co-sourcing arrangements to acquire specialized skills from third-parties. And they continuously measure levels of staff proficiency as well as career development progress.

Knowledge Management: Top internal audit functions capture, manage and share their internal knowledge, recognizing its importance to the long-term success of the organization.

Risk Mitigation: To strengthen corporate antifraud and risk mitigation efforts, an internal audit function must be aware of potential schemes and scenarios affecting the industries and markets served by the organization. It must understand measures intended to detect fraud and be able to evaluate and test antifraud controls.

Risk Assessment: A highly effective internal audit function has assessed the risks facing the organization and built an audit plan to address them. There is transparency to the process so that key stakeholders can see the risk profile and understand the risks and their coverage. Without a process to identify and communicate the underlying risks, stakeholders cannot satisfy themselves that the audit plan is adequate. The process must also be dynamic and link changes in the company’s risk profile to changes in the audit plan.

A PricewaterhouseCoopers Internal Audit survey conducted in 2007 shows that the controls-focused approach that has dominated internal audit functions on a global basis is expected to diminish significantly in value. As this change occurs, internal audit leaders in Asia Pacific will need to redefine their fundamental value propositions and adopt risk-centric mindsets if they expect to remain key players in assurance and risk management.

Technology: Pervasive use of technology is a hallmark of highly effective internal auditing functions, which use it to improve processes ranging from data retrieval to risk monitoring. Continuous auditing techniques, data mining and predictive modeling can all be employed to enhance the quality of the internal audit process.

Comply with Applicable Professional Standards

An effective internal audit function will also operate in compliance with professional standards, principally those of the Institute of Internal Auditors. IIA, as recommended by SGX, is one of the more recognised internal audit organisation in Singapore and referred to by many internal audit departments. IIA has developed the Professional Practices Framework (IIA Framework) which defines how internal audit departments should be structured and operated. Audit Committees should make sure that their internal audit function complies with the requirements of the IIA as part of their assessment of the department.

According to the standards, internal audit should seek to improve the governance process by promoting appropriate ethics and values, ensuring organisational  performance management and accountability, communicating risk and control information within the organisation, and helping to coordinate the governance-related activities of the board and senior management.

The IIA standards also require both internal and external reviews of internal audit quality. To address these requirements, Boards should also evaluate the option to have an independent review of their internal audit function to determine if its internal audit structure is doing the job satisfactorily, i.e. meeting organizational needs and whether they are fulfilling their stewardship roles and responsibilities.

Measure Results

On a routine basis, companies measure and quantify the performance effectiveness of their business activities. In the same manner, internal audit needs to demonstrate its own effectiveness using a performance measurement system tied to the expectations of its key stakeholders. Only by circling back to the needs of its key stakeholders and regularly tracking its performance against the expectations of the board, senior management and operating management, can an internal audit function satisfy their increased scrutiny and more demanding expectations.

To achieve this, we recommend balanced scorecards, which go well beyond numbers to examine important, broad-based activities. The balanced scorecard concept, based on the simple premise that “measurement motivates,” is used by thousands of corporations, organizations and government agencies worldwide.

Conclusion

The four action areas described above give management, audit committees and internal auditors a high-level framework to assess internal audit effectiveness. Unless an organization adopts each measure comprehensively, it runs the risk of having an internal audit function that may fail to meet the new, higher expectations for this key governance activity.

The following is a 10-step checklist summarising the critical “must haves” to build the foundation for a high performing internal audit department:

Stakeholders’ needs

• Does the Internal audit have an appropriate reporting line to provide sufficient authority and objectivity?

• Has an Internal audit charter been developed that reflects the authority and mission of the department?

Achieve Best in Class Capabilities

• Is the internal audit department adequately staffed to provide the necessary expertise to fulfil the audit plan?

• Are business domain practices, knowledge and audit issues compiled into searchable databases that can be accessed by Internal audit staff?

• Has a comprehensive and effective enterprise wide risk assessment been conducted with participation from members of senior management?

• Does the audit plan review controls sufficient to address all identified key risks of the organisation?

• Are appropriate IT tools being used to increase the efficiency and effectiveness of internal audits?

Comply with Applicable Professional Standards

• Does the internal audit department comply with standards of IIA (or any other relevant) professional organisation?

• Has an independent assessment of the internal audit department been conducted including benchmarking the internal audit department to peer organsations?

Measure Results

• Is performance of the internal audit department and staff measured with tools such as balanced scorecards?

Contributed by:

Ng Siew Quan
Partner,
Governance Risk Compliance & Internal Audit Services

Francis Wan
Associate Director,
Governance Risk Compliance & Internal Audit Services
PricewaterhouseCoopers