Five Trends Reshaping the Internal Audit Function

Given the clear need for internal audit to sharpen its focus on risk, and thereby provide more value, internal auditors find themselves at a strategic crossroads: They can either pursue the status quo, a path that could lead to their obsolescence, or they can transform themselves from an internal-audit model focused on controls assurance to a risk-centric model based on the effectiveness of risk management processes. The latter path is far more likely to address the evolving needs of modern organizations and meet the rising expectations of directors and senior management.

The findings of Internal Audit 2012, a major survey and interview project by PricewaterhouseCoopers, suggests ways that corporate directors can help reshape internal audit strategies and thereby enable internal-audit functions to provide more value. In reassessing the primary focus of internal audit, it suggested that members of audit committees ask these key strategic questions:

• Do we have a clear understanding of internal audit’s current value proposition?

• Do we want internal audit to stay the course and maintain a strong focus on controls? Or are we ready for internal audit to adopt a more risk-centric mindset?

• If internal audit is ready to provide risk-management assurance as well as assurance over controls, what skill sets will it need to achieve its objectives?

•  Is internal audit helping the audit committee identify emerging issues?

Improving Risk Management

The migration toward a more risk-centric approach to internal audit is being driven by five closely related trends: globalization, changing internal-audit roles, changes in risk management, shortage of audit talent, and technological advancement.

Globalization and new technology continue to have a dramatic impact on how companies structure business processes and operations. These changes—together with regulations, institutional investor demands, and the complexity of today’s multinational corporations—are influencing corporate efforts to improve risk management. Study participants expect increased globalization and advances in technology to have a sizable impact on internal audit and the talent it needs to meet its objectives. By understanding these factors and their implications, audit committee members will be able to work more effectively with internal-audit leaders to determine how to help senior management identify and manage risk.

Globalization Drives Demand

The Internal Audit 2012 project identified globalization as one of the most significant and growing trends examined. As organizations expand overseas, there is a corresponding increase in the demand for internal-audit services. In the future, a majority of the study’s survey respondents expect globalization, outsourcing, and off-shoring to have a profound impact on the roles and responsibilities of internal audit.

Yet while Internal Audit 2012 survey participants see new responsibilities stemming from globalization, chief audit executives (CAEs) from experienced global companies express caution, pointing out that risks associated with the pursuit of global markets can be difficult for internal auditors to identify and assess. Other audit leaders cite challenges relating to cultural issues in China, India, and other growing markets.

PwC’s research also suggests that audit committees and senior management pay closer attention to shifting political risk in global markets. At a time when risk-based auditing has become a driving force within business circles, internal-audit risk assessments should take political risk factors into consideration. For companies operating abroad in unfamiliar political environments, new types of risks and complexities can threaten business performance and may also mask new opportunities. Factors range from regulatory changes lowering barriers to market entry to practices that violate the Foreign Corrupt Practices Act (FCPA).

If a company has a presence in foreign markets, or if it is thinking about making major investments abroad, it needs timely, accurate, and objective assessments of the political environment. Economic analysis alone fails to tell the whole story, particularly in situations where useful statistical data is either hard to come by or subject to manipulation.

As companies expand globally, they also need to determine whether to provide audit coverage from a central location or from a satellite operation aligned geographically with the business footprint—not a decision to be taken lightly. Internal Audit 2012 survey respondents generally expect that the internal-audit organizational structures for U.S. companies will remain U.S.-based, albeit with a growing global dimension.