By Rob Starr, Big4.com Content Manager
The Deloitte research report – “Evolution or irrelevance? Internal Audit at a crossroads” finds that more than half of Chief Audit Executives are not satisfied that their internal audit groups have the skills and expertise to deliver on stakeholder expectations. As well, 16 percent of respondents believe Internal Audit has little to no impact and influence over the board of directors, executive team and other key personnel, yet 64 percent believe it will be important for them to have a strong impact over the next three to five years. Responses from Terry Hatherell, Internal Audit Leader for Deloitte Global, to questions posed by Big4.com.
What are some of the reasons that Chief Audit Executives (CAEs) are not satisfied with their internal audit groups?
- Many CAE survey respondents believe that their internal audit functions lack impact and influence within their organization. Only 28% of respondents believe that their internal audit function has strong impact and influence while 16% indicated that their internal audit function has little to no impact and influence.
- The majority of survey respondents are not satisfied with the skills and capabilities of their internal audit functions. Only 41% of respondents indicated that they were satisfied. Gaps in specialized information technology (e.g., cyber, cloud computing, mobile) and data analytics were most frequently identified by respondents.
- Survey findings indicate that the use of Internal Audit analytics has not yet taken hold as expected. The majority of respondents rated their analytics capabilities at the basic level.
Why will this situation become critical over the next three to five years?
- Internal Audit plays a critical role in the ecosystem of corporate governance. In a world of significant and exponential change, effective corporate governance becomes even more critical. Examples of exponential change expected to significantly impact organizations include cognitive computing and artificial intelligence and societal trends such as collaborative consumption.
- Internal Audit has a critical role to play in terms of providing assurance with respect to whether key risks are being managed effectively and in providing advice to management along the journey of change.
- 86% of survey respondents expect moderate or significant change in their organizations over the coming 3 to 5 years. Almost as many (80%) expect moderate or significant change will be required within their Internal Audit departments.
How does the wealth of available data fit into the picture?
- Survey findings indicate that Internal Audit should leverage the available data just as many businesses, today, leverage their data in the day-to-day operations of their business.
- In Deloitte’s view, nothing is transforming Internal Audit more than analytics.
- Analytics enables Internal Audit to provide deeper insights and foresight and also promotes
efficiency in execution (e.g., doing “more with less” or “more with the same”).
- Our research showed that, while many Internal Audit departments are on the analytics journey, they are possibly not far enough along and are not moving quickly enough. The majority of respondents assessed their analytics capabilities as basic, with much fewer at the intermediate and advanced levels.
- Availability of skilled talent and quality of data were identified by respondents as the two more common barriers to using analytics.
- Our research found that, in order to secure the required analytics skills, Internal Audit departments expect to train existing staff, hire skilled professionals and leverage co-sourcing arrangements with third party firms.
- While the quality of data was identified as a frequent barrier by respondents, our survey results indicate that this is often an excuse, as many Internal Audit departments that state they are advanced from an analytics perspective also say that the quality of their data is not great.
- In response to the survey findings, we recommend that Internal Audit departments map out their analytics journey and start with a pilot of internal audit analytics to demonstrate its value.
What are some of the other bigger takeaways from the report?
- It is concerning to see the relatively low impact and influence that CAEs believe their Internal Audit departments are having.
- Respondents expect to significantly increase their usage of analytics over the coming few years. Our findings indicate that the majority of Internal Audit departments still operate at the basic level.
- Respondents expect to continue to use co-sourcing as a common model to secure required skills. The use of guest auditor programs and rotation programs are expected to significantly increase over the coming few years.
- According to our survey, 68% of Internal Audit departments use analytics in fieldwork while much fewer use analytics in scoping (39%) and annual planning (33%). This represents a significant opportunity for Internal Audit as much of the “secret sauce” in analytics involves using analytics up-front in the annual planning and scoping activities to help target areas of risk.
- Respondents expect to shift their communications with stakeholders from static presentation and word processing reports to more visual and dynamic reporting using analytics and data visualization tools.
- Respondents expect to significantly increase their focus on auditing their organization’s strategic planning process and end-to-end risk management process over the coming few years.
- More than half of respondents (55 percent) expect the proportion of advisory services they provide to expand over the next three to five years.
- Survey findings indicate that risk anticipation is the #1 innovative development expected to impact Internal Audit over the coming few years. This is followed closely by Data and Predictive Analytics.
What are some of the things that need to be done going forward?
- Survey findings indicate:
- There’s opportunity for respondents to address the identified talent gaps, such as specialized skills in information technology and data analytics, while taking advantage of alternative resourcing models to secure the required skills (e.g. co-sourcing, guest auditor programs, rotation programs).
- Internal Audit departments should embed analytics as a central element of Internal Audit’s activities. The question asked as it relates to analytics should be “Why wouldn’t I use analytics” rather than “Why would I use analytics”.
- CAEs should shift communications towards being more dynamic and visual to help stakeholders digest and interpret results. The old adage “A picture is worth a 1000 words” applies here.
- CAEs should ensure the optimal mix of advisory and assurance services to deliver the greatest impact and value within their organization.
- Internal Audit should incorporate risk management and strategic planning reviews into their annual audit activities as these reviews will be particularly important given the extent of change anticipated within both the internal and external environment.
- CAEs should consider the expected innovative developments identified in the research (e.g., risk anticipation, data analytics, predictive analytics) and should consider how they can incorporate these expected innovative developments into their internal audit activities.
- As a way to help strengthen Internal Audit’s impact and influence, there’s opportunity for stakeholders to ask the tough questions of Internal Audit such as:
- Do we have Internal Audit skill gaps such as specialized information technology and analytics knowledge?
- What resource models are we using to secure the required skills?
- Are we using internal audit analytics beyond just simple profiling and sampling? How frequently do we use analytics in our reviews?
- When was the last time we conducted an end-to-end internal audit review of our risk management function?
- When was the last time we conducted an internal audit review of our strategic planning function or process?
About the report
Deloitte Global’s “Evolution or irrelevance? Internal Audit at a crossroads” report is based on a 2016 survey of more than 1,200 Chief Audit Executives in 29 countries and eight industry sectors. The findings are based on the analysis of this collective data. The full report can be found at www.deloitte.com/globalCAEsurvey.
Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee (“DTTL”), its network of member firms, and their related entities. DTTL and each of its member firms are legally separate and independent entities. DTTL (also referred to as “Deloitte Global”) does not provide services to clients. Please see www.deloitte.com/about to learn more about our global network of member firms.
Deloitte provides audit, consulting, financial advisory, risk management, tax and related services to public and private clients spanning multiple industries. Deloitte serves four out of five Fortune Global 500® companies through a globally connected network of member firms in more than 150 countries bringing world-class capabilities, insights, and high-quality service to address clients’ most complex business challenges. To learn more about how Deloitte’s approximately 225,000 professionals make an impact that matters, please connect with us on Facebook, LinkedIn, or Twitter.
Tel: +1 212 492 4503