A new report finds that internal auditors increasingly directing risk-management efforts
Internal auditors are making progress at carving out a more strategic role for themselves and are gaining influence with management and the board at their organizations, according to a new report out earlier this month.
Securing a place as a trusted adviser to the board and management—long a goal of the internal audit profession—involves providing services beyond assurance. According to results from the Common Body of Knowledge (CBOK) 2015 Stakeholder Study, conducted by The Institute of Internal Auditors Research Foundation (IIARF) and Protiviti, that is exactly what is happening. The study suggest stakeholders are eager to expand internal audit's role to encompass risk identification and management.
The first report from the study, Relationships and Risk, Insights from Stakeholders in North America, finds that the top three areas where respondents want to expand internal audit scope involve identifying and managing risk.
Of 433 North American stakeholders surveyed, 85 percent want internal audit involved in identifying known and emerging risk areas. A slightly lower, but still significant, 78 percent want internal audit to facilitate and monitor effective risk management practices by operational management. Internal audit's scope also should include identifying appropriate risk management frameworks, practices, and processes, according to 78 percent of respondents.
The survey also finds that 58 percent of stakeholders believe internal audit should be more active in assessing strategic risk. One CEO interviewed in the study noted, "We need to better define how we link internal audit objectives to the achievement of strategic objectives."
Some other areas outside of risk management that management and boards are calling on internal audit to play a more substantial role include consulting on business process improvements and assurance on compliance with legal and regulatory requirements.
While the news is positive for growing internal audit's value to the organization, the report also discusses how the function must manage growing and competing demands. "Internal auditors cannot do everything stakeholders expect of them. There are limited resources, potential conflicts to independence, and overlap with other functions' responsibilities," wrote Douglas Anderson, managing director of CAE solutions at the IIA and author of the report.
According to the report, "Increased demands on internal audit will require chief audit executives (CAEs) to prioritize competing demands. Managing these conflicts requires strong relationship and communication skills." These demands will also require more resources, which many organizations have been slow to increase. According to several studies, internal audits have generally remained the same or increased only slightly.
