One of IIA Global’s priorities is to monitor the trends and emerging issues affecting the profession around the world. Hardly a week goes by without a new research report crossing my desk, giving fresh insight into internal audit practices. One from our own Audit Executive Center has been particularly enlightening. Titled “The pulse of the profession: with progress noted, opportunities are still abundant”, it highlights not only changes that the profession has undergone in recent years, but also implications for how it must change in the future.

It points to a number of areas where we can enhance our performance and stature as a profession. The first is audit committees’ oversight of internal audit. Internal auditors have made great strides over the past decade in building reporting relationships with their audit committees. Recent studies show that this progress is continuing, yet they also raise troubling questions about the level of oversight. While most internal audit groups report functionally to an audit committee, only 38 per cent of committees are involved in setting performance objectives for chief audit executives (CAEs) and only about half receive regular updates about internal audit quality-improvement programmes. Audit committees are charged with overseeing us, but our failure to involve them in setting our objectives, evaluating our performance and improving our quality may be making it impossible for them to do this effectively.

Even when it comes to ensuring management support for internal auditing, more work may be needed. Audit committees in 72 per cent of organisations make sure that the CAE receives “management support”, according to the survey, but it also reveals that only 24 per cent of audit committees ensure that the CAE is involved in key strategic initiatives. 

If the audit committee doesn’t assume strong oversight over the CAE, whose fault is it and what should be done? Only when the audit committee and management are fully informed of their responsibilities and armed with the information they need can they be expected to fulfil their oversight and support duties properly. 

The survey also highlights the fact that, while internal audit teams’ sizes have stabilised, the skills they require have changed. The profession has come through the economic crisis relatively unscathed and many internal audit teams are increasing headcounts and budgets, but CAEs are looking for different skills from those they sought a year ago. Then they preferred candidates with industry-specific knowledge. Now they want critical thinkers or excellent communicators. 

Today’s audit plans are the most balanced they have been for a decade, since Sarbanes-Oxley and similar legislation led to a demand for financial auditing knowledge. With this shift in priorities has come a demand for different skills, many of which don’t relate to accounting. Skills needing most improvement include relationship building, negotiation, conflict resolution, presentation and handling high-level meetings.

Lastly, the report says that, while our stakeholders have enhanced their understanding of internal controls, we may still not see eye to eye on important risks. As it points out, several studies show that internal audit plans seem to address key risks identified by boards, audit committees and management, but the allocation of internal audit resources may not reflect the priorities of the board and management. For example, coverage of strategic risks and the effectiveness of risk management remains low, despite their impact in recent years. In other areas, internal audit may be overestimating risks. For most organisations, it seems that the dialogue on risks and controls has advanced to the point that management, boards and auditors agree on areas of potential risk – but not yet to where they agree on the extent or possible impact of individual risks.

Although these aren’t the only issues affecting internal audit, they do warrant our immediate attention. I will continue to update you on the emerging issues facing our profession, so that you can address them in your organisations.

For further information

Richard Chambers writes a blog at www.theiia.org/blogs/chambers and tweets at www.twitter.com/rfchambers