内部审计 state_internal_audit_profession_study_09
Internal Audit Services
Business upheaval: Internal audit weighs its role amid the recession and evolving enterprise risks
PricewaterhouseCoopers 2009
State of the internal audit profession study
PricewaterhouseCoopers’ fifth annual state of the internal audit profession study reveals an internal audit profession in flux, making rapid adjustments to a world that seems at once expanding, contracting, and changing...always changing.
Table of contents
The heart of the matter 4 Doing more with less as a fragile
economy looks to regain its footing
An in-depth discussion 6 A tough period sets the stage
for internal audit transformation
Strapped for resources, yet faced with new challenges. 7 Company risk profiles aren’t what they used to be. 9 Navigating the stakeholder perception of value now. 13 ERP implementations highlight a skills gap. 17 When governance meets continuous improvement. 21
What this means for your business 24 New strategies are needed for success
in a time of transition
How to determine that the ERM function is prepared
for a dramatically different environment. 26 How to reduce costs and enhance the quality of internal
audit services by embracing technology. 30 How to build an effective human capital strategy to acquire,
develop, and retain talent needed now and for the future. 32
4
The heart of the matter Doing more with less as a fragile economy looks to regain its footing
Source: PricewaterhouseCoopers. American Perspectives, 2008, https://www.wendangku.net/doc/622981953.html,/americanperspectives.
International crises
The heart of the matter 5
PricewaterhouseCoopers Internal audit department budgets will flatten or decline and long-vacant positions will
go unfilled as a result of the deepening worldwide economic downturn, according to
PricewaterhouseCoopers’ 2009 State of the Internal Audit Profession survey. As the
economic contraction continues, internal audit departments accustomed to nearly
untouchable status in the post-Sarbanes-Oxley period now face major changes.
With company revenue growth declining or negative and expenses subject to greater
scrutiny by management and stakeholders, internal audit leaders have been challenged to
pay special attention to the value that their departments deliver. Our survey suggests they’re
also concerned with ensuring that value is recognized by their internal customers—typically
the audit committee and management.
Now is not the time to be out of step with company and management priorities, according
to industry leaders surveyed. The time is right, however, for a value-enhancing spring
makeover. With cost efficiency the name of the game, internal audit leaders will want to
reexamine strategy, optimize internal processes, and find ways to produce more value at a
lower cost.
Our 2009 State of the Profession survey reveals that the economy is the top issue for
the coming year. Even while the economy dominates, other issues such as increased
globalization; alignment to new, emerging risks; and a scarcity of IT -related resources
continue to be top of mind. Current economic conditions have other implications for internal
audit as well. Massive, long-running frauds have recently come to light as the lower level
of economic activity no longer permits concealment. In addition, lay-offs and similar cost
reductions are often cutting deeply into, or even eliminating, layers of experienced middle
management. Important control functions can also be impacted by these changes.
PricewaterhouseCoopers’ annual survey reveals an internal audit profession in flux, making
rapid adjustments to a world that seems at once expanding, contracting, and changing…
always changing.
The Great Crash & Depression 1929–39Florida Building
Bubble
1926Mexican Peso Crisis 1994Ruble Crisis
Russia
1998
Long-Term Capital Management hedge fund collapse
1998Housing Bubble and Subprime Crisis 2003–
An in-depth discussion
A tough period sets the stage for internal audit transformation
6
Strapped for resources, yet faced with new challenges.
Why internal audit must brace for an efficiency revolution.
Not surprisingly, this year’s State of the Profession survey reflected the economy as the number one issue. With the percentage of respondents reporting budget reductions doubling from last year’s survey, PricewaterhouseCoopers predicts even greater internal audit budget constraints in 2009.
About half of the survey respondents said that they expected budgets to remain flat, while
a third said budgets would actually decrease in 2009. Among the Fortune 500 respondents, the outlook was somewhat darker: 51% believe there is significant risk that the economic downturn will result in budget reductions during the coming year.
While the economic outlook is uncertain, these circumstances present internal audit with
a transformative opportunity. Many internal audit leaders know what they need to do to achieve greater value at lower cost. Others are eager to learn.
If internal audit is to demonstrate value in the face of declining resources, it must begin
with a fresh look at the company’s internal audit strategy and a reassessment of its own processes. We believe doing so will not only help gain credibility with organizational peers suffering the same cutbacks, it will also help internal audit preserve its capacity to address strategic, operational, and business risks, as well as today’s emerging challenges.
As we anticipated in our forward-looking report Internal Audit 2012,1 internal audit leaders have begun to recognize the need to redefine the function’s value proposition and seek to increase its value by learning to operate more efficiently, intelligently, and quickly. Concerns over declining budgets are a reminder that greater efficiencies within internal audit won’t come a moment too soon.
Here are highlights of what the respondents to
our 2009 survey had to say about internal audit
budgets and resources:
? 19% reported budget reductions in 2008
compared with 10% in 2007.
? 49% expect budgets to remain flat and
36% expect a decrease in the coming year,
compared with projections of 49% and 14%,
respectively, in the prior year’s survey.
? 51% of Fortune 500 respondents believe
that there is a medium-to-high risk of the
economic downturn causing an unexpected
reduction in the internal audit budget
during 2009.
PricewaterhouseCoopers
An in-depth discussion7
Company risk profiles aren’t what they used to be.
Why internal audit’s focus must be aligned to business priorities more
than ever before.
The nature of business risk has changed, particularly for global organizations. But whether doing business at home or abroad, risk has grown and become more amorphous. Emerging risks, which are difficult to predict from past experience, are now reverberating across entire industries and economies. These hard-to-predict, high-impact risks can manifest themselves rapidly and exponentially over a very short period of time. They are characterized by imperfect information and potentially interdependent consequences. Aligning internal audit’s focus to the risks flowing from changing business priorities and conditions has become the central mission of forward-looking internal audit executives concerned with the future of their companies and their departments.
In our view, successful internal audit departments will be those that maintain alignment with the changing risk profile of their company and the evolving needs and expectations of their key stakeholders. Both our 2012 report and our subsequent white paper on internal audit transformation2 delineate the reasons for changing risk profiles and the need for internal auditors to adapt. Key among them: a shift in focus from financial reporting controls to a focus on the sources of risk that destroy shareholder value.
Recent studies indicate that strategic and business risks pose greater threats to shareholder value than operational, compliance, or financial risks. These studies, which examined the factors behind rapid losses in shareholder value, focused on “large cap” companies such
as those ranked in the Fortune 500 and FTSE 100 index. The results of the studies were remarkably similar. As shown in the chart below, strategic and business issues are the most common means by which value is destroyed—responsible for 60% of value loss—with operational issues driving another 20% of the loss.
Figure 2. Strategic, operational, and business risks underlie 80% of the rapid declines in shareholder value
Source: PricewaterhouseCoopers. Composite of various studies of US and UK markets.
PricewaterhouseCoopers
An in-depth discussion9
Nevertheless, this year’s State of the Profession survey shows that many internal audit
functions are still heavily rooted in the past, auditing financial reporting and compliance
controls, hallmarks of the earlier Sarbanes-Oxley period. Only 13% of respondents indicated
that their departments allocated at least 25% of resources to strategic and business risks,
while a clear majority (57%) assigned this degree of resources to more traditional financial
risk. However, things are changing: strategic, business, and operational risk categories are
among the fastest-growing areas of internal audit focus.
Figure 3. Composition of auditing activities
Financial
57%
21%
Operational
53%
34%
Compliance
33%
30%
Information Technology
31%
36%
Strategic/Business
13%
38%
Consulting
9%
28%
Percentage of internal audit departments that contribute
25% or more of their resources to key categories of risks
Percentage of internal audit departments that increased
coverage in each area during 2008
Source: PricewaterhouseCoopers. Composite of various studies of US and UK markets.
10Business upheaval: Internal audit weighs its role amid the recession and evolving enterprise risks
New levels of risk complexity can also be seen when companies increase their global footprint. In multiple reports and studies, we have commented on the increased business risk that accompanies the pursuit of international growth via entering new markets
or expanding existing ones. As companies venture into new territories, a multitude of
Source: PricewaterhouseCoopers. American Perspectives, 2008, https://www.wendangku.net/doc/622981953.html,/americanperspectives.
PricewaterhouseCoopers
An in-depth discussion11
Globalization trends, such as increased outsourcing and offshoring, can have a direct impact
on internal audit departments. Indeed, our 2012 report3 respondents said they expected that
the auditing of outsourced or offshored operations would continue to increase over the next
five years.
Our 2009 State of the Profession survey participants expressed a similar expectation of
increased global activity, along with a concern over the lack of foreign language capabilities
among their staff.
?
56% of Fortune 500 respondents reported that their company is planning to acquire or
expand operations outside of the US in the next 24 months.
?
68% of Fortune 500 respondents indicated that they use their company’s internal audit
resources to address needs outside of the US.
?
88% of Fortune 500 respondents reported that fewer than half of their staff are fluent in a
second language.
Concerning emerging risks, our 2009 survey revealed that 57% of the Fortune 500
respondents believe the ability to identify these risks in the coming year will be a medium
or high concern. Yet precisely because such risks are having the greatest impact on
shareholder value, this is exactly where internal audit should be focused in 2009.
12Business upheaval: Internal audit weighs its role amid the recession and evolving enterprise risks
Navigating the stakeholder perception of value now.
Why internal audit needs new knowledge management and sourcing strategies.
That internal audit leaders need to change their mindset—increasing their focus in areas of strategic, business, and operational risk—is now clear and borne out by forward-looking reports and survey data. However, their efforts to do so may be hindered by their staff’s ability to excel in these more complex risk categories.
Internal audit leaders have told us candidly of a nagging stakeholder perception that internal audit doesn’t understand the business, and have sought our advice on overcoming this perception and its underlying realities.
We believe the answer should include a rethinking of the profession’s sourcing strategies, along with a significant upgrade in knowledge management skills. As the profession scrambles to deal with emerging risks and new challenges, internal audit leaders must
find effective ways to attract and retain top talent and increase business and operational knowledge among the ranks.
Our 2009 survey results reveal that 58% of the respondents’ staff have five years or less of experience. Those staff would typically have spent their formative years as auditors during the Sarbanes-Oxley era and would have been heavily engaged in auditing financial reporting controls. As the current economic downturn reveals, shareholder value is being battered by new and previously unanticipated risks. Internal audit faces the dual challenges of realigning its resources to address the reality of new, value-destroying risks while demonstrating knowledge of relevant risks with staff that are potentially unprepared to identify and deal with the implications of those risks.
As the details of the broadening economic crisis have demonstrated, today’s global economy is inextricably connected. Consider the once-simple home mortgage transaction. Today, the financial institution that made the loan likely no longer carries it on its books. Instead, the loan is more likely to have been bundled with other mortgages of varying quality, securitized, and sold to a pool of investors located in countries around the world. Similarly, food, oil, and other commodities from other nations flow seamlessly among global markets, making the daily events of Main Street Asia, Europe, and South America of greater importance to Main Street America than ever before. This interconnectedness creates an entirely new body of risks for business. Internal audit leaders whose departments want to assume a more active role helping to anticipate and monitor organizational risk in a more complex world economy may have some development work to do. These leaders will no doubt want to take stock of their departments this year—creating and analyzing resource profiles and identifying knowledge and skills gaps, and making plans to close them.
The accumulated knowledge and experience of senior team leaders deeply familiar
with the businesses in which they’ve spent their careers will be a key asset in this skills
PricewaterhouseCoopers
An in-depth discussion13
transformation process. Yet the incoming generation will bring its own gifts to the table: potentially greater technological skills, comfort with new ways of learning, and often a wider world view than their predecessors had. Given these challenges, we believe that every internal audit leader’s development plan for 2009 should include an initiative to upgrade the knowledge management capabilities of his or her team, as well as to identify those team members with unique skills that can be leveraged to improve the team’s overall performance.
When it comes to recruiting, internal audit may find the talent hunt easier when it can present itself as an innovative, strategically aligned organization with a seat at its company’s risk management table. Our survey results also suggest that this may best be achieved by appropriately aligning internal audit’s focus with the company’s changing and emerging risks and effectively communicating internal audit’s value to key stakeholders.
Figure 5. Is your company prepared to address these talent challenges?
Supply and demand
In spite of popular belief and current market conditions, there’s actually a shortage of knowledge workers in the marketplace; thus, competition for talent is fierce. The confluence of issues cited at the right is driving this competition.
Gen X, Y, etc.
Population Retiring
Boomers
Labor vs. Talent
Characteristics
The shrinking pool of available workers is becoming increasingly diverse, requiring more-customized solutions.
Gender
?
Race
?
Ethnicity
?
Sexual Orientation ?
Generation
?
Values and expectations
Watching years of downsizing, today’s knowledge worker is loyal to the development
of skills demanded by the market, not a particular employer...and expects technology-enabled flexibility and connectivity in today’s 24/7 work environment.
Relevant work
?
Career development
?
Flexibility
?
Connectivity
?
The way I work
14Business upheaval: Internal audit weighs its role amid the recession and evolving enterprise risks
An in-depth discussion PricewaterhouseCoopers Chief Audit Executives (CAEs) and internal audit managers typically have deep
knowledge of the business and industry:
79% of CAEs have eight years or more of experience.
? 59% of managers have eight years or more of experience.
? However, internal audit staff typically have more limited experience:
27% of staff have less than three years of experience.
? 31% of staff have three to five years of experience.
? 25% of staff have five to eight years of experience.
? 17% of staff have eight years or more of experience.
? Internal audit functions frequently turn to subject matter experts (SMEs) to assist in audit
coverage requiring deeper knowledge of the business, industry, process, or function.
Audits of strategic or business risks are typically handled as follows:
48% are addressed exclusively by internal audit department resources.
? 26% are augmented by SMEs from within the company.
? 21% are either augmented by or addressed by third-party service providers.
? 5% are addressed by others.
? Audits of operational risks are typically handled as follows:
63% are addressed exclusively by internal audit department resources.
? 23% are augmented by SMEs from within the company.
? 12% are either augmented by or addressed by third-party service providers.
? 2% are addressed by others.
? Our 2009 survey provided a look at internal audit
team experience and how leaders currently address
knowledge gaps.
15
Leverage technology to optimize audit operations.
High-performing internal audit functions maximize the use of technology to
enhance the efficiency, effectiveness, and quality of operations.
?
To increase efficiency, internal audit should automate issues tracking
and reporting to achieve paperless audits and reports, and use capacity
multipliers to mitigate the impact of constrained resources.
?
To improve effectiveness in the search for errors or unusual transactions,
internal audit should test entire data populations automatically.
To strengthen quality, internal audit should apply technology to conduct real-
?
time reviews, escalate issues, and ensure compliance with standards.
Technology solutions deployed in high-performing internal audit functions
typically include the following:
Integrated internal audit software to streamline the production of work
?
papers, risk assessments, and audit reports, and to automate issues tracking,
monitoring, and administrative activities.
Data retrieval software to automate testing. Proficiency with such software
?
should be considered a core competency for an internal audit staff.
?
Data-mining/analysis software for predictive analysis and modeling.
Knowledge tools and databases to provide best-practice insights as well as a
?
source for business-process benchmarking tools.
Source: PricewaterhouseCoopers. Internal Audit 2012, 2007.
16Business upheaval: Internal audit weighs its role amid the recession and evolving enterprise risks
ERP implementations highlight a skills gap.
Why internal audit must get up to speed in ERP systems and data analytics. Companies challenged by the economic downturn continue to explore technology as a means of reducing costs and improving productivity. For internal auditors, this trend brings with it a host of implications.
For starters, it reveals a growing problem: most internal auditors aren’t prepared to audit in an automated environment. However, increased automation is precisely the direction most companies are headed, suggesting that internal audit will stay relevant to the changing needs of the organization only if it remains actively involved in such transformation initiatives. As business processes and underlying technologies evolve, so do the risk assessment responsibilities of internal audit. In addition, boards and audit committees have increasing expectations that internal audit will provide additional assurance for these costly transformation projects from blueprint to post-go-live sustainability. Therefore, internal audit must evolve as well, adapting to more-automated control environments and continuous auditing tools if it intends to maintain or increase coverage with fewer resources in the future. Embracing technology at all levels, strategic and tactical, will enable internal audit to significantly increase its relevance to the technology-enabled organization and increase its productivity as well.
The current global economic crisis has also exposed a number of exceptional and brazen fraud schemes. These revelations remind us that internal audit must be more vigilant than ever in its fraud-detection activities. Therefore, internal audit’s data-mining and data-analytic capabilities, instrumental to efficiently examining the large volume of data readily accessible through ERP systems for anomalies and other fraud indicators, are now even more critical. However, our State of the Profession survey reveals that internal auditors are still grappling with a skills gap in technology, particularly in major ERP systems. Half of the participants
we surveyed said that less than 25% of their non-IT auditors have experience with the company’s ERP system, and only 28% reported incorporating data-mining and data-analysis tools for more than 25% of their audit work.
Such a lack of IT experience has implications for many organizations, since it may mean that auditors can’t effectively audit the related processes and identify potential control deficiencies, make recommendations to create efficiencies, or even access reports needed to do their jobs more effectively. In some instances, auditors may even be auditing around the system to compensate for this skills deficiency. A large majority of respondents (87%) also said that less than a quarter of their staff were familiar with ERP governance systems. These results indicate a growing strain on internal audit departments tasked with doing more with less, since they may be unable to effectively harness the power of technology and technologically savvy resources to achieve their productivity and audit coverage objectives.
PricewaterhouseCoopers
An in-depth discussion17
We asked our respondents to indicate the percentage of non-IT auditors (auditors who do
not spend more than 75% of their time performing IT audits) who have experience in specific
technology-related areas. The results included the following:
?
49% indicated that less than 25% have experience in generating reports or navigating the
company’s ERP system for the completion of audit work.
?
65% indicated that less than 25% have experience in providing recommendations
to management regarding use and optimization of ERP applications (e.g., identifying
processes not automated that could be, identifying a better way of configuring the system
to improve process efficiency, and so on).
?
75% indicated that less than 25% have experience in the use of systems or live data
feeds to regularly monitor business performance and risk indicators.
?
87% indicated that less than 25% have experience in the maintenance and use of
governance systems such as SAP GRC, Oracle’s Governance Risk & Compliance module,
or Approva.
Not only did our survey reveal a knowledge gap in technology, it also indicated a
corresponding resource allocation dilemma: the IT audit work is not well shared in most
organizations we surveyed. For the most part, technology-related risks are addressed
solely by IT auditors, who are often in short supply. In our 2012 report, 76% of those
surveyed stated that increasing the core skill level of the general internal audit staff for
understanding and auditing technology risks was the best strategy to address the
shortage of technology resources.
We asked 2009 survey participants to indicate who, of the following, generally performs
IT audits, with these results:
?
IT auditors within the company’s internal audit department—46%
?
Third-party service providers—33%
?
Internal auditors within the company who have IT knowledge—17%
?
Other—4%
To begin solving the IT resource problem, internal audit leaders need to assess the skill
sets of its auditors—including non-IT auditors—and look for ways to enhance and broaden
technological skill sets. In doing so, specific attention should be directed toward developing
integrated departments whereby technological skills are embedded within the department
and are not just the domain of a typically smaller IT audit subgroup. This integrated
18Business upheaval: Internal audit weighs its role amid the recession and evolving enterprise risks
approach will allow for more consistency and promote greater effectiveness and efficiency
in executing audits, which is especially important during a time of reduced budgets. Later in
this report, we offer some practical tips for internal audit leaders to consider in closing the
technology gap.
Despite budget pressures, however, internal audit leaders still identify training and skills
development as a core need that must somehow be met. We offer some suggestions for
efficiently enhancing a department’s learning strategy later in this report. A look at how
survey participants ranked the importance of key technological skill sets shows where their
priorities will lie in the coming year:
The percentage of internal audit departments that ranked the following skill sets as
high or medium is as follows:
?
Information technology application controls—87%
?
Data analytics—84%
?
Information technology infrastructure—70%
?
Proficiency in navigation of core ERP systems—69%
?
System implementation—67%
Optimization of information technology application functionality—58%
?
Many challenges lie ahead for internal audit departments as they continue to maneuver
through a changing business environment where technology remains a driving force. In the
coming year, it will be important to reconcile the technological implications with the skill sets
of available internal audit resources and look for cost-effective ways to manage technology-
related resource needs. We believe—and our survey respondents agree—that internal audit
functions must embrace technology in all phases of the internal audit process and ensure
that both IT and non-IT auditors are armed with a practical application of relevant systems
and data analytics. Depending on the starting point, this may mean turning the traditional
audit approach upside down and redefining the nature, timing, and extent of the audit
activities that are performed.
20Business upheaval: Internal audit weighs its role amid the recession and evolving enterprise risks