Leading the Way is a column written by PricewaterhouseCoopers professional staff. It appears in the Business section of the Bangkok Post twice each month. The column provides specialised advice to corporate decision-makers in Thailand on global and local business trends.
This article appeared in the November 20, 2007 issue of the Bangkok Post.
By Varunee Pridanonda
Across the globe, internal-audit functions are being affected by rising concerns over corporate governance, risk management, internal controls and ethics. A PricewaterhouseCoopers' survey of internal-audit leaders in Asia Pacific suggests that the controls-focused approach that has dominated internal auditing in the past is expected to diminish in relevance over the coming years.
What factors are driving this change?
As Asian companies seek to become more global, they will be expected to have more advanced control and governance processes. Without these, it will be increasingly difficult to compete effectively in global capital markets.
In addition, many Asia Pacific countries are enacting legislation to promote better corporate governance and more transparent financial reporting. For example, Japan, Korea, India and China have all developed regulatory frameworks governing internal controls that are similar to the regulations put in place in the US following enactment of the Sarbanes-Oxley Act of 2002. The overall aim is to produce truly independent audit committees, strong enterprise-wide risk-management systems, strong and efficient internal controls, and effective internal-audit systems.
Percentage of respondents who expect a particular trend to have a strong or very strong impact on their internal audit functions over the next five years.
- Risk management 79%
- Corporate governance 77%
- Ethics and compliance 66%
- New regulations 62%
- Globalisation 51%
- Technology 45%
What types of changes will we see?
When asked in our survey where they expected to spend more time five years from now, internal auditors in Asia Pacific agreed that risk management will be a key focus moving forward. To address risk concerns, internal-audit leaders we interviewed said they plan to update their risk assessments on a more frequent basis. They also plan to take a shorter-term approach to audit planning in order to gain both flexibility and agility and to ensure that their internal audits are on target.
Survey respondents believe continuous auditing offers significant promise. Some internal-audit leaders cited the ability to use continuous audits to zero in quickly on riskier events at lower cost. ''The challenge is to figure out where to look and what to look at,'' said one Asia Pacific internal-audit leader. For many companies, continuous auditing routines have already become an integral part of their audit plans.
Percentage of respondents who expect a particular factor to generate either somewhat more or much more responsibility for internal audit over the next five years.
- Auditing the ERM process 77%
- Auditing IT security 77%
- Educating company personnel 77%
- Continuous auditing 76%
- Ethics programmes 69%
- Fraud prevention and detection 67%
What progress will we see over the next five years?
Over the next five years, internal audit leaders will begin to re-define the function's value proposition. Based on our study, we believe that a ''risk-centric'' internal audit model will provide assurance on the effectiveness of risk management in addition to controls assurance. This additional level of assurance will help internal audit align itself more closely with the organisation's maturing risk-management capabilities.
To help their companies achieve advanced levels of control and governance, internal auditors need to progress as quickly as possible. However, that's no small feat, because an internal-audit function cannot change its primary orientation overnight
How is the internal-audit function in Thailand changing?
In Thailand, we've noted a significant increase in the demands from boards of directors that their internal-audit functions play a greater role in providing assurance in risk management, not just in internal controls. Executives want something more from internal audit to help improve the efficiency of their organisations, provide reliable financial reporting, and ensure compliance with laws and regulations.
More importantly, audit committees in Thailand may take more responsibility to ensure that internal controls in the organisation are adequate to mitigate risks and deter fraud opportunity. As a result, internal-audit committees in Thailand will play a significant role in giving assurance and providing consulting services to their stakeholders, and especially boards of directors, audit committees and executives.
What's ahead for internal audit in Asia Pacific?
It's an exciting time to be an internal auditor in Asia Pacific. The expectations of internal-audit stakeholders are at an all-time high, and significant opportunities abound for internal-audit leaders to be more engaged with executive management and the board of directors.
We believe internal-audit functions must be proactive and redefine their value to their organisations. Central to internal audit's strategic repositioning is the ability to adopt an all-inclusive, conceptual approach to audit, risk assessment, and risk management that extends well beyond a focus on financial controls.
