SINGAPORE, 12 November 2007 – Internal audit leaders must redefine the function’s value proposition and adopt a risk-centric mindset if they aspire to be key players in assurance and risk management in their organisation, according to two new reports released by PricewaterhouseCoopers (PwC). “ Internal Audit 2012 ” and “ Internal Audit 2012 – Asia Pacific Supplement ” identify major trends that will likely shape the world of internal audit over the next five years. The studies, which were based on interview and survey data from Chief Audit Executives (CAEs) of fifty selected large companies in Asia Pacific and from US Fortune 250 companies, found that the controls-focused approach that has dominated internal auditing is expected to diminish in relevance over the coming years.
The central finding of the studies is that over the next five years, internal audit leaders must redefine the function's value proposition. Based on the studies, PwC has determined that a “risk-centric” internal audit model would provide assurance on the effectiveness of risk management in addition to controls assurance. This additional level of assurance would help internal audit align itself more closely with the organisation's maturing risk management capabilities.
As Asian companies seek to become more global, they will be expected to have more advanced control and governance processes. Without these it will be increasingly difficult to compete effectively in global capital markets. To help their companies achieve such advanced levels of control and governance, internal auditors need to progress as quickly as possible. However, that’s no small feat, because an internal audit function cannot change its primary orientation overnight.
The two reports highlight the trends that will have the greatest impact on the internal audit profession in the coming years. The two reports also highlight the similarities and differences between the internal audit functions in Asia Pacific and the US.
Keith Stephenson, PwC’s Asia Pacific Performance Improvement Leader says, “We’ve noted a significant increase in the demands from boards of directors that their internal audit functions play a greater role in providing assurance in risk management, not just in internal controls. Executives want something more from internal audit.”
The PwC studies show that internal auditors in Asia Pacific face a number of obstacles due to the cultural norms that tend to inhibit promotion of a dynamic and independent role for internal audit. A number of large organisations in the region either have no internal audit function whatsoever or have an internal audit function that focuses on low-value activities. Companies in Asia Pacific are often slow to demand a stronger internal audit function, but as these companies assume multinational status they quickly realise the value and benefit of a robust internal audit function that is aligned strongly with the strategic direction of the organisation. To this point, 68% percent of the Asia Pacific respondents told PwC that the role of the CAE will increase in importance over the next five years.
“Our experience in Singapore is that some companies need to get back to basics with controls. When asking management to develop cost effective but reliable control frameworks, Boards must do more to ensure that the outcome is one of sustained substance rather than form. To make change stick requires a genuine commitment from the top down,” adds Mr. Stephenson. “The study points to opportunities for organisations and their internal audit function to move beyond basic controls coverage and become strategic players in assisting the organisation to manage risk.”
Time is short; either move quickly to embrace a risk-centric approach to assurance or risk losing further ground to global competitors.
“CEOs and CFOs are increasingly asking us to help them determine the value they are currently receiving from their internal audit functions. Internal auditors need to embrace new tools and techniques to be effective,” says Mr. Stephenson. Central to internal audit’s strategic repositioning is the ability to adopt an all-inclusive, conceptual approach to audit, risk assessment, and risk management that extends well beyond a focus on financial controls.
All across the globe, internal audit functions are being impacted by the rising concerns over corporate governance, risk management, internal controls and ethics. Asia Pacific internal audit leaders expect to be impacted more significantly by these external trends than do their American counterparts.
There is more behind this change than just good corporate governance. Many countries in this area are enacting legislation to promote better corporate governance and more transparent financial reporting. For example, countries such as Japan, Korea, India and China have developed regulatory frameworks governing internal controls that are similar to the regulations put in place in the US following enactment of the Sarbanes-Oxley Act of 2002. Furthermore, all state-owned enterprises in China are now required to implement an enterprise wide risk management system, and listed companies in India are now required to control risks through means of a risk management framework.
Changing roles and responsibilities
Asia Pacific and US respondents agree that risk management will be a key focus moving forward. To address risk concerns, internal audit leaders in both regions told PwC they plan to update their risk assessments on a more frequent basis. They also planned to take a shorter-term approach to audit planning in order to gain both flexibility and agility and to ensure that their internal audits are on target.
Internal auditors are adopting continuous auditing techniques to provide more assurance using less cost. Ninety percent (90%) and 76% of CAEs in the US and Asia Pacific, respectively, indicated they expect to be using more of continuous auditing strategies in their internal audits.
The fact that internal audit functions in the Asia Pacific region are not as advanced as their US counterparts is strongly reflected by the survey results dealing with stakeholder dynamics. In Asia Pacific, 87% of CAEs anticipate the importance of their audit committee relationship will increase over the next five years, compared with 10% in the US.
Both Asia Pacific and the US survey populations agreed that the most important skill sets five years from today will be data mining, risk assessment, information technology, risk management and fraud detection.
We believe internal audit functions must be proactive and redefine their value to their organisations. It is vital for internal auditors in Asia Pacific to learn from the experiences of their peers in other regions of the world. Take advantage of new tools and techniques to make the most of today’s opportunities. “Internal audit must move quickly to redefine its fundamental value proposition in order to remain relevant to the organisation,” concludes Mr. Stephenson.