Seeing through walls to find new horizons, PwC Internal Audit Survey

Jakarta, 6 March 2024 – Internal audit (IA) should go beyond historical analysis and provide a flexible and dynamic perspective on risk while utilising technology and data to provide assurance and risk insights. However, as the risk landscape evolves, IAs must adapt to meet stakeholders’ expectations, to ensure organisations can navigate future risks over the next decade. 

Meita Laimanto, PwC Indonesia Risk Assurance Partner, stated, “The Internal Audit department should keep evolving to stay relevant. This will allow the department to be able to strongly and smoothly collaborate with all lines to find new horizons.”

From PwC’s Global Internal Audit Survey 2023, with 4,680 executives globally including from Indonesia, we found that megatrends are creating a complex and interconnected risk multiverse, i.e. market and economic volatility, technology advancement, supply chain disruption and sustainability and climate change. Of the four risks and challenges that have been addressed by the company's IA plan, companies in Indonesia have added more to the company's plan than global respondents.

As many as 66% of companies in Indonesia have made strategies to anticipate uncertainty regarding market and economic conditions, surpassing the global average of 48%, who have addressed their risk and challenges in the organisation’s internal audit plan. Notably, 70% of Indonesian respondents incorporate technology advancements into their internal audit strategy, compared to the global of 54%. However, regarding the risk of supply chain disruption, the results of Indonesian and global respondents are not much different, only 51% and 47%. And for sustainability and climate change challenges, the numbers are also lower than other aspects, 47% for Indonesian and 44% for global. 

Driven by increased complexity and higher stakes, IA function needs more involvement in strategic areas to remain relevant. Business leaders want more strategic engagement with IA early and proactively. From the survey, Indonesian respondents think that the IA function can be involved in risk identification and assessment (70%), testing of process and control effectiveness (68%) and management strategy and planning (63%). 

Furthermore, IA can help combine expertise across the organisation to harness momentum and forge something stronger together. Respondents in Indonesia (60%) and globally (52%) believe that the Internal Audit function should be aligned with the first and second line functions in the organisation to solve key risks and problems. This gives IA a strong mandate to take the lead in creating a unified view and finding new ways to leverage the different capabilities in the organisation.

Meita Laimanto, PwC Indonesia Risk Assurance Partner, added, “Technology skills will always be important and should be developed further, but they also need to take human factors into consideration. Developing strategic thinking is one of the key components, along with creativity, agility, adaptability, and empathy.” From the survey, we found that Indonesian companies expect IA functions to have strong attributes, which are: risk and control mindset (44%), business knowledge and experience (32%), independence and objectivity (29%) and the ability to understand complex business processes (27%). Like the world around us, IA’s skills and capabilities need to keep evolving and adapting. This requires a continual focus on professional growth and an open mind. It may also mean changing how IA recruits, retains and develops talents.

Meita also added, “Interestingly, among other attributes on IA department compared to global, 

Indonesia has room for improvement in several areas, including collaborative approaches (11%), transformation and business change expertise (9%), people development (8%), and negotiation and dispute resolution (6%), where these attributes are currently only at half of the global average.

Lastly, IA needs to recalibrate its approach and work with others to unlock the potential technology; but the window is closing fast. Just over 20% of IA functions have achieved the desired benefits from their technology and data investments over the last twelve months. There could be multiple reasons why RoI is falling short, one of them is the technology is driving the strategy, rather than the strategy driving the technology. This is a common pitfall and requires pausing to reconsider and remap activities to the business and IA strategy, objectives, and intended outcomes.

In addition to the result, the survey also identified 8% of the respondents represent “Pioneer” - those that break new ground and stand out from their peers, with certain characteristics: (1) very effective in  raising significant risks and challenge, (2) high effort on strategic risk areas and (3) most of work delivered using innovative and agile methods.

To close, Meita stated, “IA’s role in providing assurance and confidence is the common denominator at any level of maturity—this is fundamental. The differentiator between success and failure, value and irrelevance, comes down to how effectively IA can understand what its stakeholders want, shine a light on what they may not see or understand, and break down barriers to assemble and connect the right technology and capabilities across the organisation.”