Chief audit executives (CAEs) worry that their internal audit functions lack the tools and skills to help their companies compete with “born-digital” newcomers. Most say they are taking steps to fix this. But innovation and transformation requires more than just a series of discrete activities.
Next generation internal audit requires a fundamental rethinking of the design and capabilities of the internal audit function. Most audit executives recognize this important fact and have begun to move in that direction, according to Protiviti’s 2019 Internal Audit Capabilities and Needs Survey. However, most are in the earliest stages of transformation, and more substantive progress is needed.
Survey Findings
- Three out of four internal audit groups are undertaking some form of innovation or transformation effort — While this finding is expected given what we’ve observed in the market, it also sends a clear message to the significant number of internal audit functions that have yet to begin their next-generation journeys – do not fall behind, or you will be left behind.
- The adoption of next-generation internal audit capabilities is in its early stage — The implementation of the governance mechanisms, methodologies and enabling technologies that comprise the next-generation internal audit model has so far occurred in a predominantly ad hoc manner. Internal audit groups within organizations that are digital leaders have made substantially more progress with their innovation and transformation initiatives.
- Chief audit executives need to take the lead in getting the function’s transformation on the audit committee agenda — Fewer than one in five organizations report that their audit committee is highly interested in the internal audit group’s innovation and transformation activities. It is incumbent on CAEs to convey the internal audit function’s commitment and explain why it is important.
- ERM, cybersecurity risks, vendor and third-party risk management, and fraud risk management are top audit plan priorities — Internal audit groups are highly focused on these areas in their 2019 audit plans.
Our Analysis
To date, most internal audit organizations describe the maturity of their internal audit transformation activities as relatively low. They also appear concerned that they trail other companies when it comes to advancing their function’s innovation and transformation activities. The concern about a perceived lag in innovation and transformation may be misplaced – after all, the majority of internal audit functions are still in a relatively early stage of transformation – but it does underscore an awareness of the need to transform, perhaps even a sense of urgency among some internal auditors.
Transformation requires seeking ways to do things better by leveraging new processes and the latest technologies. Internal audit leaders should encourage new ideas, new solutions, learning opportunities and information sharing both inside and outside the function.
Transformation champions are critical. Roughly six out of 10 internal audit groups have already adopted this structural mechanism as an enabler of sustained commitment to transformational change. These champions should be just one element of a broader change management plan, which follows a proven methodology to bridge the gap between vision and delivery.
Finally, CAEs need to take the lead in ensuring that internal audit transformation is one of the audit committee’s core agenda items. Given all of the strategic and other risks competing for their attention, audit committees are unlikely to proactively advocate the need for the internal audit group to develop next-generation capabilities.
Fewer than one in three internal audit groups currently have a roadmap in place to guide their innovation and transformation journeys, although it is encouraging to note that a majority say they plan to formulate this vision within the next two years. To that end, we have created a research guide that may prove helpful in the journey.
For the complete survey report and related resources, click here. Also, learn more about Protiviti’s internal audit services.
