The Protiviti View is examining some of the ways internal audit (IA) departments around the world are reinventing themselves, drawing on the experience of 16 innovators profiled in Internal Auditing Around the World, Volume 15. We examined various specific technologies and approaches (RPA, analytics, and agile auditing techniques) and the way they are being applied by leading audit departments. This post reflects on the true meaning of audit innovation.
To grasp the scope and speed of change in the global marketplace today imagine replacing the install date of a corporate technology stack with the type of telephone in fashion when that technology was installed. Under such a scenario, innovators would be sporting iPhones and Androids; most companies would still be carrying flip phones; and a surprising number would still be trying to transmit data through dial-up.
Internal auditors have been calling out this enterprise risk for several years, but it has only been within the last couple of years that the profession has begun its own journey of transformation to next-generation internal audit governance, methodologies and enabling technology. According to Protiviti’s 2019 Internal Audit Capabilities and Needs Survey, only about a third of respondents indicated that their IA organizations have fully embraced an innovation agenda, and only 4% have made innovation a core value.
Innovation as a Core Value: A Few Examples
In talking about transformation, it is always instructive to define a desired future state. Internal Auditing Around the World, Volume 15 offers as an example Synchrony, a fintech company that created its IA function from scratch within the last five years.
Synchrony was spun out of GE Capital as a public company in 2014. Mark Martinelli, executive vice president and chief audit executive, began with a staff of 10 and has expanded to a team of 60, including six data scientists.
Recognizing that he had been given a rare opportunity, Martinelli invested heavily in audit tools and created a “Data Intelligence Academy” to ensure that every team member has at least a working knowledge of data analytics. He said the training has already resulted in timelier audits that are more closely aligned with business objectives, but his goal is to achieve near real-time assurance with dashboards and workflow tools to increase transparency and eliminate approval bottlenecks.
Most internal audit functions don’t have the luxury of starting from scratch. That does not preclude them from being innovators; it just means they have to be open to new ideas. Occidental Petroleum is a hundred-year-old company with a next-gen-minded IA leader determined not to let tradition get in the way of innovation. Occidental’s vice president of internal audit leads a small team of two directors, one manager and one senior auditor. That small team conducts between 70 and 80 audits a year, through a co-sourcing arrangement that ensures Occidental’s audit skills and technology are always state of the art, and by outsourcing contractor audits to a third-party provider.
Contractor audits account for 40% of the internal audit workload. Outsourcing that work allows Occidental’s audit team and co-source partners to focus on projects that create value for the business, such as a current enterprise risk management initiative to create dashboards for monitoring key risks and key performance indicators.
In 2018, Occidental introduced automated process maps for all internal audit activities, and now requires some type of data analysis on all projects. The data analysis requirement is mandatory. The only way to opt out of this requirement is for an auditor to request permission, and exceptions are not granted lightly.
“We need people in internal audit who have a technological viewpoint because that’s the future,” said Occidental’s vice president of internal audit. “We also need critical thinkers and good communicators.”
Representing yet another innovation strategy is Capital One, once a credit card company which has evolved over the past 25 years into one of the largest full-service financial services companies in North America. Capital One has made innovation part of its brand message. The 300-member IA function includes an 80-person technology audit division, with a 20-member Data Analytics and Innovation team. This team is looking for ways to use artificial intelligence, data analytics, and new technology to deliver deeper and more forward-looking insights.
In 2017, Capital One’s internal audit function restructured its audit delivery operations into “agile pods” — small groups of five or six auditors empowered to identify and resolve any issues or challenges that arise in the audit process and create more transparency, as the organization works toward real-time monitoring and auditing.
One of the more unusual innovations at Capital One is the use of “empathy research,” which uses design-thinking sessions to ensure that the tools and technologies being deployed are aligned with the needs of the team and not just tech for tech’s sake.
These examples illustrate that innovation in internal audit is more than the sum of several technologies – it is driven by a next-gen, trailblazer mindset, a willingness to make bold decisions, learn from mistakes and never stop asking, “How can we get even better?”
Taken together, our “world tour” of innovative audit departments and the Internal Audit Capabilities and Needs Survey results paint a picture of a profession in the throes of change. Substantial progress has already been made. Those changes, combined with the transformation planned over the next couple of years, will set the tone for the next generation of internal auditing.
