From Corporate Cop to Corporate Strategy – The Future of Internal Audit

Among all the corporate functions that have risen to prominence in the past decade, internal audit (IA) has had one of the fastest rides. This is mainly because of the myriad demands on firms to comply with Sarbanes-Oxley legislation.

IA has spent a lot of time and resources to gain internal respect and, by and large, has shifted perceptions away from it being seen as the ‘corporate cop’, and toward it being seen as a useful partner in business decision-making. But it now has a chance to take advantage of the increased interest in corporate risk management, and make long-lasting changes, both to the function and the way it helps the firm that funds it.

Why Audit Should Tackle Strategic Risk

The IA function should move beyond traditional controls and process-oriented work and start partnering with senior management and the line on true ‘strategic risk’. Large firms should rely on audit expertise to turn an early and effective response to a risk into an opportunity to make investments ahead of competitors.

A lot of senior management (and some heads of audit) would scoff at the idea of ‘strategic risk audits’. We disagree. As has been proved time and again in the past 18 months, the ability to see round corners and deal with risk will differentiate the best firms from the rest. Companies will lose out if they don’t make use of the audit function’s ability to drive this advantage.

A Definition of Strategic Risk

Our research into this shift in the function’s focus is just beginning, but we know that getting it right will depend on a strong definition of strategic risk. So here it is:

“A risk is any event that interrupts the fulfillment of an objective along that objective’s lifecycle.”

The most important ‘objectives’ to work on are, of course, the multi-year corporate goals of the firm. Internal audit should be involved in assessing the processes its firm uses to choose and execute on those objectives. This means IA should look at:

• The information used to decide on the objectives
• The strategic planning process used to show how the objectives can be achieved
• The execution of the strategy
• The evaluation of the strategy’s success

Most of our clients do some work on the assessment of strategy execution (stage 3 in chart 1 below) but do not necessarily get involved in the rest of the process.

Chart 1: The Lifecycle of an Objective

Internal Audit Should Not Depose the Head of Strategy

We want to be clear: we are not advocating that Internal Audit should be involved in setting and executing strategy. Rather, IA should play a role in making sure that the processes used to do so are as good as they can be. The table below sets out role distinctions for each part of the process.

What Next Generation Internal Audit Will Require

This evolution will require a fairly large shift in the constitution, skills, and activities of the internal audit team. Chart 2 shows some of the changes required.

Chart 2: The Future Roles and Activities for Internal Audit

These changes will take a number of years, but some of our clients are already making this shift. We believe that if you don’t follow suit, your firm and your function will lose out.

We would welcome any thoughts or questions you may have; please share your comments via the box below, or contact me through the link in the top right hand corner of the page. If you are the head of internal audit at your firm, please sign up for our series of meetings with other heads of IA this summer.