Why You Should Audit Your Corporate Strategy

Recently, we laid out our argument about why companies should ask their internal audit functions to tackle strategic risk. As strategic risk is such a misunderstood and much-debated concept, now is the time to help your organization define it and help internal audit provide assurance on it. What has been heartening is the number of senior audit figures that agree with us.

Why Now

We looked at the performance of the top 20% of the Fortune 1000 between 1998 and 2009 and identified firms that suffered market capitalization declines of 50% or more in a single year. As shown in this slide, by far the biggest cause of firms’ near-death experiences were strategic risks (e.g., a decline in core product demand, failure to identify asset price bubbles, or key senior management turnover). None of these things fall within the scope of a “traditional audit”.

A far smaller proportion of those risks (18%) fall into categories which internal audit is likely to investigate such as regulatory conflicts or financial fraud. This means that internal audit spends most of its time not working on the risks most likely to cause a firm’s downfall.

To rectify this, firms should consider using data analytics to cover traditional assurance areas more efficiently thereby freeing up time to work on strategic risk.

Heads of internal audit in our network tell us their audit committees are moving in this direction and are increasingly interested in non-traditional risks. At a recent New York meeting, heads of audit discussed moves to a 50/50 traditional/non-traditional risk approach; in a recent survey of 77 heads of audit, 60% told us that they focus on traditional risks 80% of the time and non-traditional risk 20% of the time. In fact, a growing number (39%) put 50% or more of their focus into non-traditional risks.

What Audit Should Do To Start Its Strategic Risk Assurance

Internal audit tends to face four stumbling blocks with strategic risk; each stumbling block stems from a lack of alignment with the strategy creation and execution process.

Traditional audit planning tools fail to capture the breadth of possible audit activities, and fieldwork and reporting tools are too rigid to adjust to the varied needs of strategic audit work. Because of this, internal audit groups fail to build an audit plan from company objectives and so then fail to audit those same company objectives sufficiently well.

The four stumbling blocks are and tips for overcoming them are:

1. The Risk Model: Risk factors typically do not incorporate company priorities and objectives in the risk assessment process. Instead, prioritize traditional assurance work by its importance to achieving corporate objectives.

2. The Audit Universe: The use of an audit universe predefines a set of activities and is typically biased to the traditional assurance areas of process or functional-based engagements. To overcome this, deconstruct corporate objectives to identify where internal audit should create nontraditional engagements.

3. Management Interviews: Auditors rely on management’s potentially inadequate view of risks and priorities to identify nontraditional assurance work. Work on a ‘lifecycle of a corporate objective’ (as we showed in our first piece on this) to improve the rigor in selecting nontraditional opportunities to work on.

4. Risk Universe: Typical risk universes broadly define strategic risks or present them out of context, making it difficult to find a meaningful starting point for an audit engagement. Instead ensure the internal audit team provides context for each risk they audit by showing how it affects the achievement of the firm’s corporate objectives.

‘Baby Steps‘

While  a number of audit heads now see the importance of strategic risks, convincing senior management is a different matter, however; as one auditor said recently:

“We are taking ‘baby steps’ to get management on board, starting with incorporating nontraditional steps into a traditional audit.“

And it will take years for firms’ entire management to be comfortable with audit’s involvement in corporate strategy. A good start for the naysayers is the slide I linked to above: tell them that strategic audits may well stop your firm following the fate of the 128 Fortune 1000 firms in the past decade that suffered a market cap fall of more than 50% in a year. That should help.

Also, please let us know what you think below, and Audit Director Roundtable clients should contact me for more detail.