Unlocking the Value of Audit Analytics: Stakeholder Expectations
In every situation the interpretation of results is aligned to expectations. For example, a sporting team making the playoffs may be considered a great success but another team is underachieving unless they win the title. As a Chief Audit Executive (CAE) can you definitively state the expectations of your stakeholders? If not, how do you determine success?
In a recent Pulse of the Profession report by the IIA, Enhancing Value through Collaboration: A Call to Action, the issue of internal audit creating value through assurance and advisory services was studied. It is true that traditionally internal audit departments have been very reactionary but this approach is no longer meeting the expectations of stakeholders in today’s businesses. The business is demanding guidance from internal audit in addressing critical business risks and so the role of internal audit is changing to meet the need.
Is there Alignment?
The Board and executive management have been consistently challenging internal audit to provide meaningful value and justify their role as assurance providers. They want to broaden the role of the profession to incorporate risk management, business strategy and governance. It is all well and good for them to want this, but as a CAE your role is to carefully manage these expectations to align with your ability to deliver. Becoming a trusted advisor in business risk management strategies takes time.
How do you gain alignment? This often involves educating stakeholders and ensuring that your vision and timelines align with theirs.
Misalignment can occur for many reasons including the business having a very different risk appetite from audit or a lack of understanding of internal audit’s role. Should audit be involved in solving critical problems in the business? Should they be generating key insights in risk and controls? Should they be acting as a trusted advisor for the Chief Executive? These are the easier questions.
The tougher questions you should focus on at first are: Should internal audit be focusing on critical business risks? Should they be bringing foresight to the table to identify emerging risks? Are they equipped with the right resources to meet management and Board expectations?
By bringing these questions to the table and hopefully getting some consensus, Internal Audit is better able to articulate a long term vision for increasing value and relevance.
The overwhelming opinion of over 1,900 Executives and Board members participating in the 10th annual PwC 2014 State of the Internal Audit Profession Study is that internal audit needs to reach for new heights and contribute to the organization in a more meaningful way.
Figure 1: Satisfaction with internal audit value and performance, PwC, 2014 state of the internal audit profession study
Educating senior management and the Board and enrolling them in your vision is critical to achieve alignment. As CAE you have to engage them, continuously measure their expectations and adjust your execution to satisfy stakeholders. Note carefully that I am not saying that you should simply aim to meet their expectations. If your stakeholders have an expectation that undervalues the role of internal audit or changes the focus away from critical business issues then you have to change that.
Most executives will agree that the hardest part of making changes in an organization is to get the initial wins. Small incremental wins at the outset are often more difficult than huge changes once the business gains confidence in the transformation. Start with small changes with a high probability of success with a subset of stakeholders. Then roll out the changes to larger groups and repeat the process.
For example, one of our customers started with performing simple duplicate invoice testing a year ago. The results were great as they identified significant issues. This small win enrolled the AP department into using the audit analytics on an ongoing basis as an early warning system – a second win. After several small wins over time they have recently implemented continuous monitoring to examine most AP risks and controls. This big win is because the organization now focuses on having a sustainable internal control environment after realizing the success from a simple process change that occurred one year ago.
Focusing on utilizing small wins and aligning stakeholder expectations and goals will increase the credibility of the Internal Audit vision and make it easier for them to participate in more strategic risk management in the company.
About Andrew Simpson:
Andrew Simpson has close to two decades of experience in the information systems audit and security business; specifically data analytics, interrogation and forensics. He is a regular contributor to various auditing conferences and is acknowledged as an expert on continuous controls monitoring and revenue assurance.