"Internal auditing should be about tomorrow," Charlotta Hjelm, chief internal auditor at the Swedish insurance co-operative Lansforsakringar, Stockholm, says. "If the function focuses mainly on financial audits, it is mostly looking at what happened yesterday and today."
Hjelm says boards and audit clients are looking to their chief audit executives (CAEs) to provide assurance over their forward-looking operations and strategies--no more so than in areas of rapid change, such as product launches or IT initiatives. As a result, functions that have historically concentrated on auditing controls over financial information have been pushed out of their comfort zones and into the fuzzier world of nonfinancial auditing.
"If you are conducting financial audits, things are black and white," Hjelm says. "The controls are right or wrong." So-called nonfinancial audits, on the other hand, may be concerned with improving the efficiency of business processes, or the quality of services. Auditors working in those areas need adequate knowledge of the business and its functions--from human resources and sales, to supply chains and customers. "If a business wants to be the best, most efficient, and offer the highest quality of goods or services, that can be hard to define," she says.
This lack of clarity has an impact on internal audit. If an organization's goal setting is not precise, auditors can struggle to grasp what separates the most important audit area, for example, from the slightly less important. Moreover, risks in dynamic areas of the business can change rapidly, impact business processes in other parts of the business and prove difficult to cover comprehensively. Internal audit teams working in nonfinancial areas of the business need a wider range of technical skills, broader soft skills, and deeper business knowledge. But the rewards of engaging in these areas include providing better insight to the business on the quality of its operations and the risks it faces tomorrow.
ALIGNING WITH THE BUSINESS
The shift in emphasis from static, backward-looking audits has come from boards and from the profession itself as it has sought to win that coveted seat at the top table. In fact, over the past 15 years internal auditors in most sectors have been aligning themselves more closely with their organizations' strategies. According to Driving Success in a Changing World: 10 Imperatives for Internal Audit, a 2015 report from The IIA containing the most recent figures, globally 57 percent of audit departments say they are aligned fully or mostly to their business' goals and objectives. As that percentage continues to grow, increasing numbers of auditors will be moving into those dynamic areas of the business that need assurance most--whether they are primarily financial in nature or not.
This realignment to auditing nonfinancial areas has led to a shift in approach that places greater value on what audit findings mean to the business than whether or not the organization is compliant with regulations. In regulated areas such as finance, for example, boards still want to know whether they are compliant with Solvency II--a European Union directive that focuses...