Rapid technological advances have transformed the business world and pushed once stable economies and stalwart companies to the brink of collapse. To stay relevant, internal audit departments must embrace bold innovations. Improving risk assessments through altering frequency, depth, or breadth is insufficient. Evolving internal audit to include continuous monitoring, thematic auditing, and nontraditional staffing stops short of the transformative innovation desired by business. New business insight is the goal.
THE CURRENT ENVIRONMENT
Companies are more integrated, more interdependent, and more geographically dispersed than ever, while internal audit is tasked with doing more with less. Both of these factors create significant challenges for traditional internal audit operating models. PricewaterhouseCoopers' 2014 State of the Internal Audit Profession study cites quality and innovation as foundational attributes for adding significant value and moving toward a trusted adviser relationship.
Meeting management expectations in a dynamic environment will require a new approach. Internal audit departments cannot afford to spend months designing a comprehensive risk universe that will become outdated immediately, nor can they devote resources to conducting extensive external research to assign risk ratings that will have short shelf lives. The need to respond to the latest headlines, attacks, and case studies necessitates a more nimble approach that permeates everything from planning to execution to reporting. Gone are the days when internal audit could spend one or two months on risk assessments, three or four months on audits, and one month on reporting. Acquiring additional resources to address a new issue that arises in the audit year also is unlikely. That begs the question: How does internal audit aggregate and synthesize organizational knowledge when this information resides within myriad people, systems, and resources, without increasing resources?
Fortunately, todays technologies give internal audit the ability to mirror the many-to-many relationships that define current business models. Mobile technology makes it easier to access data in real time. Visualization tools provide opportunities to demonstrate relationships in new ways and spark new conversations. Knowledge management tools can spotlight complex data relationships and root causes.
Like human beings, organizations suffer from multifactored illnesses. Fixing only one factor may provide modest, but temporary, gains that don't cure the illness. A more holistic approach is necessary to prevent recurrence and to achieve sustainable improvements.
Internal auditors need to connect disaggregated points of information, take a multifactored approach to problem-solving, and operate nimbly within their current resource constraints. This begins with focusing inward to embed innovation within the departments operating model. The "Nationwide Case Study" on page 49 illustrates the impact inward innovation can have on internal audit.
BENEFITS OF INNOVATION
Internal audit departments that embed innovation don't just realize process efficiencies, they also develop deep insights that position them as subject-matter experts. They begin to observe business operations differently and ask different types of probing questions that challenge their value. Reports change to focus on both the "message" and the big-picture story that provides context and creates a desire for change. Executives begin to request internal audit involvement. Operational practices are changed to accommodate management requests while meeting the audit committee's...