The Role of Internal Audit Post-Pandemic

Lessons from internal audit leaders

We talked to Chief Audit Executives in the financial services and professional services industries to understand how the senior management in internal audit is adapting to the demands of today and the unknowns of tomorrow – How Internal Audit Adjusts for Tomorrow. The highlights of that conversation include lessons on adaptive working, strategically aligning the internal audit function to business objectives, smarter use of technology, and building stronger connections with people.

Steve Brown
Chief Audit Executive
Booz Allen Hamilton

Jim Enstrom
SVP & Chief Audit Executive, Internal Audit
Cboe Global Markets

Creating Strategic Alignment with the Business

The deeper inquiry we should be exploring is how does internal audit add value and support key metrics when internal audit is challenged with understanding what the pandemic means to the business and how the audit team should evolve in support.

“If the audit report written this year says: we need to prepare for global pandemics, we will have failed. We need avoid looking back and stating the obvious because it’s not helpful,” Steve Brown advises.

The stress the pandemic and surrounding events have put on businesses, processes, and internal controls signify key areas where internal auditors can find opportunities to improve. “We need to ask ourselves, what does stress in our economy, our business, our processes and controls look like and what can we do to proactively plan for those?” Brown advised. If internal auditors cannot go that far, the next best step is in documenting current experiences and share them with the business so that teams can assess and recommend changes for the future.

“Agility isn’t often a word we use in internal audit because it’s hard. We get comfortable. We have our annual audit plan the board approves it and we execute. We need to be able to say ‘I thought this was important, but in the context of what’s going on in the world, this isn’t as important,’” says Brown.

One thing has held true during this pandemic experience: things continue to change. As a result, internal audit teams must prepare for flexibility. Agile will become the new future of internal audit. Internal auditors need to look for actionable insights on how risk and controls are being managed to make recommendations moving forward.

How internal audit becomes agile

Conduct smaller audits that look at a subset, such as controls, cash management, collections, or how to approve ‘a, b, c’ initiatives.
Become laser-focused on your subsets, which allows you to stay nimble.
Utilize analytics to gain a real-time pulse of what’s going on in your organization.
Start monitoring real-time versus traditional thinking of “let’s go do an audit.”

A shift to specialized co-sourcing resources

Historically, internal audit has leveraged strategic co-sourcing because it is purposeful in nature. In some environments, it’s a capacity play, while in other circumstances it’s because in-house resources lack specialized skillsets like IT or capital markets, or sometimes the organization cannot retain in-house auditors with specialized skillsets on a permanent basis.

Moving forward there will still be a continuous need for co-sourcing specialized skillsets, but those skill sets will be unique to each organization. The important thing is to get guidance from your internal audit committee to make sure everyone is aligned upfront on the skills needed to support the business before co-sourcing decisions are made.

Greater reliance on technological skillsets

Right now, businesses are going through tremendous amounts of change. The ability to execute upon technical goals that support changing needs requires involvement from stakeholders across the business who may not have time or bandwidth to focus here.

Internal audit should absolutely be using this time to focus on technology. Audit teams should be evaluating and utilizing internal audit technology specifically designed to support the risk assessment process, leverage data, and analytics that exist in the organization and relate KPI feeds into risk assessment methodology.

Steve Brown thinks of technology utilization in two buckets:

To improve documentation & efficiency
To make auditing better

Invest in technology to improve the quality of information that gets you to deeper and better results. Capitalize on technology that manages risk assessments and audit schedule to move you up on the efficiency curve. “Automated workflow is where the world is today and I think that’s where it will continue to go,” Brown stated.

Jim Enstrom encouraged internal auditors to, “Ask yourself, why did you join this profession? Most of us like problem-solving and learning opportunities.” By bringing new technology onboard, the internal audit team can hone new skill sets to continue sharpening their minds.

Internal audit becomes advisors to the organization

Brown suggests, “To add more value, we as auditors need to take more risks sometimes. To earn or share a seat at the table, you have to be able to share your opinion. Take a little more risk in conversations instead of doing 150 hours of fieldwork just to prove a point.”

The key here is learning to be constructively candid, even if your opinions have not been backed up by fieldwork. These conversations will not always be comfortable, so remember to:

Ask questions
Prod your audience to think about an issue from a different perspective
Be inquisitive to become a better problem-solver

Deciding when to go back to the office

No one has an answer on when it is safe to go back to working in an office, but it also shouldn’t be our focus.

The tone at the top should be, “If we’re all united in why we choose to work and show up, we’re results-oriented, we hold each other accountable – that’s what matters.”

Today’s video calls force us to be more deliberate in our interactions with people. Leaders are hosting more 1-on-1 meetings, more team meetings, and emphasizing the need for employees to reach out to one another. Before the pandemic, only a small percentage of companies allowed work-from-home policies and now nearly everyone is doing it and proving it works.

Both Brown and Enstrom believe companies will be open to continued working from home moving forward. Leaders and department heads need to recognize the landscape has changed and need to embrace this evolution.

“There should not be concern about negative impact on the culture of your company or team because of this work from home environment. In fact, this is an opportunity for you to strengthen and elevate the importance of your team,” advises Enstrom.

Conduct an exercise that creates a ‘team-culture’ statement to define why team members should show up every day. Cboe describes their focus of learning, trust, and support as existing concepts that have become amplified in today’s environment:

Lifelong learning. Expose yourself to new ideas and new concepts. That is fundamental to success right now in an ever-changing environment.
Create a culture of trust. Right now, your employer has to trust you. In the future, trust as a concept of teamwork will increase and management will be forced to recognize that.
Helping. Use your role as an internal auditor to support your organization however needed. This helps maintain morale and keeps teams engaged to get the work done.

How we measure Internal Audit’s success

Patience. The internal audit committee needs to continue to be patient. Everyone is experiencing the impact of this pandemic from a different perspective and point of view, so each of us has a responsibility to be good listeners.

Brown defines his measure of success as, “If the board can look back 18 months from now and say, internal audit was in the trenches with us.”

What the future holds for us is what we make of it. We are all navigating as best we can and how we demonstrate partnership and value is how we get through this.