A look at where internal auditing has been, its current condition, and where it’s headed.

Shannon Steffee
Associate Editor

In the wake of the financial crisis of 2008–2009, few professions have had to transform themselves quite like internal auditing. Faced with meeting heightened stakeholder expectations by focusing more on risk and governance activities, internal auditing continues to evolve as it adapts to shifting roles in the organizations it serves.

 

According to The IIA Research Foundation’s (IIARF’s) 2010 Common Body of Knowledge (CBOK) Global Internal Audit Survey, the most comprehensive global study conducted on the practice of internal auditing, it appears the focus of the profession will endure another significant change of course over the next five years. CBOK’s survey is broken down into five reports that provide an overview of the practice of internal auditing around the world. It offers insights on how the profession has changed over the past few years; the types of knowledge, skills, and technologies today’s auditors possess; practitioner compliance with The IIA’s International Professional Practices Framework; and internal auditing’s role within the organization. The first three published reports, which include feedback from 13,582 IIA members and nonmembers in more than 100 countries, provide a snapshot of how the profession has changed since the last CBOK study in 2006, what it currently looks like, and what’s in store for the future.

DEMOGRAPHICS

Thirty percent of respondents to the 2010 survey are in the 26 to 34 age range. The highest proportion of young auditors is in the Middle East and Africa, where 49 percent of practitioners are younger than 34; in the United States, Canada, and Western Europe, more than 70 percent of respondents are over 44. This difference could be due to the maturity and long-term recognition of the profession in North America and Western Europe compared to other parts of the world.

That younger demographic also means less experience, so training and career planning should be addressed accordingly, says Sue Ulrey, managing director of internal audit and regulatory compliance for KPMG in Carmel, Ind., and co-chair of the CBOK 2010 study. “There will be a greater need for both internal audit and industry training and developing more formally an internal audit career path,” she says. Interestingly, this also is a demographic that will bring in new skill sets because of younger auditors’ awareness of technology and social media, she adds.

Overall, the profession remains male-dominated (two-thirds male), with a more balanced gender ratio in the United States and Canada. The highest percentage of female respondents can be found in Europe and Central Asia (57 percent), whereas the lowest percentage (22 percent) is from the Middle East. “Women are seeing internal auditing as a good career choice, so the numbers are increasing,” says Sridhar Ramamoorti, associate professor of accountancy at Kennesaw State University in Georgia and co-chair of the CBOK 2010 study. “Internal auditing’s composition worldwide is changing, and we’re beginning to see a startling difference in the maturity and evolution of the profession.”

EDUCATION

As with many professions, there has been growing awareness of the need for well-educated internal auditors and recognition of the importance of education when dealing with challenges on the job. The percentage of respondents obtaining a master’s degree/graduate diploma increased from 41 percent to 50 percent since 2006.

Education means credibility, according to Ulrey. “Credibility is derived from increased formal education, certifications, and training. Internal auditors need to be well-credentialed when they sit down at the table with key stakeholders. The increase in higher- level degrees shows that internal auditors have listened to the message from stakeholders about what they want from them.”

The 2010 results also show an increase in the number of respondents obtaining a degree in internal auditing (from 12.7 percent in 2006 to 24 percent). The percentage of respondents in the Latin America and Caribbean region who possess an internal audit degree (63 percent) is much greater than those in the United States and Canada (4 percent), leading researchers to infer that internal auditing at the university level may not be as readily available in North America.

In addition to higher-level degrees, internal auditors also are placing more value on certifications. More than 30 percent of respondents hold the Certified Internal Auditor (CIA) credential, followed by accountancy certifications such as certified public accountant, chartered accountant, and chartered certified accountant (20 percent). Moreover, nearly 10 percent have obtained information systems audit certificates such as the Certified Information Systems Auditor.

 

STAFFING

The expected upsurge in staffing means the importance of what internal auditors do is being recognized by stakeholders, Ulrey says. “Companies are more aware of risk, so there is an increased and renewed interest in having a strong, robust internal audit department that can examine it from all angles.”

Ramamoorti agrees. “Boards of directors have realized that they may have underutilized internal auditing in the past,” he says. “The damage from the financial meltdown could have been softened had boards leveraged internal auditing more effectively.”

When it comes to compensating for missing skills, organizations appear to be relying heavily on co-sourcing and outsourcing within the United States and Canada (57 percent), Middle East (52 percent), and Western Europe (51 percent), far surpassing the average level of 42 percent worldwide. By industry, financial services ranks the highest in use of co-sourcing/outsourcing (30 percent), followed by the manufacturing and construction industry (18 percent). With 90 percent of respondents expecting no change or an increase in their future budgets, it appears that co-sourcing/outsourcing will continue at these levels or rise.

EVOLVING STAKEHOLDER EXPECTATIONS

Internal auditing’s role in the organization is continually evolving based on stakeholder and management expectations. Whereas practitioners are currently concentrating on operational and compliance audits, auditing financial risks, fraud investigations, and evaluation of internal controls, the areas of focus will be significantly different in five years. Attention will switch to corporate governance, enterprise risk management, strategic reviews, ethics audits, and migration to International Financial Reporting Standards, according to the CBOK research (see “Internal Audit Focus in Five Years” at right).

“Stakeholder expectations are shifting after witnessing failures in the marketplace,” Ulrey says. “There is now a better awareness of how internal auditors can play a role in evaluating and mitigating risks. And internal auditors have done a much better job of messaging their value proposition in the last five years. Business has responded to that.” Not only will the focus of internal auditing continue to evolve, but stakeholder expectations will continue to increase, she says.

REPORTING RELATIONSHIP

The 2010 survey shows an improvement in the relationship between the audit committee and internal auditors compared to 2006. Almost 74 percent of respondents indicate they meet or talk with the audit committee/chairman in addition to regularly scheduled meetings (63 percent in 2006). The IIA’s International Standards for the Professional Practice of Internal Auditing (Standards) requires the head of the internal audit department to report to the audit committee or an equivalent; it also recommends a dual reporting relationship where the chief audit executive (CAE) reports functionally to the audit committee and administratively to a senior management executive. Overall, 43 percent of respondents indicate they report administratively to the CEO/president/head of government agency, and 34 percent report administratively to the audit committee or equivalent. This varies by region and industry:

• Middle East — more than two-thirds report administratively to the audit committee, and almost 33 percent report to the CEO/president.
• Europe and Central Asia — 25 percent report to the audit committee, and 55 percent report administratively to the CEO/president.
• Financial industry — 39 percent report administratively to the audit committee, and 28 percent report to the CEO/president.
• Public sector/government — 5 percent report administratively to the audit committee, and 13 percent report to the CEO/president.

Small percentages of respondents indicated reporting to chief financial officers, legal counsel, chief risk officers, chief operating officers, and controllers. The importance of the relationship between the audit committee and internal auditors is reinforced in the survey, with 90 percent of respondents indicating that they have appropriate access to the audit committee and that they are invited to almost all audit committee meetings.

“The improved relationship probably is due to better dialogue and transparency around what internal auditors do and their understanding of the needs of the audit committee,” Ulrey says. “There’s also more awareness on the part of internal auditors of best practices, which includes frequent communication, and audit committee chairs are taking more active roles and requesting information to enhance their understanding of what is going on in the organization.”

COMPETENCIES AND SKILLS

Communication skills, problem identification and solution skills, and keeping up to date with industry and regulatory changes and professional standards were three of the top five competencies ranked by CAEs, internal audit staff, and managers who participated in the study. It’s crucial to identify, prioritize, and develop competencies, according to Ramamoorti, but defining them is most important because they are the skill sets internal auditors need to make sure assurance engagements are the best they can be.

Communication ranked as the top overall general competency in both the 2006 and 2010 surveys. It was also the top competency for internal audit staff, but ranked second for management and CAEs. Problem identification and solution skills also appeared in the overall top five competencies for 2006 and 2010, ranking second most important for internal audit staff and fifth for management and CAEs.

Keeping up to date with industry and regulatory changes and professional standards is now considered a priority across all three professional levels. In 2006, internal audit managers and staff ranked it in the bottom third of competencies, and in 2010 it ranks as the fourth highest competency for both. CAEs consistently ranked keeping up to date as the third most important competency in both 2006 and 2010.

ADDING VALUE

As with the 2006 survey, most respondents (92 percent) in the 2010 survey say their internal audit activity is adding value to their organization, according to the third report, Measuring Internal Auditing’s Value. However, there are slight regional differences in perceived contributions of the internal audit activity to organizations. For example, the Latin America and Caribbean region has the highest percentage of respondents who agree or strongly agree (95.5 percent) that internal auditing adds value, compared to the Asia Pacific region (85.2 percent).

The report also found that the most important factors to the perceived contribution of an internal audit activity are having appropriate access to the audit committee, functioning without coercion to change a rating assessment or withdraw a finding, and using more audit tools or technology during a typical engagement.

ADHERENCE TO STANDARDS

When CAEs were asked if their organization uses the Standards, more than 80 percent gave an affirmative response, indicating they use them in whole or in part. Full compliance with the Standards took a downturn, from 60 percent in 2006 to 46 percent in 2010. Reasons cited for noncompliance with the Standards include size of the organization, inadequate staffing, cost, time, management/the board’s perception that compliance doesn’t add value, and lack of support from management/the board.

 

Ramamoorti says the results could be more “noise” than an indicator of an actual drop in Standards compliance — he cites the ambiguity of the survey question and potential variation among participants’ understanding of the term full compliance as potential reasons behind the finding. “Regardless, we’d like to be scoring in the 90th percentile,” he says.

A LEARNING OPPORTUNITY

Results from studies such as CBOK allow practitioners to discover how their peers are practicing the profession around the world. “It is imperative for internal auditors to examine current trends within the profession and be able to make recommendations within the internal audit activity,” says Bonnie Ulmer, IIARF vice president. “This helps internal auditing to deliver the greatest value to its organization, anticipate and meet the organization’s needs, and strategically position the profession for the long term.”

Ramamoorti says the results provide a unique learning opportunity. “I like to equate it with soul searching,” he says. “CBOK enables us to take a critical look at the profession to see where there are gaps and opportunities, and how the profession is changing dynamically worldwide.”

See the Stakeholders’ Expectations and Perceptions Survey slideshow and download the CBOK reports on The IIARF’s website at no cost to IIA members.