Auditing In Tight Times

The current economic crisis is challenging internal auditors to deliver value and assurance with fewer resources.

Neil Baker
Editor, Internal Auditing

Geoffrey Storms is philosophical about the impact of the economic downturn on his internal audit shop. His current employer recruited him four years ago to build an audit function from scratch. His team has been working hard to educate management and the board about what internal auditing does, and why it is important. He's been making real progress. So how does he feel now that his budget is being cut? "If I was a newly minted auditor, I would probably be angry," he says. "But I've been in the profession for a long time, and I've experienced this kind of downsizing in other organizations. If I know in advance that I'm going to be somewhat resource constrained, then I can deal with it."

Despite the stoicism, Storms says he argued against the budget cuts. He told senior management at the mining company where he is chief internal auditor that pruning audit resources in a downturn is not a prudent course of action. Why not? "Because in times of belt-tightening, organizations often face greater risks. It's not a time to start losing controls; it might even be a time to strengthen them."

Storms is not alone. Around the world, fellow internal auditors have been waging the same battle, trying to persuade people who hold the corporate purse strings that now would be the worst time to cut audit resources. Naturally, the heads of other corporate functions are making the same argument about their respective services. When times are tough, every corporate function will fight to protect its piece of a shrinking budget pie. So does internal auditing really deserve special protection? And if auditing does have to take a share of the pain — which seems to be the case for most shops — how can chief auditors rework their plans so they continue to deliver assurance and value with less money?

THE BUDGET CRUNCH

Research confirms that many audit departments are currently facing budget cuts or freezes. The recently published PricewaterhouseCoopers (PwC) survey on the state of the internal audit profession shows the depth of the budget crunch in the United States. A third of the chief audit executives (CAEs) who responded to the survey say their budgets would be reduced this year; half expected them to remain flat. Predictions from the largest companies in the survey were grimmer still: 51 percent of those among the Fortune 500 say they face a significant risk that the economic downturn will cause budget cuts during the coming year. The fieldwork for the study finished in December, and the world economy has deteriorated since then. Therefore, pressure on budgets will likely be even worse than predicted.

Storms met his budget cut by losing two front-line audit posts. His shop has three managers, each with his or her own audit staff — there were 15 people in total, nine of whom actually worked on audits. That number has fallen to seven. "We examined the audit plan for 2009 and considered how we would accomplish our objectives with two fewer staff members," Storms says. They eventually determined that a different approach was necessary: The plan had to change, and some of the audits had to be eliminated. Storms discussed the issue with his audit committee. When he joined the company four years ago, the committee gave him a mandate to identify and risk-rate its audit universe, and then audit all the high-risk areas within five years. "This downsizing puts us at risk of not being able to do that," he says. Storms conveyed this message to management and the board, but to little avail. "They understand, but they are prepared to live with some of the risks," he adds.

One way of covering the same audit plan while cutting costs would be to reduce the time spent on each audit. Storms ruled out that option. These were mostly first-time audits; a great deal of uncertainty existed around the level of inherent risk in some business areas, in addition to residual risk, he explains. He told the audit committee that performing fewer audits was better than cutting quality. How did the committee respond? "I'll put it this way: It wasn't a brief conversation," he says.

SHOW THE IMPACT

The key to convincing an audit committee that less internal audit budget equates to less assurance is to be specific about the work internal auditing can no longer perform, says IIA President Richard Chambers. He advises showing committee members the audit plan and specifically identifying the audits that will be removed. That gives the audit committee the chance to request that some audits stay on the plan, and that others are cut instead.

"The CAE's conversation with the audit committee needs to be tangible and real in terms of the impact on audit coverage," Chambers says. "Otherwise surprises inevitably will surface later." If the CAE talks vaguely about a reduction in audit coverage, individual audit committee members might develop different ideas about what the audit shop is likely to cut, he warns.

An Audit Makeover In this tough economic climate, auditors should consider giving their audit shop a quick four-step makeover, advises Jim LaTorre, managing partner of PricewaterhouseCoopers' U.S. internal audit practice. First, he recommends reviewing the last risk assessment. "Everything has changed so dramatically in the last few months that you may be chasing risks that are significantly down the scale now," he says. Second, LaTorre suggests looking at the way the audit shop works. "I would look for ways today to reengineer my department and to stratify those items I believe are 'must-haves' and 'nice-to-haves,' where I can legitimately cut costs." Third, he advises auditors to review the audit shop's skills complement. If the shop doesn't have the skills needed to deal with the issues in the new risk assessment, auditors should look for short-term, creative ways to fill those gaps. One solution might be to bring in guest auditors from other departments. Finally, and most importantly, "Remain in direct, constant communication with the audit committee and management regarding their view of emerging risks and where audit effort should be spent," LaTorre says. "Do not go it alone."

The CAE should ask the committee what areas it wants to prioritize, he says. "It's easy for CAEs to start by identifying audits that their department needs to keep doing, but they should first talk to stakeholders and obtain their assessment of where the audit department should focus. Ask them: 'What should we be doing for you?'"

Reigning in expectations in this way is important, Chambers says. In many instances, auditors mistakenly believe they have to maintain the same audit coverage from the previous year, but with fewer people. However, that approach will impact quality, he warns.

If the audit committee insists that the audit plan stays the same, Chambers recommends that CAEs review the scope of each assignment — just like they would the entire audit plan — and focus on the high-risk areas that offer the greatest value for resources expended. "Any audit shop taking that approach must be fully transparent in its audit reports about the level of coverage and about any objectives or risks that were not addressed because of budget constraints," he says. "That will make the report more useful and valuable and prevent the reader from misinterpreting the level of coverage internal auditing has provided."

Determining how to redirect audit efforts can involve a difficult balancing act. For example, CAEs often report to two masters: the finance chief, who sets the audit budget, and the audit committee, which receives the assurance that this budget pays for. What if the audit committee wants the same level of assurance but the finance department wants to cut the budget? "If the chief financial officer has decided that the audit function should be reduced, it is vital for the audit committee to be aware of that," Chambers says. And if the committee members don't know about it, the CAE should tell them, he adds. "I would never advocate that internal auditors play one of their stakeholders against the other, but they do have a responsibility to make sure the audit committee is aware of any resource issues or challenges they face."

CHANGING RISK PROFILE

Budget cuts are not the only reason to revisit the audit plan in a downturn: The risk profile of the organization is likely to be changing too. A recent survey from The IIA's Global Audit Information Network — Knowledge Report: 2009 Hot Topics for the Internal Audit Profession — showed how auditors around the world are refocusing their audit efforts to reflect a changing economic climate.

A third of organizations in the survey say the downturn is affecting the focus of their work, with the risk of fraud representing the main area receiving extra attention. Half of the respondents feel that budget cuts across their organization would damage its control environment and its ability to achieve business outcomes this year. The survey said auditors should be reviewing what the organization is doing to maintain its control coverage, but the majority (58 percent) have no plans to do any work on this risk.

The PwC study on the state of the profession has more detail on the shifting audit focus at U.S. companies. The two main areas gaining increased attention are strategic/business risk and operational risk. Most audit shops at the companies surveyed are heavily rooted in financial controls and operational compliance, a reflection of the fact that they all have to abide by the U.S. Sarbanes-Oxley Act of 2002.

Financial control will remain important, but PwC is seeing increased audit work in other risk areas, reflecting the changing economic times, says Jim LaTorre, managing partner of the firm's U.S. internal audit practice. Hot areas include whether big customers can pay their bills, whether suppliers might become bankrupt, and whether cost-saving measures such as offshoring administrative work are delivering the expected benefits.

LaTorre, who is a practicing CAE at a large hospitality and leisure company in addition to his role at PwC, says auditors need to look at what they do from a wider perspective. "There are ways to fight this problem and still maintain a degree of cost effectiveness, but it's going to require knocking down some of the old barriers and revisiting established thinking to find a solution that works best for the organization."

For example, internal auditors need to focus more on the risks that could destroy shareholder value, or stop the organization from building value, LaTorre says. For some, that would entail a significant re-examination of internal auditing's role in relation to risk. But at this point the recession is just accelerating a change that needs to happen anyway, LaTorre says. The internal audit shops at large U.S. companies have grown used to "near untouchable status" in the Sarbanes-Oxley era because of core skills inherent within internal auditing, he argues. The work that the 2002 legislation mandates around financial control is still important — failure can land company officials and board members in the proverbial hot seat — but companies have made substantial progress in improving their financial control environment because of the legislation, he says. Perhaps there are more efficient ways of providing assurance over financial controls, such as better use of data mining techniques, to "unlock" hours from financial control monitoring that can be shifted to address emerging risks, he suggests.

Michael Fucilli, auditor general at the Metropolitan Transportation Authority (MTA) in New York City, is one of the CAEs who has been changing his audit focus. His team is doing more work on procurement fraud; for example, trying to spot fraudsters who submit fictional invoices in the hope they'll be paid. It is also checking the way contracts are awarded, looking at background checks on suppliers, and auditing payroll. "Believe it or not, I even added petty cash audit to the plan this year," Fucilli says. With the organization's high-risk areas so well controlled, trouble can arise in the seemingly low-risk areas, he reasons. "I've added more audit coverage to some of my low-risk areas, just to make sure that they really are low."

FIND EFFICIENCIES

Thoroughly examining how the audit shop operates represents another way to make smaller budgets stretch further. Chambers was the head of the U.S. Army's Global Internal Review and Audit Compliance Department in the early 1990s, when it made massive budget cuts. The impetus for reductions was the end of the Cold War rather than a recession, but the impact was the same. Head count in the audit shop fell from 1,700 to 1,000 auditors, with some offices losing 75 percent of their audit staff.

"It forced us to take a hard look at what we were doing and determine how we could work smarter, better, and quicker," Chambers says. Some audit processes had just evolved over time, without any great scrutiny. Chambers and his team looked at areas such as audit planning processes, the development of risk assessments, and the planning of individual assignments. "Auditors should ask themselves whether or not they're dedicating the appropriate level of resources to those areas. Perhaps there are opportunities to streamline the way audits are conducted."

Chambers' advice to CAEs: "Perform an end-to-end examination of your audit processes." Inefficiencies in audit execution often result from too much documentation, he says, and too little use of technology. The three key processes are planning, fieldwork, and reporting, he says, and auditors should review all of them. For the Army, Chambers' team created what they called the Quick Response Audit. "It was specifically tailored to get audit results out quickly and to minimize the impact on the number of audits we could generate. It proved to be a popular concept with our stakeholders, because they realized we were focusing on the most critical issues and getting them answers in a much more timely fashion."

DON'T WAIT FOR THE KNIFE

How can audit shops that have budgets still intact avoid the CFO's knife? "I wouldn't wait for senior management to come to me and say, 'We are all contributing toward cost cuts: It's your turn,'" LaTorre says. Fucilli agrees. "Be proactive," he says. "You can't sit back and wait for the company to come to you. You have to identify key issues in the organization and speak with appropriate personnel. Don't say, 'how can I help you?' say 'I know how I can help you — here's how.' I'd say nine times out of 10 they will take up the offer."

Fucilli has been looking for tangible ways to help managers. He's been meeting with them, attending their staff meetings, and inquiring about the issues they face. Spending time with managers led to a recent assignment on medical costs. "People say that some items are simply runaway costs that cannot be controlled. I've been to meetings and heard people say we couldn't control medical costs. Of course we can!" he says. "We audited them and saved US $5.5 million, and the company received a check back from our insurer. That gets people's attention."

Fucilli sums up his approach: "We are not in the audit report business; we are not even in the audit recommendation business. Instead, we are in the change business — how to address risk and how to make the company better. It's not easy to audit this way, but if you search out areas where you can help, then your audit business will boom and they will not cut your department."

Fucilli's audit shop has become a profit center, because of the cost savings it finds. The team of 100 auditors completes 175 audits a year across a universe of 561 activities. Last year it saved the organization US $61 million, against a budget for the shop of US $15 million. Even so, Fucilli has been told to make a 5 percent cut. But that's a lot less than other MTA departments have been told to save. He met the target by automating more of his processes. And his head count has actually increased, because nine auditors who specialize in engineering compliance have been transferred to his team. "Because of the work we do and the assurance we deliver, the audit shop is one of the most important departments in the organization," he says.

INVEST IN YOURSELF

For the CAE, now is not the time to be a corporate wallflower or to disengage from the debate about shifting organizational priorities. Audit leaders should promote their shops' value as never before and redouble their efforts to ensure internal auditing's work addresses the changing risks facing their organizations. But what should internal auditors do on a personal level? In tough economic times, people are bound to worry about their career prospects.

"My advice to internal auditors who are being impacted by the recession is to take this opportunity to make themselves distinctive in terms of their professional credentials," Chambers says. "They should look at their investment in professional education and training and obtain whatever additional certifications they can. Auditors are more likely to be successful if they can demonstrate the excellence and quality of their work."

The current economic crisis will be deeper than any we have experienced in recent times, Chambers acknowledges. "But I think that internal auditors will survive and persevere, and the profession will come out strong and effective on the other side."

Storms was chief auditor at a large Canadian insurance company when recession last hit in the early 1990s. What lessons did he learn? "First of all, don't panic," he says. "As auditors, we control our own destinies. We can decide what is going to be audited, when it is going to be audited, and what the scope will be. If you've got a mandate, an audit charter, an independent reporting structure, an audit universe, and a plan, then all of the necessary components are in place — all you've got to do is manage your way through it. You've still got control."

To comment on this article, e-mail the author at neil.baker@theiia.org.