Actualiteit

The evolution of the internal audit profession toward a more value-added risk assurance function continues to move forward. While technical skills are needed for day-to-day work, analytical/critical thinking and communication are personal skills that continue to be at the top of any chief audit executive’s (CAE’s) wish list. Practitioners with these skills have a higher probability of overcoming any technical deficiencies and stepping up to meet stakeholders’ value-added expectations. To find practitioners with these skills, CAEs need to have a deliberate talent management plan. They should prioritize identifying those candidates with key personal skills through behavioral assessments, looking at diverse academic backgrounds. When it is not feasible to hire staff for particular skills or needs, they can consider using resources in other areas of the organization (co-sourcing) or obtaining support from outside the organization (outsourcing). Finally, CAEs should establish development programs that further improve on personal skills while augmenting industry-specific knowledge and other technical skills. This report supports its conclusions with results from the CBOK 2015 Global Practitioner Survey, the largest ongoing study of internal auditors in the world. 

In 1941, when The Institute of Internal Auditors (The IIA) was founded, there was no internet, personal computers did not exist and open global communication among private citizens was a dream. Fast-forward to 2016: Technological innovation is rapid and disruptive, and touches almost every aspect of our lives. People and machines are becoming increasingly interconnected, accelerating digitization and shaping the Internet of Things. And almost every business today is, at its core, a technology business − one that relies on IT not only to operate, but also to innovate and enable future success. Another dramatic change that has occurred since The IIA’s founding: the number of companies across industries, and the globe, that are positioning women in board-level and leadership positions in increasing numbers. This is why, as The IIA celebrates its 75th anniversary, we chose to interview only female internal audit leaders for the latest edition of our Internal Auditing Around the World series. These women represent positive change in the business world and in the internal audit profession. Therefore, we believed they could offer a unique perspective on how technology is transforming internal audit functions for the better.

The requirements placed on the Internal Audit function (IAF) by internal and external stakeholders seem to be constantly increasing. As a result of the financial crisis, new laws and regulations have been introduced in the financial sector and supervisory bodies have tightened up and expanded their supervision. In addition, increasing critical attention is paid in the public domain to the design and operating effectiveness of companies’ governance and their reporting of non-financial information. As the IAF plays an important role in the governance framework, there has been a corresponding increase in the requirements placed on the IAF. Various stakeholders quite regularly publish interesting documents that introduce additional requirements regarding the quality of the IAF. Recently, the Monitoring Committee for the Dutch Corporate Governance Code presented its proposals for revising this Code. These proposals envisage a prominent position for the IAF, which is considered “complementary to the external auditor.” According to the Monitoring Committee: “It is important to have a good interplay between the Executive Board, the Supervisory Board and the Audit Committee, as well as a good communication with the internal audit function and the external auditor.” An important element in the proposals in relation to the effectiveness of the IAF is also included in guidance 1.5.1, which states that the Audit Committee should supervise “the relationship with - and compliance with the recommendations of and followup given to comments of - the internal auditor and external auditor”.  

In 2013 voerde De Nederlandsche Bank (DNB) een onderzoek uit naar de internal audit functie (IAF) bij de Nederlandse banken. Daarbij kwam op een bepaald punt de uitdagende vraag naar voren: “Wanneer is een IAF eigenlijk als effectief te beschouwen?”. In de gesprekken die we als IIA-bestuur met DNB daarover hadden, worstelden we aan beide kanten met deze vraag. Duidelijk was toen al wel dat er vele facetten zijn die in het antwoord op deze vraag een rol spelen. Ongeveer anderhalf jaar geleden startte een aantal internal auditors, afkomstig uit de financiële industrie, met een discussie over dit onderwerp. Nationaal en internationaal werd geïnventariseerd wat er beschikbaar was aan normenkaders, best practices en performance-indicatoren. Veel gesprekken en veel discussies vonden plaats om te duiden wat in welke mate kon bijdragen aan de zojuist weergegeven uitdagende vraag. Een dankwoord is dan ook verschuldigd aan eenieder die vanuit zijn of haar eigen achtergrond input heeft geleverd om tot dit resultaat te komen. Omdat die groep nogal wisselend is geweest, laat ik naamvermelding achterwege. Een naam die echter wel genoemd moet en mag worden, is die van Dennis Webbers. Hij was namelijk degene die zich onvermoeibaar toonde op de momenten dat het onderwerp even te diffuus leek om af te ronden. ‘When the going gets tough, the tough get going’. Zijn we erin geslaagd om een antwoord te geven op de vraag wanneer een IAF effectief is? Ik durf het niet met zekerheid te zeggen, omdat het antwoord op deze vraag van vele factoren afhankelijk is, bijvoorbeeld: in welke industrie opereer je, hoe is je missie verwoord, en hoe werk je samen met bestuur, commissarissen en de externe accountant? Hoe dan ook kan iedereen die kennis neemt van dit boekwerk, daarna voor zichzelf een aantal relevante indicatoren selecteren en komen tot een volwassen performance-meting en rapportage daarover. En dat is een enorme winst!

The profession of internal auditing has been making great advancements in performance, positioning, and perception. The CBOK 2015 stakeholder study confirms these advancements but also highlights opportunities for internal audit to push even harder, moving to the next higher level of value for organizations. This report focuses on providing initial findings specifically from North America. While there is much to be explored in the survey responses, at a high level, a clear picture emerges regarding the importance of risk and relationships. Specifically, in the eyes of stakeholders: Internal audit does many things well that could be considered foundational elements of the assurance work of internal auditing. There are opportunities for internal audit to add value to their organizations by spending more time focusing on risk identification and management in addition to assurance work. Internal audit should focus more on strategic risks, but exactly what the stakeholders mean by that is less than clear or consistent. Increased demands on internal audit will require chief audit executives (CAEs) to prioritize competing demands. Managing these conflicts requires strong relationship and communication skills. A brief discussion is provided for each of these topics. Future CBOK stakeholder reports will delve deeper into the feedback from internal audit stakeholders and the implications.