Vaktechnische Publicaties

Internal Audit and Crisis Resilience The possibility of a crisis severely disrupting an organization’s ability tooperate looms today like never before, given the pace with which global threats evolve. Incidents of sophisticated cyber sabotage, volatile weather patterns, terrorism attacks, and labor disruptions are escalating, and can strike, obviously, without warning. With these crisis events and the inability to continue operations and meet objectives comes damage to an organization’s reputation and its ability to meet stakeholder expectations. Yet a recent study reveals a broad gap between board members’ awareness of potential crises and their organizations’ actual crisis readiness. Being able to recognize potential crises, effectively handle such interruptions, and return to normal operations is extremely difficult. Gaining the capacity to do this quickly and efficiently with the minimum amount of impact — to be crisis resilient — is that much harder, and the ultimate goal. Crisis experts agree the key to being crisis resilient is preparation and that internal audit is positioned to play a key role in the process. Auditors’ breadth of skills, position in the organization, and deep knowledge of operations can help their businesses prepare for the inevitable crisis and move the organization from crisis aware to crisis resilient — ready to resist, react to, and recover from major disruptive events.  

Successful internal audit activities are built on a strong foundation - a foundation sturdy enough to withstand increased pressures from internal and external stakeholders, a turbulent geopolitical landscape, and evolving business practices. Unfortunately, weaknesses in a foundation are not apparent until the foundation is stressed, and then it's too late - the foundation crumbles. When the foundation crumbles, it becomes more difficult for internal audit to provide valuable services to the organization. This Pulse Report is intended for chief audit executives (CAEs) who are building new internal audit activities, as well as CAEs who want to examine the structural soundness of established internal audit activities. This report covers resources, competence, structure, IIA standards, and other foundational elements necessary to deliver world-class internal auditing.

Hier een teaser in te vullen

The following report, ‘Analytics: good practices for (smaller) IAFs’, sets out the findings of a field study commissioned by the Professional Practices Committee of IIA Netherlands. The aim of this report is to encourage and support the use of analytics in Internal Audit Functions (IAFs). Analytics has been part of our ‘toolset’ for many years, but recently rapid advances have been in the available techniques. “The world hates change, yet it is the only thing that has brought progress.” (Charles Franklin Kettering). The auditing profession first emerged during the industrial revolution, and its original aims were to provide (additional) assurance to clients such as executive and supervisory directors and other stakeholders such as regulators and the general public. Since that time, the profession has steadily progressed and professionalised. However, in recent years many audit and control functions seem to struggle to keep up with the pace of the increasing digitisation and real-time developments in the economy. Traditional auditing in the sense of ‘retrospectively checking the figures’ is becoming increasingly inadequate. (2012, AICPA White Paper). Solutions to this are sought, including by: involving non-financial perspectives, such as client perspectives and those based on operational management and innovation, increasingly using (upfront) system audits, and increasingly incorporating ‘soft controls’ (culture and behaviour). These are all useful steps, but they are not sufficient. A promising solution that is already feasible for many audit functions is the use of analytics. It is expected that the use of analytics will enable auditors to substantially improve their effectiveness and efficiency. Furthermore, in the near future the use of analytics will no longer be the exclusive domain of IT auditors, but will increasingly expand to other audit disciplines such as financial and operational auditing, as well as ‘second-line’ functions such as the internal audit, risk management and compliance functions. All this calls for research into the use of analytics that looks into the wishes and requirements of IAFs as well the practical experiences they have gained. We hope this field study will inspire and support professionals in the use of analytics and will contribute to the further development and embedding of analytics in the internal audit profession. We would like to thank the auditors who contributed to this study for sharing their experiences and insights.

Dit rapport bevat de resultaten van een praktijkonderzoek uitgevoerd in opdracht van de Commissie Professional Practices van IIA Nederland. Hiermee hopen we de inzet van analytics binnen Internal Audit Functies te bevorderen en te ondersteunen. Analytics behoort al jarenlang tot ons ‘gereedschap’, maar de beschikbare technieken hebben een snelle ontwikkeling doorgemaakt. “The world hates change, yet it is the only thing that has brought progress” (Charles Franklin). Het vakgebied Auditing is ontstaan ten tijde van de industriële revolutie met als doel het verschaffen van (additionele) zekerheid aan opdrachtgevers zoals bestuurders en commissarissen en andere belanghebbenden zoals externe toezichthouders en het ‘maatschappelijk verkeer’. Sinds die tijd heeft het vakgebied diverse ontwikkelingen en professionaliseringslagen doorgemaakt. Echter, de laatste jaren lijken veel auditen controlefuncties de voortgaande digitalisering en ‘real-time ontwikkelingen’ in de economie niet meer goed te kunnen ‘bijbenen’. Traditioneel auditen in de zin van ‘achteraf kijken of de cijfers kloppen’ voldoet steeds minder (2012, AICPA whitepaper). Oplossingen worden gezocht in onder meer: het betrekken van niet-financiële perspectieven zoals klanten, bedrijfsvoering en innovatie, het meer systeemgericht (vooraf) gaan auditen en het nadrukkelijker daarbij betrekken van de ‘zachte kant’ (cultuur en gedrag). Dit alles is nuttig, maar niet afdoende. Een veelbelovende en voor veel auditfuncties inmiddels bereikbare oplossing is de inzet van ‘analytics’. De verwachting is dat de auditor door de inzet daarvan substantiële verbeteringen in effectiviteit en efficiëntie kan realiseren. En dat analytics daarbij al snel niet meer het exclusieve domein van IT-auditors is, maar meer en meer verbreedt naar andere auditdisciplines zoals financial en operational auditing en ‘tweedelijns’ functies zoals interne controle, risk management en compliance. Kortom, tijd voor een onderzoek dat de wensen en behoeftes vanuit Internal Audit functies combineert met ervaringen uit de praktijk. We hopen dat dit onderzoek inspireert en ondersteunt bij de inzet van analytics en dat het bijdraagt aan de verdere ontwikkeling en inbedding van analytics in het vakgebied van internal audit.  U kunt het rapport hier downloaden.