CBOK: Achieving Excellence in Assurance, Strategic Risk Insights, and More

Global macroeconomic uncertainty and rock-bottom interest rates, soaring regulatory expectations, cybersecurity threats and attacks, legacy information technology (IT) systems, Fintech, blockchain, and other disruptive innovations are all examples of the staggering collection of market and regulatory challenges that confront the financial services industry (FSI), making it the most demanding sector in which internal auditors operate. Amid the industry’s growing macroeconomic, regulatory, procedural, and technological complexity, internal audit within FSI must fulfill its core mission of delivering assurance excellence. Yet, internal auditors must do more. Effective assurance alone no longer guarantees success. This is an important message conveyed by FSI participants in the 2015 Global Internal Audit Common Body of Knowledge (CBOK) Stakeholder Survey. The results of this global survey of stakeholders— specifically, the results from the responses of executives and board members who work closely with internal auditors—reveal best practices that internal auditors in FSI should consider in their quest to continually improve performance and deliver more value to their organizations. Among the key findings:

• Internal audit reporting structure, the chief audit executive’s (CAE’s) relationships with the boards and the executive teams, and the entire function’s communication skill and style represent key success factors.
• Assurance is paramount. The consultative, value-added work that stakeholders clearly want auditors to deliver cannot detract from assurance.
• Assurance work is most valuable when it is aligned with the strategic risks of the organization and provides credible challenges to the effectiveness of risk management activities within the organization.
• CAEs and internal auditors should convey both good and bad news while exerting their influence to focus attention (at the board level and throughout the organization) on specific risks. CAEs also should possess the authority necessary to elevate and communicate strategic issues quickly to executive management and the board.
• Stakeholders expect internal audit to assess governance effectiveness and to monitor the values and behaviors that influence the organization’s risk culture.
• Stakeholders believe that internal audit should take on a more active role in assessing and evaluating the organization’s strategic risks and emerging risks