The Evolving Role of Internal Audit: Managing Risk in a New Economic Environment

Without question, today’s organizations face a global economic crisis of historical proportions. In response, management, boards of directors and leaders throughout the organization are taking fresh looks at virtually all aspects of the business to assess how to enhance productivity, processes and systems, yet still stay “in control.” They are starting, and very likely will continue, to think and respond differently as they determine how to operate their businesses successfully and maintain plans for long-term growth in today’s unique business environment.

Internal auditing professionals not only must understand these challenges and their organization’s key objectives, but also ensure that amid the many organizationwide changes taking place on almost a daily basis, key controls and processes are adequately addressing these changes and the new risks that emerge, and are functioning as intended. Internal audit plays a critical role in helping companies successfully “manage the change” by providing assurances that with every new process, procedure and initiative, any significant new risks that emerge are identified, monitored and managed effectively, so that the enterprise is protected on an ongoing basis and to a level that satisfies management and the board.

It cannot be overstated that at least part of the cause of the current economic turmoil can be attributed to poor risk management. As noted in Protiviti’s Global Financial Crisis Bulletin containing frequently asked questions about the economic crisis:

Deficiencies in corporate governance processes obviated the contribution of any risk management processes in place. In many cases, there was a lack of effective transparency, accountability and escalation in the institutions affected, which led directors and senior managers to a position of not knowing the extent of the risks undertaken. Collectively, these issues reach well beyond the scope of risk management and touch upon such areas as corporate governance, executive management, and the role of the board and the audit committee.

Internal auditors play a critical lead role in helping management and the board understand, assess, mitigate and manage the organization’s risk through activities detailed in the internal audit plan. It is incumbent upon chief audit executives (CAEs) and the internal audit functions they lead to partner with the board of directors and management to ensure the organization stays the course with its internal audit plan and function, yet also remains nimble and flexible enough to change when necessary.

Thus, internal auditors must continue to enhance their skills and educate themselves on new technologies and competencies that will be required in the months and years to come. The success of any internal auditor lies with that person’s commitment to ongoing learning and capabilities improvement, along with his or her deep understanding of the organization’s needs and how they can be met through the internal audit function. At no time is this truer than in today’s business climate.

How Protiviti Is Partnering With Companies to Meet This Challenge

There is no single answer for all organizations, but in our experience, aligning the audit committee with the CAE and ensuring periodic reviews to maintain common objectives are important steps. 

Also, internal audit must think expansively when seeking ways to add value to the organization. Too often, we find internal audit functions stop short of making recommendations that could create value for the organization for fear of overstepping their place. However, “consulting” is part of the Institute of Internal Auditors’ definition of internal auditing, and we believe that appropriately empowering this function provides management with greater opportunities to create value without compromising independence.

Our Internal Audit professionals work with audit executives, management and audit committees at companies of virtually any size, public or private, to assist them with their internal audit activities. This can include starting and running the activity for them on a fully outsourced basis or working with an existing internal audit function to supplement their team when they lack adequate staff or skills.

View Related Material
View related Protiviti media coverage