Reflections on the internal auditing profession: what might have gone wrong?

21 Mar

The marginalized role of Internal Audit (IA) in the aftermath of the financial crisis that began in 2007 serves as the starting point of this paper, which reviews the profession’s situation between that time and 2010. The absence of IA from the governance debate has been marked and the relevance of IA has become a contentious issue in practice. In having no one clear boss and no single clear role, IA is exposed as trying to be many things to many people, to the point where no one is really sure who it is for and what it delivers. The analysis suggests that, to become a more relevant stakeholder in the corporate governance arena, the IA profession should consider clarifying both the perspective and the purpose of IA, that is, determining to whom IA should be accountable (the perspective from which its added value is judged) and clarifying/concentrating the IA’s service offering (its purpose).

It is striking that the IA profession has hardly been considered by other governance stakeholders as a source of solutions to the problems that led to the financial crisis. Post-financial-crisis activities have remained almost completely silent about IA’s role. Thus, the IA profession has been marginalized in the corporate governance debate since the financial crisis that started in 2007. IA is still searching for an identity and a unique selling proposition in order to play a more important role in that governance arena. There are limitations, some self-inflicted, regarding the role of IA as a core principle of good corporate governance: IA has multiple customers to serve and IA aspires to render both assurance and consulting services.

IA has no clear chief stakeholder: The IIA recommends a dual reporting relationship in which the CAE reports functionally to the board (or the audit committee of the board) and administratively to a senior management executive, and the IIA acknowledges that there may be conflicts when IA tries to “serve two masters” . When IA serves two masters, senior management and the board, what IA reports to the board may be filtered by management, such that only what is palatable to management is communicated.

Value of IA questioned: Having an IA function (IAF) is not the same as having a value-adding and effective IAF, as several stakeholder surveys have indicated. There are big gaps in practice when comparing factual and targeted scope of IA services. There is an absence of clear conveyance of the value added to major stakeholders. There are overly optimistic self-assessments by internal auditors.

This paper suggests viewing the oversight authority (board/audit committee) more clearly as the prime customer group, which abandons the IIA’s traditional view of IA as an “agent of the board”, and at the same time positions IA as a “partner to management”. Following that path may be the way IA can leverage the governance opportunity. The aspiration to broaden the scope of IA beyond the assurance arena may not be helpful in establishing IA as a profession, as doing so may move IA farther away from what matters most to boards and audit committee. There is significant room for improvement for IA in the arena of assurance, which is to be exploited, as otherwise other professions may fill the gap.

The two key conclusions of this paper are first that positioning IA as the agent to the board/audit committee and, at the same time, as partner to management is challenging in practice. The IA function should clarify the customer dimension in its organizational context. Second, assurance and consulting may be a confusing combination in practice that dilutes the value proposition. Consolidating IA around its core function of providing assurance is argued as the way forward.

Rainer Lenz, Gerrit Sarens, (2012), Reflections on the internal auditing profession: what might have gone wrong?, Managerial Auditing Journal, Vol. 27 Iss. 6, pp. 532 – 549

http://www.emeraldinsight.com/journals.htm?articleid=17038613

Advertisements

3 Responses to “Reflections on the internal auditing profession: what might have gone wrong?”

  1. Norman Marks March 22, 2013 at 2:03 pm #

    I think audit committees are to blame for not demanding enough (see my post on PwC’s State of the Profession 2013 at http://www.theiia.org/blogs/marks/), CAEs are not performing risk-based programs designed to lead to an opinion and assurance on the management of the more significant risks, and CAEs are consumed with ‘adding value’ in ways measurable to senior management instead of giving priority to assurance.

    Like

  2. drrainerlenz March 22, 2013 at 2:27 pm #

    Thank you Norman. I agree with your three observations: 1) boards/audit committees often expect too little from IA, 2) modern IA is risk-based, and 3) there is an assurance-vacuum yet waiting to be more fully exploited by IA.

    Like

  3. Ricardo Atencia March 23, 2013 at 2:22 pm #

    “The analysis suggests that, to become a more relevant stakeholder in the corporate governance arena, the IA profession should consider clarifying both the perspective and the purpose of IA, that is, determining to whom IA should be accountable (the perspective from which its added value is judged) and clarifying/concentrating the IA’s service offering (its purpose).”

    Assurance or consulting role? Assurance vs. risk management (by risks management professional as against the roles of IA)?

    Lost identify?

    Very intriguing topic to explore. Thanks Rainer.

    This topic would be nice if we also have some reflections from the IIA, COSO and other policy-making / advocate bodies to put us on track as to our roles and concentration.

    There was recently also the question: Are we going to change the name of Internal Audit? It looks like the different perceptions as to our roles meant we may be going out of the traditional roles, expanding and challenging our traditional roles or still in the dark as to our real roles?

    Like

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: