An increasing number of chief audit executives (CAEs) are being sourced from other areas of business instead of from within the internal audit profession – a trend that is likely to continue, according to a recent survey from the Institute of Internal Auditors (IIA).
“Ultimately, the approach CAEs take when executing their role and managing the internal audit function depends on their understanding of – and alignment with – the expectations of their stakeholders,” IIA President and CEO Richard Chambers said in a written statement. “Whether you come from within the profession or not, self-preservation as a CAE begins with understanding the business, applying diversity of experiences, and effectively communicating with your stakeholders.”
Of the nearly 370 CAEs in North America who responded to the 2014Pulse of the Profession: Continually Evolving to Achieve Stakeholder Expectations survey from the IIA’s Audit Executive Center, 42 percent said they held a position outside of internal audit immediately prior to becoming a CAE.
According to the survey report, many within the internal audit profession believe a CAE coming from the business world may not have an aptitude for governance, risk, and controls or an appreciation for the possibilities of internal audit. Others say understanding the business and having a previous hands-on role as a business executive are also vital to the position.
“The bottom line is that internal audit needs people in the CAE chair who understand the business and speak like business leaders,” said Kelly Barrett, vice president of internal audit and corporate compliance for the Home Depot, according to the report.
As the career path changes for CAEs, so do the competencies for internal auditors. For example, only 25 percent of respondents recruit for the traditional auditing skills of accounting, while 43 percent recruit for business acumen, and 40 percent recruit for industry-specific knowledge. According to the survey, the top five skills internal auditors should possess include:
- Analytical/critical thinking (81 percent)
- Communication skills (61 percent)
- Data mining and analysis (51 percent)
- IT (45 percent)
- Business acumen (43 percent)
But being a good communicator is a skill that is equally important for CAEs, especially for resolving any perceived gap between the priority given by stakeholders to strategic business risk and the portion of the audit plan devoted to business strategy, said Richard Anderson, a clinical professor of strategic risk management at DePaul University in Chicago.
“Given the focus of stakeholders on strategic and business risks, it becomes incumbent on CAEs to communicate clearly where within their audit plans they have identified and addressed the organization’s key strategic and business risks,” he said in the report. “Explicit rather than implicit communication with full transparency is needed to avoid any misunderstanding of this critical risk coverage.”
Forty-six percent of CAEs rated strategic business risk as the top priority for executive management, while 28 percent consider it the top priority for audit committees. While business strategy remains a relatively small area (6 percent) of the overall audit plan, according to the survey, follow-up interviews with 24 CAEs reveal that internal audit’s approach to audit planning can bridge a perception of misalignment. Successful internal audit functions take into account stakeholder priorities and address them throughout their audit plan.
“Internal auditors must continuously assess the risks facing their organizations and align those assessments with stakeholders’ evolving expectations,” Chambers noted. “Our success as a profession is contingent upon not only securing the resources and talent needed to address key risk areas, but also gaining stakeholder trust that our contribution is focused on the right areas.”
About the survey:
The IIA Audit Executive Center’s 2014 Pulse of the Profession study surveyed 1,935 audit professionals around the world. In North America, 367 CAEs participated in the survey. The survey is a semiannual assessment of the state of the internal audit profession in North America.