Survey responses from board members serving on audit committees revealed six “imperatives of interest” that would prompt committees to think broadly, go beyond assurance, and make sure chief audit executives (CAEs) are in a position to meet committee and board expectations.
The latest survey, entitled Six Audit Committee Imperatives by the Institute of Internal Auditors Research Foundation and global consultancy Protiviti, offers a snapshot of what they think would work. Here are some of the suggestions from the survey, below:
1. Elevate the CAE’s stature. Internal audit expectations must consider how the CAE and the function itself are positioned to deliver. While their access and perspective are key, access typically has meant the CAE is a direct-report of the audit committee and C-suite, the report states.
But the big-picture perspective would help internal audit, especially in handling competing demands. Most of the board members who responded to the survey said the best way to see the big picture is to have the CAE regularly sit in on board or board committee meetings.
The second highest-rated tactic is to have the CAE report directly to the audit committee. “Perhaps this gateway can be enhanced by granting the CAE ‘red phone access’ to the audit committee and making this privilege known throughout the organization,” the report states.
2. Help the CAE unify stakeholder expectations. In assessing internal audit’s success, stakeholders consider useful recommendations that address the “root cause” of issues, quality work and reliable results, communication about risks, and helpful suggestions on emerging risks.
3. Think outside the audit-plan box. CAEs need to challenge their teams to consider how audit findings will affect the entire organization. That means going beyond the audit-plan borders. “Just because an issue is not in scope does not mean that audit committees and other stakeholders in the organization do not want to hear about it,” the report states.
4. Go beyond assurance. A slower economy puts more emphasis on the efficiency of operations. Most survey respondents indicated that internal audit should consult and advise on business process improvements.
5. Play up strategic risks. Most board members believe internal audit should do more in assessing and evaluating strategic risks while even more chief executive officers and chief information officers do.
6. Make communication a priority. Internal audit gets top grades for the frequency and quality of its communications. That’s key because it allows everyone involved to discuss gaps in the annual audit plan.