The rise of the risk-intelligent audit leader

By Doug Brownridge

The recent financial crisis and our industry responses have produced a surprising misconception – that risk is the opposite of reward. It is not: loss is the opposite of reward. Risk represents the possibility that a loss or reward will occur.

“When internal audit uses analytics and automation, it demonstrates its value as a highly effective and efficient contributor to the company's overall risk management program and its bottom line.”
-Doug Brownridge

For too long, audit leaders have been relegated to the tactical execution of the annual audit plan; but they are well-suited to provide risk insight given their unique visibility across the organization's activities. For audit executives, this point marks a critical distinction from the traditional audit role.

Business success will be determined by risk intelligence at the strategic level rather than risk aversion on a tactical level. So too, internal audit's ultimate value will be determined by strategic contributions to the business rather than tactical accomplishments alone.

Amid the economic uncertainties facing financial institutions and the mounting pressures bearing down on internal audit functions, this much is certain: audit executives have a unique opportunity to assume and/or solidify their role as a strategic business partner to the CEO and CFO.

Those who leverage this opportunity through strategic risk management endeavors, continuous auditing activities, board committee relationships and other strategic priorities[i] can help lead their companies to greater success while enjoying more rewarding career opportunities.

Given the regulatory and economic conditions particularly for financial institutions, as well as the recent post-Sarbanes-Oxley focus on internal controls management, all internal auditors will need to:

• Do more work with fewer resources;
• Conduct their activities in more complex technology and data environments; and
• Work with increasingly "audit-aware" operational partners whose demands for real-time audit and risk information are swiftly growing.

A Critical Juncture

Speaking to CEOs and CFOs about their top needs is a sure way to assess the current state of internal audit. The challenges that keep C-suite executives awake at night help explain why audit executives face a critical juncture.

CEOs and CFOs say that they want their internal audit leaders to cut costs, reduce headcount, teach the business how to take ownership of internal controls monitoring, reduce compliance costs, "find money - fast," enable real-time auditing and risk management, redeploy current internal audit staff and, above all, add value. These demanding and, in some cases, seemingly contradictory requests should sound familiar to anyone who has served as a senior internal audit executive in recent years.

Efficiency Demands Confront Everyone

The vast majority of CAEs and audit executives face a similar set of challenges that require them to ply their craft with greater efficiency and effectiveness. Addressing these widespread challenges, as The IIA President and CEO Richard Chambers laid out in a keynote address, requires numerous steps, including the following:

• Aligning internal audit coverage to meet new expectations
• Realigning skills to address new requirements
• Coping with diminished resources
• Demonstrating value and adding to the bottom line
• Maintaining stature with the audit committee; and perhaps the most important
• Leveraging technology to achieve greater efficiencies2

Why is the final priority so important? Because technology can help internal audit functions achieve each of the other priorities. "When internal audit uses analytics and automation, it demonstrates its value as a highly effective and efficient contributor to the company's overall risk management program and its bottom line," notes Vice President John Verver, from ACL Services Ltd.

The Randolph-Brooks Federal Credit Union (RBFCU) internal audit department understands the power of analytics. Seeking improved business insight by implementing full-population data tests, they were eager to drive additional efficiencies throughout the organization using technology. The Audit department wanted to develop a systematic process for communicating, tracking and escalating exceptions across multiple business divisions and branches.

Now with their business assurance technology from ACL, the RBFCU team has a reliable way to efficiently distribute and track control violations. There's a clear audit trail that makes it easier for auditors to manage potential issues, instead of spending hours searching reports for exceptions.

Similarly, Wells Fargo Foothill uses ACL analytics technology to protect their loan collateral and generate high-quality reports that ensure client records are complete and reliable. As a result, Wells Fargo Foothill has cut field audit time, identified fraud, reduced credit risk and strengthened their overall business performance.

Whether or not the current risks confronting CAEs today turn out to be rewards or losses tomorrow depends, largely, on how effective - and sustainable - their responses are today.

Notes:

[1] Priorities identified in 2009 Internal Audit Capabilities and Needs Survey. Protiviti, 2009.

2 "Internal Audit Solutions for Tough Times," Internal Auditor blog entry by Richard Chambers, posted on Aug 26, 2009.

Biography

Doug Brownridge is VP Marketing with ACL Services Ltd., the leading global provider of business assurance technology for audit and compliance professionals. In addition, he is on the board of Coast Capital Savings, where he serves on both the Audit and Risk Committees, and previously served on the board of Citizens Bank of Canada.  Doug's 30 year career has spanned executive roles at P&G, Cadbury, Motorola, PMC-Sierra, and Intrawest.