New Directions for Internal Audit

Audit committees are asking more from internal audit executives. And they're better informed than ever, thanks to the growing trend for audit committee members to serve on the boards of multiple companies.

Richard Chambers, managing director in PricewaterhouseCoopers' Orlando office and leader of internal audit advisory services for the U.S. firm, first noticed the trend in 2006 when his firm received a rash of inquiries from internal audit departments that wanted to get a quality assurance review (QAR) done by the end of the year in order to conform with global standards from the Institute of Internal Auditors. "On further discussion, it came up that somebody on their audit committee knew about these QAR requirements from another company where they were on an audit committee," he says.

Chambers decided to explore the topic through some questions in PwC's 2008 State of the Internal Audit Profession Survey, which polled some 670 internal audit professionals. Sure enough, more than 50 percent of Fortune 500 respondents said that an audit committee member had brought in an idea from another internal audit department in the past year. "That's particularly compelling when you consider that it had to be a pretty good idea for someone to have brought it in," says Chambers, adding that this kind of information transfer "allows the audit committee to serve a very valuable role in raising the overall caliber the profession."

And it's symptomatic of the dramatic rise in the level of interaction between audit committees and internal audit functions in the last few years. "There's been a real increase in the number of internal audit departments that have a reporting relationship with the audit committee, and so audit committees are taking a much greater interest in what internal audit does," Chambers reports.

Now that much of the heat is off of Sarbanes-Oxley work -- only 27 percent of respondents said that Section 404 was sucking up 50 percent or more of their department's resources, a sharp drop from 41 percent in PwC's previous survey -- audit committees will likely be looking for a greater focus on operational, strategic, and business risks, according to PricewaterhouseCoopers. "If you look historically at internal audit, it hasn't always been so heavily focused on financial compliance controls or risks," Chambers points out. "Prior to Sarbanes there was a lot more focus on operational risks, a lot more operational auditing and compliance auditing. You're seeing a migration back to that."

One thing that seems unlikely to change in internal audit's realm is the notoriously long time span between starting an audit and issuing a final report. In Chambers' thirty-plus years in the profession he hasn't seen much progress in this area. "Audit departments -- no matter what sector they're in, what part of the world they're in, or what type of organization they have -- almost invariably struggle with the cycle time," he notes. Nearly 80 percent of survey participants reported an average audit cycle time of three months or more, and for 10 percent of respondents it was more than six months.

And it's not just a question of resource deprivation. Audit processes haven't changed much in the past fifty or sixty years, Chambers notes. "Certainly there's a greater use of technology now, but our point of view is that this really requires some transformational thinking on the part of an internal audit department because you can't just put a band-aid on one part of an audit process and speed the entire process along."

One major bottleneck is the reporting end of the cycle. It's not uncommon for an internal audit department to spend as long writing and publishing the audit report as it spends doing the actual audit -- and that's clearly not an effective use of resources.

The survey report offers the following suggestions for internal audit departments that want to tackle the reporting problem:

1. Re-engineer the audit reporting process. Challenge current practices and experiment with alternatives, such as issuing reports without management comments to speed things up.

2. Retire long, narrative reports. Move toward streamlined report formats that communicate the information more effectively.

3. Keep ancillary information outside of the main report. Consider slicing nonessential background material out of the report and making it available in another format -- for example, via the company's intranet.

4. Apply "less is more" thinking to audit communications. Minimize editing and redrafting; consider applying Six Sigma and Lean methods to the process.

5. Focus on clear, concise reporting of key points. Some internal audit organizations are turning to bullet-point summaries of their findings; others are experimenting with one-page reports.

To read the complete PricewaterhouseCoopers study, click here.