Internal audit should spend more time on advisory activities — Deloitte

KUCHING: In Deloitte’s 2020 survey of audit committee chairs and members, 70 per cent say internal audit should spend more time on advisory activities while 92 per cent say internal audit should provide insights on and help prepare for emerging risks.

Today’s challenging business environment shares many similarities with a bumpy flight scenario, although perhaps adding a smoldering cigarette in the lavatory, a belligerent inebriate coach, and a leaking hydraulic line in the engine compartment would provide a more-precise comparison to the multiplicity of threats currently facing businesses across the globe.

The sudden onset of the global crisis is almost as notable as its severity, as entirely new problems swiftly merged with and amplified alreadysimmering issues.

While no one is under the illusion that internal audit (IA) can solve all the world’s problems, the function nonetheless has a major role to play in helping organisations cope.

Faced with Covid-19 and its cohorts, IA must now report faster, engage with stakeholders more quickly, and find new ways to add valuewhile simultaneously replacing processes that have historically been manual, ad hoc, and unsustainable.

Today, IA functions of all stripes-from cutting-edge to traditional shops-engage in advisory work alongside their traditional assurance role.

“The advisory role should be treated as one of the initiative for an IA function in providing a value-added services to the audit committee and the organisation as a whole,” Deloitte Malaysia’s Internal Audit, Risk Advisory executive director Muzafar Kamal said.

“While embarking the journey in playing a more active role in advisory, IA function should always maintain the independency and objectivity in retaining the ‘Third Line of Defense Function’; namely providing assurance on the effectiveness of governance, risk management, and internal controls within an organisation.

“The advisory role should be confined to providing advice solely from internal control, risk management, and governance perspective based on its experience and familiarity with the business process and organisational structure of an organisation.”

According to Deloitte’s 2020 survey of audit committee chairs and members, 96 per cent said internal audit needs to broaden its skillset. While many audit committee interviewees emphasised the need for specialised skills – in cyber, artificial intelligence, analytics, and more – many others stressed the necessity of generalised business knowledge and rounded skillsets.

Muzafar shared that in terms of hiring initiative, the IA function should consider a “Purple Person”; that is, a person who possesses a combination of technical skills; for example, analytics and business skills; for example, business knowledge and soft-skills. “For the existing team members, the Chief Audit Executive (CAE) should continue focusing on the Team’s development by having a structured training programme for upskilling purpose; namely providing the necessary training to equip the team members with the necessary skillsets, particularly on technology as well as analytics and business skillsets.”

On leveraging on technology to accomplish more with flat budgets, Muzafar highlighted that the availability and quality of data are pertinent attributes that the IA function needs to focus on, on top of having the right team with the right skillsets in its’ analytics journey.

He continued by adding that one of the option that the IA function may want to consider is having a structured plan in rolling out the analytics into its’ IA activities.

That is to say, identify suitable area where there is quality data available and treat it as “Pilot Programme” before embedding analytics as part of the audit.

“Once this approach is proven successful, a larger scale roll out can be considered, in tandem with the awareness of the Organisation’s on the application of analytics within the IA function’s audit activities as well as the availability of quality data and readiness of the IA function; i.e. in terms of analytics tool available and having the right team with appropriate skillsets to embed analytics in its IA activities.”