After years of belt tightening and cost cutting, companies may finally be starting to increase budgets and staffing for internal audit. As part of our inaugural internal audit study on planning and staffing priorities, we asked internal auditors about the resources, including budget and staff, they are allocated and if they are sufficient to get the job done and if those budgets are increasing or declining.
The good news is that most have stable or even rising budgets to do the job. More than a third (35 percent) say they expect the resources allocated to internal audit to increase, 57 percent expect them to stay the same, and 9 percent expect them to decline or weren't sure.
Yet many respondents still don't find the current internal audit budget and staffing levels sufficient to carry out the required activities of the function. While a healthy 55 percent say the current budget is sufficient, 45 percent don't think they have the resources they need to get the job done or aren't sure if they do.
Part of the problem is that the job is getting harder. Internal auditors are trying to meet a bar that is constantly rising, in part due to their efforts to meet board expectations and stay on top of turbulent business risks. Seventy-three percent use a formal risk assessment as the basis of their audit plan, 18 percent use an informal process, and fewer than 5 percent say they don't consider risks in formulating the audit plan. That's a step in the right direction compared with old-school audit plans that looked at the same expense areas year after year, say experts. "The internal audit profession as a whole has made tremendous progress in the past decade as it relates to our ability to better align audit activities with the strategic goals and objectives of the companies we serve," says Ed Williams, senior manager for risk advisory services at Experis Finance.
Those risk assessment processes can be resource-intensive in and of themselves, generally involving surveys, face to face interviews, and data analysis over the course of months. Trying to stay close to business risks can also mean frequent audit plan revisions over the course of a business year. "Every quarter we change the plan based on emerging risks," says Duaine Smith, chief audit executive for iHeartMedia, a $6 billion owner and operator of radio stations and billboards in 30 countries.
Those resources frequently include using an outside consulting firm. About one-third use a Big Four audit firm, 33 percent use another national or regional advisory firm, and 12 percent turn to small consulting firms. That's in part because audit staffs generally remain lean—48 percent of respondents had teams of 10 or less—and audit leaders rely on outside help to augment in highly technical areas. However, it's not always a size issue. "With our stakeholder expectations these days, I can't think of one audit department—even the largest—that doesn't use some external resources," says Smith. While he has a fairly large team of 10 staff employees, he co-sources another 12 with a Big Four firm to gain specific types of expertise. "There are just too many specialized situations—language issues, technology issues, business complexity issues—to go it on your own."
Audit leaders are also still working to harness the power of data analytics tools. While many see their potential to minimize low-value work and focus reviews on the areas of greatest concern, less than half (42 percent) of respondents plan to use such tools in this year's audits. That number varies only slightly by size of department. Forty percent of those with staffs of 1 to 24 use such tools, compared to 48 percent of those with larger internal audit staffs.
Even among those using data analytics tools, progress is typically slow, experts say. "The concept of truly integrating data analytics into internal audit is still struggling to get off the ground," says Williams.
By and large, however, internal auditors generally think their departments are doing a good job. 89 percent say the products and services provided by internal audit meet or exceed audit committee expectations, proportions that hold true for both audit staff and audit executives. Those with larger audit staffs tend to be the most confident, with 23 percent saying they exceed expectations, compared with 15 percent of those with smaller staffs.
The bad news: That perception of success may or may not be rooted in reality. Nearly one-third (31 percent) say they are not subject to regular review by their peers or audit committee. Similar to confidence levels about meeting audit committee expectations, that number also varies by size of department: Nearly 40 percent of respondents with 24 or fewer internal audit staff say they don't have formal assessments, compared with only 16 percent of those with 25 or more staff members.
Those who believe their departments exceed audit committee expectations are also more likely to have a formal review process in place. Among those who say they exceed expectations, 84 percent say they are subject to a formal review. Among those who believe they simply meet expectations, that number drops to 70 percent.
One area for potential improvement may be to consider developing avenues to get more feedback on their performance. "Even if you are a small two-person shop, you really should be doing some sort of assessment to make sure you're in sync with the rest of the business," says Williams. "That could be a simple questionnaire that gets distributed to management and the businesses you're auditing or even conversations with management."
Is internal audit focusing its resources on areas that have the greatest impact on the organization's success? Our "2017 Internal Audit Planning and Staffing Priorities Report" answers this question and more.