It’s time for internal auditors to think differently.
That’s not a new assertion, precipitated by the challenging times the coronovirus pandemic has wrought; companies have been in period of radical change for some time, and corporate leaders, internal audit experts, indeed internal auditors themselves, have implored the profession to change along with the companies they audit. Some caution that internal audit either isn’t moving fast enough or is not making the type of wholesale overhaul it needs to stay relevant in a fast-moving, digital world.
Indeed, the disruption created by the COVID-19 crisis may hurry things along, but avoiding transformation is no longer really an option for internal audit leaders regardless of how their organizations have been affected by the pandemic.
Stakeholders are calling on internal audit departments to adopt a culture of innovation. “It’s not enough to hire people with technology skill sets, you have to create a culture of innovation,” says Herb Chain, assistant professor and Executive Director of the Center for Executive Education and External Programs of the Tobin College of Business at St. John’s University. He says that internal audit departments that fail to innovate will get left behind and run the risk of becoming obsolete. “It’s going to take an investment, but it should be one that has a good return,” says Chain.
It’s true that innovation will come at a price, but it going to take more than money to truly migrate to an innovative mentality. Internal auditors will have to become comfortable with a constant state of change. They will have to learn how to remain flexible to move where the risks are at a moment’s notice and abandon the business-as-usual outlook, where they conduct the same low-impact audits year after year.
“Modern Internal audit teams must provide flexibility and be responsive to changing business priorities by providing staff with the right blend of functional and industry and operational skills to collaborate with management across various operations and locations to solve problems,” says Jonathan Ngah, principal at internal audit, governance, risk, and advisory firm Synergy Integration Advisors.
Two Types of Innovation
When internal auditors talk about innovation, they are generally talking about two different types. The first is keeping up with new technologies and advancements that their companies are adopting so they can understand them, evaluate the risks, and ensure they won’t have detrimental consequences to the organization. Such technologies include artificial intelligence (AI), machine learning, virtualization, the use of drones and robotics, and even some cutting-edge technologies that come with big ethical questions, like gene editing and cloning.
The second type of innovation is adopting advancements in the internal audit department itself. Those technologies include advanced and predictive analytics, robotic process automation (RPA), continuous auditing, cloud-based GRC tools, and many others. These two types of innovation are related. The thinking is that internal audit organizations that seek to adopt a culture of innovation in their own processes will be more adept at keeping up with the innovations throughout their organizations, and therefore better equipped to audit them.
“Boards want Internal Audit to provide advice on how their organization should exploit new technologies and to make recommendations as part of the audit process that push the organization’s technological innovation levels,” noted PwC in its State of the Internal Audit Profession Study, Moving at the Speed of Innovation. “Internal audit functions can serve in this valuable capacity only if they themselves are innovating.”
Slow to Move
While the need to innovate has been clear to most chief audit executives (CAEs), getting there hasn’t always been easy. In the PwC report on innovation cited above, just 14 percent of internal audit functions were considered to be “advanced” in their adoption of technology.
Furthermore, a Protiviti survey from earlier this year, titled “Embracing the Next Generation of Internal Auditing,” which surveyed 1,113 CAEs and internal audit leaders and professionals on their current views and audit plan priorities, also found internal audit to be slow to innovate.
Forty-one percent of Protiviti’s survey respondents said they were concerned that they are moderately or far behind their competitors’ in innovating internal audit and adopting a culture of innovation. “With most companies already working on transformation initiatives in some capacity, and 48 percent saying that they’ve increased focus on it in the last year, the remaining 24 percent of internal audit teams who have not definitively started their digital transformation journey need to begin as soon as possible to maintain relevance within their firms and industries,” the report warns.
So what’s holding internal audit back? One of the issues is time. Most internal audit departments are stretched thin and don’t have the time to devote to coming up to speed on new technologies, even if it would save time in the long term. Another problem is that the technology is moving so fast that some CAEs decide they can’t keep up with it all and throw up their hands.
Resources are also a problem. Gaining access to enabling technology skills and expertise remains a major challenge, and one that internal audit departments may also address through outsourcing and co-sourcing arrangements. But internal audit departments that fail to demonstrate innovation are less likely to convince boards and management to provide more resources, resulting in a death spiral of sorts that can be fatal to internal audit, or at least their CAE leaders.
According to Michael Smith, U.S. intelligent automation and solution lead for internal audit at KPMG, at companies where internal audit is behind on technology, the problems often lie higher up in the organization. “At organizations where internal audit isn’t particularly tech-savvy, it’s usually some combination of the lack of vision among company leaders and the positioning of the internal audit function.” He says they haven’t been empowered to go and create their own innovation.
Promoting a Culture of Innovation
At the 2019 Wolters Kluwer TeamMate User Forum in Aurora, Colorado, last year, speaker Jeff Malloch, who serves as manager of audit business systems at First American Financial Corp., identified some of the ways that internal audit shops can foster an innovative culture. Interestingly, Mallochs advises internal audit leaders to focus on the small things and take incremental steps. “Set a small goal and achieve it. That’s innovation!” he said.
He had some other advice on creating a culture of innovation, including:
Fix the underlying processes first: According to Malloch, you can’t innovate on top of bad processes or bad management. Those problems are hindrances to innovation and must be corrected first. He compared innovating bad processes to giving a bad driver a new car. “It won’t fix the problem and the driving will still be bad,” he said. The lesson is that technology is not in itself a solution, but a tool to finding solutions.
Set expectations and measure them: Malloch dispelled the notion that innovation comes from big, bold moves and from sewing chaos, as we sometimes hear from Silicon Valley types. “Innovation, at least in an internal audit sense, is way more disciplined than that,” he said. He advised attendees to set goals and stay on top of them. Achieve a measurable goal and then move the mark to the next one. “We may think that innovation is these huge breakthroughs, but it’s not.”
Focus on people: Another piece of advice to creating a culture of innovation is to trust the people that are in place, particularly those on the front lines. “To create innovation we have to give people the freedom to be honest, and we have to led them fail before they succeed,” he said. He also emphasized the need to be able to resolve conflict as part of the innovation process. “The inability to resolve conflict is fatal to the innovation process.”
It’s all about data: Malloch describes three aspects that are driving innovation: the widespread availability of data, including unstructured data; the processing power that is now capable of analyzing massive data sets much faster than in the past; and new software models, such as open source and cloud, that have created more collaboration and better algorithms. But data is at the center of it all. He says bad data is often at the center of innovation failures. “The old adage of garbage in, garbage out is as true as ever,” says Malloch. “We have to get better at gathering and cleaning data.”
We all know that internal audit must get better at being innovative. As a recent Protiviti report, The Next Generation of Internal Audit, put it: “Compounding internal audit’s challenge is the risk of inaction. Internal audit needs to respond to these organizational changes in order to ensure it can help manage risk and drive value in the new paradigm. As transformational changes ripple through different departments and business units, CAEs and other business leaders face a make-or-break choice: disrupt or be disrupted.”
As the pace of change accelerates, and massive risks like the coronavirus show they can materialize almost overnight, the need to create a culture of innovation will only become more critical. 
Joseph McCafferty is Editor & Publisher of Internal Audit 360°