The audit committee is a cornerstone of good corporate governance. Its mandate now extends well beyond oversight of financial reporting to include an array of key areas that support an organization’s performance, such as risk management, compliance, reliability and integrity of internal data, cyber risk, and the effectiveness of internal control over operations.
Yet even as the list of oversight responsibilities gets longer and more complex, the amount of time that most audit committee members can reasonably commit to the part has not. The role of internal audit has traveled a parallel course with that of the audit committee, with internal auditors expanding their scope of responsibilities to meet organizational needs. Organizations are increasingly turning to the internal audit function to provide assurance and/or consulting services to better address their own needs. When a strong working relationship is in place with the audit committee, internal audit can enhance and protect organizational value by providing risk-based and objective assurance, advice, and insight. With its broad view of the organization and its familiarity with operations across all business units, the internal audit department is uniquely positioned to help the audit committee understand and evaluate risks that may affect the enterprise.
Audit committees can and should rely on internal audit as a critical resource to help them successfully fulfill their responsibilities. In addition to helping address risk, an effective internal audit department acts as an objective insider, empowering the audit committee with insights into the business and its practices that can achieve significant cost savings.
Internal auditors, use tools such as data analytics to identify problems and recommend new, better approaches that can affect the company’s bottom line. Audit committees and management take notice when that happens, but one of the biggest obstacles to optimizing the value obtained from internal audit is a bias toward viewing the function as primarily providing assurance on financial, regulatory, and compliance risks. While those areas are critically important and are historically internal audit’s strengths, internal audit can make contributions well beyond those traditional spaces.
With appropriate resources and staff, internal audit can also address areas many stakeholders see as offering higher value to the organization by improving the efficiency and effectiveness of all controls, including, for instance, controls of data security or operations. In some cases, internal audit may increase value to stakeholders by providing assurance over strategic and business risks.
Audit Committee and Internal Audit:
To ensure that internal audit can deliver value, the audit committee must protect and nurture unbiased assurance, which is among internal audit’s greatest contributions to the organization. Audit committees should be prepared to:
11 | P a g e
SBS Wiki www.sbsandco.com/wiki
vUnderstand the resources needed to provide value, including both personnel and data analytics
resources.
vProtectthe independence and objectivity of the chief audit executive (CAE) and internal audit
team.
vCommunicate with the CAE often and at a deep level, both formally and informally. vAgreeon expectations and help design, review, and approve audit plans that are aligned with
those expectations.
vHoldmanagement accountable for assessing and implementing, when appropriate, internal audit recommendations.
vMonitorthe quality of internal audit work and insist on timeliness, organizational perspective, and fact-based observations and recommendations.
Importance of Communication
An expanded role for internal audit inevitably creates higher expectations of the function, and requires clear communication about how internal audit will support the audit committee. The audit committee must partner with the CAE to determine what are the risk areas where internal audit’s activities will best serve the organization, When internal audit consistently identifies key known and emerging risks, and updates its assessment on an ongoing basis, the department can deliver credible insights to management and the board that help equip the organization to respond quickly and appropriately.
Attributes of Extraordinary Audit Committee
vCourageously independent
vProfessionally skeptical and intellectually curious
vDeeplyexperienced
vApproachable relationship builders
vRisk-centric strategists
The Role of Executives, Boards, and Audit Committees
The pervasive impact of culture on long-term organizational success is a compelling reason for audit committees, boards, and executives to concern themselves with the topic. Success starts at the top. Generally speaking, executives establish the culture and lead by example. Those in senior leadership must articulate and model the organization’s culture and values, demand the highest standards of ethical behavior from themselves and others, encourage transparency, and be willing to make difficult decisions. At the same time, the board of directors must ensure that the senior leaders they put in place have the right ethical compass, tact, and communication style to instill the most effective culture.
12 | P a g e
|
How Audit Commiittes can leverage Internal Audit |
SBS Wiki www.sbsandco.com/wiki
Beyond having the right leaders whose actions align with the organization’s core values, some tactics used by enterprise leaders to inspire a healthy culture are to:
vMakesure that culture, values, and ethics appear directly or indirectly on board and audit committee meeting agendas, and talk about them candidly and explicitly.
vEnsurethat culture — including the tone at the top — is evaluated using observable and measurable behaviors
vDemandfrequent reporting. Some organizations create a culture dashboard that reports data such as employee feedback, ethics violations, hotline calls, and customer complaints.
Relationship between the Audit Committee and Internal Audit Function
