Increasing the Influence of
Internal Auditing
Dr Sarah Blackburn
Past President, Chartered IIA
Increasing Conformance with the Standards Group, IIA Inc
The Loss of Trust
Companies Governments NGOs
2016 2017 2016 2017 2016 2017
UK 46% 45% 36% 36% 50% 46%
Ireland 43% 41% 32% 32% 49% 43%
Sweden 46% 46% 45% 45% 26% 23%
US 51% 58% 39% 47% 57% 58%
Percentage of people who trust… Source: Edelman Trust
Corporate scandal
Public/media outcry
Demands that ‘something must be
done’
Revision to corporate governance code
With thanks to Simon Thompson
UK
1992: Cadbury Report
1995: Greenbury Report
1998: Hampel Report
1999: Turnbull Report
2003: Higgs Report
2003: Smith Report
2003: Combined Code on Corporate Governance
2008: Revision of Combined Code
2009: Walker Report
2010: UK Corporate Governance Code
2012: Revision of Code
2014: Revision of Code
2016: Revision of Code
2016: Green Paper on Corporate Governance
2017: FRC announces ‘fundamental review’ of Code
Revisions of the corporate code
Rest of the World: • Sarbanes-Oxley
• King I, II, III and IV
• NYSE
• NACD
• The Norwegian Code
of Practice for
Corporate Governance
• Etc. etc. etc.
KPMG, 2017 Global Audit Committee Pulse Survey
Beyond focusing on financial reporting and compliance risks, what steps
can internal audit take to maximize its value to your organization?
27%
42%
49%
53%
56%
Helping to assess/"audit" the culture of theorganisation
Improve talent and expertise in internal auditorganisation
Expand audit plan on effectiveness ofcompany's risk management processes
generally
Maintain flexibility in audit plan to adjust tochanging business and risk conditions
Expand audit plan on key areas of risk (e.g.cyber security and key operational andtechnology risks) and related controls
Voice of the Customer: Stakeholders’ Messages for Internal Audit,
Global IIA, 2015
Should internal audit have a more active
role in an organisation’s strategic risks?
64 %
20 %
16 %
Yes
No
Unsure
Areas for internal audit to address
beyond assurance
Global IIA 1,124 survey respondents, 34% board members; 15% CEO
Beyond assurance
64%
65%
66%
71%
73%
Identify risk management frameworksand practices
Identify known and emerging risk areas
Alert management to emerging issuesand changing scenarios
Facilitate and monitor effective riskmanagement
Consult on business processimprovements
Pulled into more areas of the business, seen as a central driver of business success
Internal audit is seen as ‘go-to’ team who can review, identify and increasingly asked to facilitate business improvements
Senior managers are increasingly looking for assurance that risk has been identified, addressed
Assurance appetite being stoked externally:
Regulatory and business practices e,g. mandatory requirement in public sector; in FS, spurred by financial crisis
But this also means: IA team needs new skills, new understanding and to respond flexibly to new situations
HIAs are more central to the business, this is a new situation, independence is preserved but they are aware of a new proximity to senior management
HIAs are conscious they need to understand both the business and the management dynamic – do they feel fully comfortable in this new position?
Internal audit response
Heads of Internal Audit research results, Bright Penny, March 2017
7 Tenets of Professionalism
1. Set of underlying principles/standards
2. Code of practice
3. Common body of knowledge and research
4. Verified skills/competencies
5. Continuous update of skills
6. Professional network
7. Duty to the public interest
Duty to the public interest
• Playing a role in maintaining economic
stability and development
• Helping organisations to maintain strong
corporate governance
• Helping organisations to protect assets
• Helping to protect jobs
• Helping to regain public trust
“If you go back to the financial crisis, one of the things that we
heard was that when these problems were eventually discovered, it
was often the internal audit function, not an external audit function,
not any other function within a corporation or financial institution,
but it was internal audit who called this out.”
UK Regulator
Chartered IIA Stakeholder Research, interim report, March 2017 - ComRes