Boards Relying on Internal Audit to Protect Against Risk

Companies are taking steps to prepare for a reputational crisis by employing an internal audit function, but less than half the board members polled in a new survey feel they are “well-versed” in the issues.

The survey, by the accounting firm EisnerAmper, found that 78 percent of the public company directors they polled said their firms employ personnel in an active internal audit function, and 71 percent said internal audit has been helpful or very helpful in identifying risk.

In addition, 92 percent of board members indicated that regular board meetings address risk well or very well, while 84 percent said external auditors address risk well or very well, and 86 percent said the legal and compliance group address risk well or very well.

Some of the major risks identified in the survey related to cybersecurity and social media.

“Because social media and cybersecurity are intrinsically linked to a company’s reputation and image, organizations and boards should consider both as among the most important risks to manage and monitor,” said EisnerAmper CEO Charly Weinstein in a statement. “With today’s media capable of capturing every crisis occurring within organizations, it is becoming increasingly evident how connected reputation, cybersecurity and social media are in relation to risk.”

Among the other risk categories, tax strategies were cited as a concern by only 15 percent of the respondents, compared to 75 percent for reputational risk and 61 percent for cybersecurity and IT risks.

Forty-eight percent of the board members surveyed said their boards have a plan in place to address a crisis with potential reputational risk fallout, but only 20 percent have provided training to execute those plans.

Public companies are the most diligent when addressing reputational risk. Nearly 75 percent of the board members indicated their companies have a response plan and training in place.

Seventy-eight percent of the public companies surveyed said they employ people in an active internal audit function, while just over 50 percent of private and not-for-profit boards do.

Public company board members indicated they continue to find internal audit very helpful (34 percent) or helpful (37 percent) when identifying risks. Not-for-profit board members said they have found internal audit to be either very helpful (17 percent) or helpful (46 percent).