Internal auditors are seeing far-reaching effects from the COVID-19 pandemic on the way they do their work, according to a new survey.
The
Audits have been going remote since the start of the pandemic, reducing the need for auditors to work from their offices to reduce the spread of the coronavirus, particularly this year with the highly transmissible Delta variant of COVID-19. Technology has helped internal auditors as well as outside auditing firms stay safe.
According to the survey, 83% of audit teams said the creative solutions they deployed in the process of working around lockdown limitations have produced new efficiencies, along with new methods, for evidence gathering. Some of the innovative uses of technology in the past year include drones, pre-positioned security camera video feeds, and video documentation by smart phones and other devices. Chief audit executives said the use of drones to document the physical existence of assets or control effectiveness has given them sufficient evidence more efficiently than traditional means of auditing.
Audit, risk and compliance professionals have turned to video technology like Zoom not only for meetings between members of the internal audit staff, but also for other face-to-face interactions throughout the audit process and communications with stakeholders. The survey found 72% of the chief audit executives polled believe their teams will probably continue to rely heavily on technology-facilitated meetings as a more efficient means of communication. Another 72% of CAEs said they plan to put more focus on emerging risks and their possible impacts.
In addition to the survey, AuditBoard has been meeting with chief audit executives to find out more about the risks they’re facing. “We’re hosting a series of roundtables with chief audit executives here in the U.S.,” said Richard Chambers, senior internal audit advisor at AuditBoard and former president and CEO of the Institute of Internal Auditors. “We have put together something we’re calling the Risk Assurance Vision Council. It’s a roundtable of chief audit executives who are really risk professionals from leading American companies. We’re going to spend some time over the coming year tackling some of the vexing issues that risk management professionals face, whether they're audit risk management professionals formally or compliance professionals.”
AuditBoard did another survey in June of nearly 200 chief audit executives in the U.S. to ask them where they are at this point in 2021 and what the rest of the year looks like for them. “There were two key themes that have come out of it,” said Chambers. “One is that everybody is navigating the return to the workplace. A lot of great lessons have been learned over the last year as far as how internal audit can conduct itself working more in a virtual or remote fashion. A lot of chief audit executives are taking that on and drawing from those experiences over the last year to look ahead and figure out what the future looks like for their teams and how they undertake their work. When we asked some questions about how they’re looking from a resource standpoint, it was pretty encouraging.”
The internal audit profession seems to be weathering the pandemic and its effects on the economy. “Traditionally my experience has been that when the economy turns down, internal audit is one of those functions that management will turn to and say, ‘You know, we need some cost savings, so we’re going to reduce your staffing. We’re going to reduce your budgets.’ That didn't seem to be the case at all during the economic downturn we’ve seen in the last 18 months,” said Chambers. “In fact, the survey indicated that 83% of internal audit functions in this country are operating at or above their pre-COVID levels as far as their budgets go, and only about only about 11% of those we surveyed said that they had lost any staffing. That, to me, was pretty remarkable considering all of the downsizing and the reductions we’ve seen across all industries in the last year. So the good news is a lot of resources have made it through COVID. Being ‘resilient’ is the word of the day. It’s the word I would apply to internal audit.”
War for talent
Looking forward to next year, AuditBoard asked chief audit executives what their resource picture looks like for the year ahead, and 21% said they expected budget growth.
“One in five are expecting their budgets to go up, and 20% — one in five again — expect that they’re going to have more staffing added back during the next year,” said Chambers. “Those are good news stories from my standpoint. But they also give rise to one of the challenges that I’m hearing anecdotally a lot from chief audit executives, and that is the challenge of finding talent in this market. It’s a very hot job market right now, and particularly when it comes to finding talent with specialized expertise like cybersecurity or other technology-related talents. It's a very tough market. The thing that I gather from the results of our survey, and what I’m hearing and seeing, is that it’s only going to get tougher in the year ahead because people are already struggling to find the talent they need. One in five of them are going to add more talent in the next year, and the demand is going to be chasing a supply that may not be there. I think we’re going to see what I’ve loosely referred to in the past as a talent war, a real scrimmage to see who can walk away with the best talent.”
Workplaces will need to be more flexible to adapt to auditors who still prefer to work remotely. “In a conversation I had with a group of chief audit executives recently, I asked them, ‘All right, are you going to be more flexible when you bring all your staff back? And when you hire new staff, are you going to be more flexible about where they’re going to be able to work from?’” said Chambers. “And it was kind of mixed. I was surprised. Some were very firm that they expected that their staff would be returning to the workplace. Others, I think, realized that if they want to retain the great talent they have and they want to compete in this very constrained talent market that lies out there over the next year, they’re going to have to be flexible about the return to work direction that they get.”
The chief audit executives face extra challenges with talent recruitment and can’t simply turn to campus recruiters to help them fill the pipeline.
“There are not a lot of internal audit departments that recruit straight out of college because of the nature of the work that's being done these days and the kind of assurance that’s being provided,” said Chambers. “You’ve got to have a knowledge of the business really in place to come on board. I’m not saying that they don’t. There are a lot of internal audit departments that still do recruit from colleges and universities, and certainly there are some great programs out there at LSU, the University of Texas at Dallas, and Kennesaw State that have internal audit programs to prepare internal auditors for the workplace. They’re there and certainly in big demand. But I still think the vast majority of talent that’s recruited into internal audit staff is experienced talent. You’re looking at higher salary expectations. If I’m looking to bring in someone who's got five to 10 years experience in internal audit, then I certainly am going to have to compete with all those other companies out there that are looking for the same talent. It’s going to be a classic supply and demand situation. As long as there’s an increasing demand for internal audit talent and the commensurate supply is not going up, then you’re going to see salaries will have to go up. Flexibility will have to be there when it comes to working conditions and where people work and the kind of things that they're doing.”
Facing risks
Demand for talent in internal audit is being driven by not only the pandemic but also supply shortages as well as challenges like cybersecurity.
“We asked chief audit executives what are the top risks on their radar that their companies are facing in the second half of the year,” said Chambers. “When you start to look at those seven that we highlighted in a
Data privacy and protection were cited as the second most significant risks that chief audit executives are seeing this year. “We’ve certainly seen as cyber criminals have gotten more brazen this year, that they’re going after data,” said Chambers. “They’re not only going after data, but they’re really looking in some cases to just shut down companies’ access to the markets. We've seen that on several occasions so far this year.”
Third-party risk management ranked in third place on the list of risks faced by chief audit executives. “As we think about vulnerability, particularly when it comes to cyber, you can have your affairs in order and have your cyber controls tied down, but you’ve got to also be looking at your third-party contractors and your partners and make sure that they too are secure because in many cases, your systems integrate with theirs. And so a hack into their systems could also attack you. When we start to look at those kinds of risks, then you’ve got to have expertise to help internal audit needs and expertise to help tackle those risks.”
The supply chain has also been a major challenge for many companies confronting shortages in computer chips and raw materials.
“Supply chain has been a huge challenge,” said Chambers. “A year ago, economic conditions meant that internal audit was looking at the risk of a recession to their companies. Now, I think in some cases they’re looking at what’s the risk of an overheated economy to their companies, with inflation and some of the other characteristics of an economy that’s really heating up. We’ve kind of gone 180 in the last 12 months when it comes to what the economic conditions risk might be that companies face.”
Regulatory change also ranked high on the list of risks cited by chief audit executives. “Lots of new regulations and legislation are coming down the pike that will lead to new regulations,” said Chambers. “I think internal audit’s always got compliance risk on its mind. But it’s right up there in the top five this year. Talent management is number six and business continuity and crisis response are number seven. There are a lot of interconnected risks among those seven.”
Business continuity and disaster planning have to be concerns given the increasing number of natural disasters coming on top of the pandemic. “There are just so many ways your business can be disrupted these days,” said Chambers. “COVID will continue to be a threat, but all these incredible weather events seem to point to real risks for companies out there.”
Chambers recently did a poll of his own on
Companies also are facing fraud risks from remote employees who have access to the business’s computer systems day and night. “I spent 26 years in the federal government,” said Chambers. “I was an inspector general in the federal government. I would tell you from my experience that fraud chases money. As we see some of the federal appropriations coming down the pike, that’s going to pump a lot of money into infrastructure. I personally think that’s much needed. But the more money that gets pumped in in a short period of time, the more the fraud risks are going to go up. That’s something we probably are all going to need to keep our eye on in the coming year.”
Reports of fraud have been proliferating in the federal unemployment insurance program and the Paycheck Protection Program, and that may happen with infrastructure funding as well.
“We’ve seen fraud schemes related to COVID relief funding, but construction fraud is notorious,” said Chambers. “It always has been. And so if we think about all the money that’s going to get bumped into infrastructure construction, I think this will be a very, very hot topic a year from now.”
Training internal auditors will be key to combating fraud and highlighting risks. “The changes that I’ve seen in the last 20 years about the way training is provided, where people go for training, and how training gets delivered has changed so dramatically, probably more dramatically than any other facet of what internal audit does,” said Chambers. “As I look at the market today, I think consumers have a variety of options.”
