Developing the Internal Audit of the future

The impacts caused by the Covid-19 crisis required organizations to maintain their activities remotely, in addition to bringing additional obstacles to preserve the quality of their processes and the effectiveness of teamwork. And it was no different with the practice of internal audit.

Although it is uniquely positioned to help organizations navigate complex periods such as nowadays, internal audit still faces challenges in responding quickly to changing business environments and the growing expectations of stakeholders, as revealed by Deloitte’s global survey with audit committee members. This study found that 96% of respondents believe that internal audit needs to expand their set of technical, personal and business skills – as these demands will increase from 3 to 5 years.

This will require setting aside old methods, eliminating inefficiencies, adhering to innovation, operating proactively – looking to the future, prioritizing activities that bring value. If, on the one hand, internal audit does not work autonomously, requiring the continuous support of audit committees and executive levels, its leaders must be above all, determined, independent and focused on innovation, the constant improvement of their practices and the training and development of their teams.

The “Internal Audit in Brazil” survey, released by Deloitte in November 2020, states that organizations’ expectations regarding internal audit continue to grow – showing that the response time and quality of internal audit reports have improved in recent years. However, audit committees and senior management still expect more from internal audit: business acumen, perceptions of added value and, above all, anticipation of risks. In this context, about 70% of committee members said that internal audit should dedicate more time to advisory activities and 92% expect that internal audit will provide relevant insights and contribute to their organizations’ readiness for emerging risks.

To foster the development of teams that are prepared to meet these objectives, many committee leaders have emphasized development opportunities in three distinct segments:

• Knowledge of the internal auditor about the segment in which the organization operates, its business strategies and regulatory landscape, as well as a deeper appreciation of operations, expanding its capacity to bring new perspectives and contributions;
• Domain of specific risks, with a significant emphasis on cyber risk, which involves information security, data governance, automation and artificial intelligence;
• Non-technical skills, specifically involving skills about emotional intelligence, communication and presentation, negotiation, influence and leadership.

Another aspect widely explored in the survey involves structuring teams that can combine the skills necessary to achieve these goals. Considering the attribution that insights are developed better when they arise from collaboration and diversity of thought, internal audit leaders (or Chief Audit Executives – CAEs) must promote the combination of different experiences and points of view within their teams – which can help provide new and valuable points of view.

The success of an internal audit team will be less  associated with the concept of “internal auditor of the future”, giving rise to the structuring of teams formed by a set of complementary skills (which is called power teams), allowing activities to be carried out with more agility, more frequent and pragmatic interactions, concentrating collective effort on tasks and reducing the time needed to provide information and value. In general, teams with these attributes have a natural level of resilience that favors productivity, in addition to bringing the necessary excellence to achieve the results that committee leaders expect from internal audit.

Deloitte’s global study “Optimizing internal audit” addresses this perspective in the face of developing innovative teams, capable of acting as a catalyst to accelerate and consolidate learning, in addition to driving continuous improvement of tasks and the release of creativity, enabling team professionals maximize their potential.

In the Brazilian scenario, members of the local audit committee point out that it is not enough for the internal auditor to have just a technical bias. It is necessary to pay attention to the capacities to prioritize relevant aspects to the business and to engage the top management in the necessary transformations for their organizations. The current business dynamics and the evolution of technology have required the internal auditor to develop deep expertise in the segment in which the organization operates, in addition to different competencies to adequately address the set of risks to which it is exposed.

In view of all the points highlighted, it is always necessary to keep in mind the contribution of technology in the internal audit. With the growing advancement of business digitalization, internal audit increasingly needs to combine strong knowledge about cyber risks and take advantage of emerging technologies to expand the scope of its work, streamlining operational activities and bringing more assertiveness to its findings.

In this context, professionals who have robust knowledge in both business and technology (called the purple people in the survey) will have a prominent role in the transformation of internal audit. To stay up to date, internal auditors will need to adapt and achieve a high level of digital experience. Thus, investing in the training of teams with the concept of power teams and in the development of purple people professionals undoubtedly represent relevant strategies to achieve the internal audit of the future.

Paulo Vitale is a Risk Advisory partner and leader of Internal Audit practice at Deloitte Brazil