Chapter 13
Role of Internal Audit in Enterprise Risk Management
Internal auditors are the “eyes and ears” of management in their role as specialists who visit all areas of an enterprise and report to the audit committee and management on the internal controls status of the operations visited. They have historically had ongoing concerns and interests in risk management. In particular, internal auditors have regularly assessed the relative risks of areas to be examined when planning their upcoming audit activities—deciding which areas or functions within an enterprise to select for internal audits. With limited time and internal auditor resources available for the many areas and activities in an enterprise to review, an internal audit department and its chief audit executive [CAE] should focus their time and attention on the riskier areas of the enterprise, deferring other audit review candidates for another time. We have used the term audit to refer to the multiple roles of internal auditors in both providing reviews and assessments of enterprise internal controls and often providing consulting services to management. Earlier risk assessment processes used for internal audit planning, however, were often informal and limited in scope. An internal audit function with the responsibility for reviews of multiple internal controls and operations throughout an enterprise often would decide which of these often activities to include in an annual audit plan based on concerns expressed ...
ENTERPRISE RISK MANAGEMENT
ERM AND THE INTERNAL AUDITOR
What is the role for a corporation’s internal auditor in the ERM era?
Enterprise risk management [ERM] is beginning to get more ingrained into the corporate culture of many of the major corporations. As this occurs, it either gains supporters or detractors within the corporate hierarchy. ERM is, after all, a major change agent in most organizations and, as such, it is bound to "ruffle a few feathers." As a result, people in some corporate functions are having difficulty working with the corporate risk professionals. Much of this friction is caused by a lack of clearly defined roles, frequently leaving unresolved lines of authority and reporting relationships.
In many companies there is the potential for conflict between the internal auditors and those who are responsible for the ERM initiative. The Institute of Internal Auditors [IIA], in an attempt to circumvent any prospective concerns, issued a position statement shortly after COSO released its Enterprise Risk Management�Integrated Framework in 2004. The acknowledged purpose of IIA's statement was "to assist chief audit executives in responding to enterprise risk issues in their organization." Its primary approach was to "suggest ways for internal auditors to maintain the objectivity and independence required by the IIA's International Standards for the Professional Practice of Internal Auditing when providing assurance and consulting services."
It's a black and white issue
IIA's position statement goes into significant detail about what role internal auditors should take regarding a number of specific corporate functions. However, in summary it indicates:
"Internal auditing's core role with regard to ERM is to provide objective assurance to the board on the effectiveness of an organization's ERM activities to help ensure key business risks are being managed appropriately and that the system of internal control is operating effectively."
As noted previously, the key here is being able to maintain the internal auditor's independence and objectivity. Specifically, the IIA notes that internal auditors should not undertake:
• Setting the risk appetite
• Imposing risk management processes
• Management assurance on risks
• Taking decisions on risk responses
• Implementing risk responses on management's behalf
• Accountability for risk management
Through the issuance of the position statement, the IIA makes clear that, "Internal auditors should provide advice, and challenge or support management's decisions on risk, as opposed to making risk management decisions."
Not always back and white
While many of the core roles of the internal auditors have remained the same, the March 2011 IIA Research Foundation publication continues to express that a division should continue to exist between internal audit and enterprise risk management. "Internal auditors are finding they have important roles in risk management, but there are many roles that internal audit activities are either not ready to pursue or are not proactive in pursuing." They also note that since the financial crisis of 2008, many internal auditors are now less certain about their specific role regarding ERM. The IIA prepared a new white paper titled Internal Auditing Role in Risk Management to provide some input into this situation.
The paper, according to IIA, "examines data from surveys conducted over the past two years and provides analysis and insight" into a variety of risk management-related issues. Among the issues it addresses are:
• The direction chief audit executives receive from audit committees and management
• The risk management activities internal audit is currently performing and those they expect to be performing in the coming years
• Internal auditing's role in identifying and assessing the organization's strategic risks
• The skills internal auditors need to keep pace with evolving roles in risk management
• Opportunities to add greater value to their organization around risk management
There are a number of interesting findings contained in this report, and since most of them are provided from an internal audit/audit committee standpoint, they can offer some excellent feedback for corporate risk professionals. For example, they note that while recent audit committee surveys confirm that risk management is clearly on their radar, the committee "may not have high expectations as to what role internal auditors should play." Less than a quarter of the participating companies have asked internal audit to provide an opinion on the organization's overall risk management process. Nor has the audit committee requested internal auditors to perform specific audits of any components of risk management.
Additionally, however, the study points out that the internal auditors' roles within risk management "are not as high as might be expected, indicating that management may not be aggressively pushing for internal auditing to play a more prominent role in risk management." Overall, the study concludes, "The direction from the top is not building a compelling case for internal auditors to be viewed as an integral part of the risk management success."
Part of the concern regarding internal auditor participation within risk management centers around the level of skills auditors can bring to the risk management process. For the most part, the study points towards a general lack of specific skill sets that center on risk management. However, it points out, "All internal auditors should continue expanding their risk management skills." This expanded scope of knowledge is necessary, the study concludes, since one of the key findings "was that 80% of the respondents expect that the internal auditor's role in risk management will increase over the next five years."
Conclusion
While the lines between risk management and internal audit have blurred, internal auditors, in general, have a pretty good grasp of what their role in enterprise risk management should be. Certainly, just as ERM is still evolving, internal audit's role will no doubt also evolve. Risk management professionals need to realize that at this point in time, they have been given the primary roles in the enterprise risk management process.� However, the final paragraph in the March 2011 white paper should provide little comfort to any risk management professional.
"Now is not the time for chief audit executives to be passive and reactive. Someone will fill the knowledge void within organizations to help advance the risk management efforts. With the head start that most internal audit activities have in terms of training and disciplined risk thinking, this is the time to seize the day and be recognized as a valued and respected part of the organization."
Consider yourself forewarned.