Employees wearing protective masks at an office in Menlo Park, Calif., in September. Companies have pulled internal auditors into their pandemic response efforts and have added audit coverage to areas such as health and safety.
Photo: David Paul Morris/Bloomberg News
Internal auditors were once a small cog in the corporate machinery, tucked away in finance departments where they primarily analyzed financial controls. If you’re thinking of green eyeshades, you’re not far off.
But in the past 20 years, the role has expanded as investors and regulators have demanded more disclosures about how companies manage a range of nonfinancial risks. Which is why Richard Chambers, chief executive of the Institute of Internal Auditors, disabuses people who regard those in his profession as mere bean counters.
“We used to be the bean counters,” Mr. Chambers, who will step down in March after 12 years at the helm of the Lake Mary, Fla.-based professional association, said in an interview. “Today we have to understand how the beans are grown, how they’re harvested, how they’re taken to market, so we can provide advice in addition to assurance. It’s not good enough anymore for the company to just know how many beans they’ve got.”
Mr. Chambers spoke with Risk & Compliance Journal about that evolution, about how the coronavirus pandemic is creating new challenges and responsibilities for internal auditors, and what he sees as the biggest risks facing companies in 2021. Edited excerpts follow.
WSJ: You’re preparing to leave the organization. How has the profession changed during your career and particularly during your tenure at IIA?
MR. CHAMBERS: The profession has changed pretty dramatically. It’s gone from more of a focus on financial reporting and financial controls to a function that is much more risk-centric. In the last 12 years, we’ve seen a real acceleration of that.
Post-financial crisis, you started to see a lot of new risks emerge, heightened risks like cybersecurity and more focus on risks such as corporate culture, data ethics and artificial intelligence.
Richard Chambers, chief executive of the Institute of Internal Auditors, says the internal audit role is expanding beyond monitoring financial controls.
Photo: The Institute of Internal Auditors
A lot of companies started creating formal enterprise risk management initiatives, and companies started tapping internal audit to help.
Management and board members look around the company and say, “Who routinely thinks in terms of risk facing our company?” And they think of the internal auditors.
WSJ: What are some of the new roles internal auditors have taken on as a result of the pandemic?
MR. CHAMBERS: Early on, internal auditors were being pulled into more of the organization’s pandemic response. Many departments have had to add audit coverage in areas like business continuity, health and safety, revenue risks, supply chain risks.
We’ve also seen a higher incidence of internal auditors being asked to roll up their sleeves and help on the operations side. It’s not something we advise because if the internal auditors get too involved in the operations, it’s more difficult for them to do the audit work and maintain objectivity. It’s not pervasive, but it’s out there and it’s understandable, given all that’s going on.
WSJ: What challenges has the pandemic introduced to the profession?
MR. CHAMBERS: We’ve seen some reduction in internal audit staffing and resources. About 36% lost some of their budget. About a quarter said they’ve lost staffing. About a quarter have had to adapt to new ways of gathering evidence.
When you’re trying to assess whether some new control is working or there’s compliance with some aspect of a new law or regulation, you’ve got to have evidence. How we gather that evidence has been impacted because we’re all sequestered at home. In instances where you have to physically observe something, to do some kind of inventory or some physical observation of the effectiveness of control, that’s been severely impacted. You have to get innovative, creative. You have to be able to use technologies such as drones or cameras or some other means to document.
WSJ: Internal auditors can see deep into an organization. What are some of the top risks they’re seeing going into 2021?
MR. CHAMBERS: The risk that I’ve been talking a lot about is talent disruption. You’re going to have people starting to return [to workplaces] next year. You’re going to have companies with different approaches. Some are going to say, “Hey, we’re good with you working from home.” Others are going to say, “No, we want everybody here.” And people are going to be making assessments about what they want to do with their future based on a lot of factors that maybe weren’t around a year ago.
People have had these last few months to reflect on what’s important to them. More time with their family. More flexibility. They don’t really want to go back to a commuting situation. Maybe they’ve grown to a point where they want to try something different in the way of a career. We’re facing a perfect storm as people start to look for new opportunities.
I don’t know that I would’ve made the decision to step down from my role if I hadn’t been going through these experiences. I think there’s going to be a lot more people like me who’ve had a chance to reflect and say, “I want to do something different in 2021.”
WSJ: What role will internal audit play in helping organizations mitigate that risk?
MR CHAMBERS: We’re auditing how well you’ve got your arms around the risk. Do you have an assessment of what the risks are? What is your plan? What are we going to do to persuade folks who might be inclined to pack up their things to stay? What kinds of policies are we going to implement to make this a more work-life-balance-friendly workplace?
Internal auditors are providing assurance to management and the board that that risk is being effectively managed. We provide comfort to the board and the senior management. This is a resource that’s sitting right under their noses. And in environments like this, when you’ve got so much risk and uncertainty, it’s a perfect time to tap [internal audit] on the shoulder and say, “Hey, help us out.”
Write to Jack Hagel at [email protected]
Copyright ©2020 Dow Jones & Company, Inc. All Rights Reserved. 87990cbe856818d5eddac44c7b1cdeb8
