Ms Satyavati Berera, leader, internal audit services, PwC.

Recently, PricewaterhouseCoopers LLP (PwC) brought out a survey titled Internal Audit 2012, and followed it up with an Asia-Pacific (Apac) supplement. These reports found that internal audit should follow an audit plan that isclearly linked to an enterprise-wide risk assessment and the companys strategic objectives, says Ms Satyavati Berera, leader, internal audit services, PwC.

We also found that internal auditors should aggressively obtain new skills and use new tools and techniques to optimise the use of technology. And that they need to be more proactive to ensure they provide real value to their companies, she adds, during the course of an e-mail interaction:

Excerpts from the interview:

What is the purpose of the study?

Since 2005, PwC has been conducting an annual State of the Profession survey to provide audit leaders with important data and insights into current issues affecting the internal audit community. Given the many forces impacting internal audit in recent years, we thought it would be beneficial to develop a consensus projection of the trends likely to shape the world of internal audit by the year 2012. These reports are a result of that effort and provide insights on opportunities and challenges likely to face internal audit functions over next five years.

Are there any clear trends in the internal audit profession?

Yes, we did find five trends that are likely to have the greatest impact on internal audit in the coming years. These are: globalisation, changes in risk management, advances in technology, talent and organisation issues, and changing internal audit roles. Apac internal audit leaders expect to be impacted more significantly by these external trends than their American counterparts.

How is globalisation perceived to be a major force by internal audit professionals?

Nearly three-fourths of the survey respondents expect globalisation to have a moderate to very strong impact on the roles and responsibilities of internal audit. As Asian companies seek to become more global, they will be expected to have more advanced control and governance processes. Without these it will be increasingly more difficult to compete effectively in global capital markets.

Only those who will risk going too far can possibly find out how far one can go, says T. S. Eliot. What was your reading about risk management?

Our studies, which went far enough to interview and collect data from chief audit executives (CAEs) of 50 selected large companies in Apac and from Fortune 250, found that almost 80 per cent of internal auditors surveyed expect audit coverage related to risk management to increase over the next three years.

Company managements have now begun to take ownership of risk to the business and are ensuring the effectiveness of the controls designed to mitigate it. With risk assessment and management a primary stakeholder concern now, internal audit functionaries must adopt a risk-centric mindset and increase their functional value.

Looks like the traditional approach to internal auditing is no longer relevant?

Thats right. Internal auditors must move away from a traditional approach to auditing centred on an annual audit plan, and operate within a faster, more flexible scheduling and planning model. By adopting continuous auditing techniques they can provide more assurance at less cost.

Reassuringly, nearly three-fourths of Apac CAEs are betting on continuous auditing as a key trend in internal audit, moving ahead. We found a general need amongst internal auditor to move beyond a static, cyclical audit approach and adopt a continuous, comprehensive approach to audit and risk assessment one that optimises the use of technology.

Is there an increasing acceptance of technology, among the professionals?

Definitely. There is unanimity among the survey participants that the use of technology will increase over the next five years. Internal auditors clearly appreciate the potential value and the likely impact of technology, and they expect technology to have a significant impact on their function in the years ahead.

Despite the high regard for technology among participants, our study suggests that optimising the potential of technology would require different skill sets for internal auditors, more sophisticated tools and applications, and a move beyond traditional internal audit methodologies.

Different skill sets, such as?

Respondents agreed that the most important skill sets five years from today would be data mining, risk assessment, information technology, risk management and fraud detection.

Wed need advanced skill sets although traditional accounting and auditing skills are expected to remain highly important in 2012. The traditional skills alone are unlikely to provide the types of risk monitoring and analysis needed for a risk-centric auditing environment.

To operate effectively, audit leaders must develop a mix of capabilities, competencies, and experience levels. From a technical perspective, CAEs will need access to a critical mass of auditors who, on a collective basis, could access, assess, and analyse risk data as well as help prevent and detect fraud.

Are internal audit services strongly positioned in Apac?

PwC studies show that internal auditors in Apac face a number of obstacles due to the cultural norms that tend to inhibit promotion of a dynamic and independent role for internal audit. A number of large organisations in the region either have no internal audit function whatsoever or have an internal audit function that focuses on low-value activities.

We found that internal audit functions in Apac will often issue reports with watered-down findings and without recommendations for improvement in order to avoid upsetting or embarrassing their auditees.

Companies in Apac are often slow to demand a stronger internal audit function, but as these companies assume multinational status they quickly realise the value and benefit of a robust internal audit function that is aligned strongly with the strategic direction of the organisation. To this point, 68 per cent of the Apac respondents told PwC that the role of the CAE will increase in importance over the next five years.

What are your views on the internal audit and risk management capabilities of Indian organisations?

Internal audit in India currently lies at the periphery of an organisations core team. Other than a select handful of matured organisations, the roles and responsibilities of the internal audit function remain undefined and lack focus.

Organisations need to adopt good practices and empower their internal audit team with the right skills and technical knowledge to be able to derive true value of their internal audit function.

Taking a cue from their global peers, Indian companies are beginning to realise the benefits of risk management. While it remains in a very nascent stage, with a few companies implementing the required processes, regulatory initiatives such as Clause 49 of the Listing Agreement on corporate governance, help in bringing risk management to the limelight. Healthily, companies have started viewing risk management as a way of realising value rather than a necessary compliance.

How can internal audit present itself as an attractive value proposition?

To be successful, CAEs have to be perceived as strategic; they must be members of senior management. Audit leaders must strive to ensure that internal audits priorities align effectively with those of the audit committee and senior management.

Central to internal audits strategic repositioning is the ability to adopt an all-inclusive, conceptual approach to audit, risk assessment, and risk management that extends well beyond a focus on financial controls. Internal auditors need to embrace new tools and techniques to enhance the effectiveness, efficiency and quality of operations.

Do we have the required skills and resources in the internal audit and risk management sphere?

Many CAEs feel that the supply of internal audit skills sets is much smaller than the marketplace demand. Along with that, individuals need skill sets that move beyond the purview of basic internal audit, and focus on risk assessment and management.

Internal audit groups today need people who are strong in both data extraction and analysis to evaluate key risk indicators (KRIs) and compare them with industry norms. Risk analysts need to understand risk factors and related control implications to provide more timely risk and control assurances and update organisational risk profiles.

In sum, your suggestions on the key areas of improvement that internal auditors in the Apac region can strive for.

We believe that internal audit functionaries must be proactive and redefine their value to their organisations. It is vital for internal auditors in Apac to learn from the experiences of their peers in other regions of the world, and take advantage of new tools and techniques to make the most of todays opportunities.

In global capital markets, the quality of a companys internal audit, control, and governance processes can either provide significant competitive advantage or be a major liability. Internal auditors within Apac continue to focus primarily on compliance and control issues as opposed to risk.

For historical and cultural reasons, audit leaders in this region have yet to adopt the risk-centric mindsets and related capabilities needed to address the mounting risk concerns of directors and senior management.

Leaders must now break away from old systems and adopt fresh methodologies to keep pace with their rapidly evolving industry. Apac needs to use their internal audit function to their advantage and to do this they must start by accepting and simultaneously start educating company personnel about the importance of governance, risk and internal controls.

D. MURALI