Richard Chambers on the Twin Crises Profoundly Affecting Risk Today

What does The IIA’s Richard Chambers see as the issues with the most profound effect on risk right now — and how can internal audit step up to drive change? Find out in this edition of our AuditTalk video series, which features leaders in the audit community discussing their perspectives on current issues, sharing their experiences, and offering insights on industry trends.

We invited Richard Chambers, President and CEO of The Institute of Internal Auditors, to sit down virtually with Tom O’Reilly, AuditBoard’s Senior Director of Solutions Advisory Services and Internal Audit Practice Leader, to share his perspective about which changes coming out of the first several months of COVID-19 are just short term shifts, and which will have long-term impacts on internal audit’s work. 

Watch the full interview below to hear his views on addressing the expectation gap in 2020, why departments still deploying 20th-century processes are in trouble in today’s environment, and how internal audit can step up now to be a change driver in the organization.

Q: You’ve spoken quite a bit about the immediate need for Internal Audit teams to adjust their audit plans in 2020 resulting from COVID-19. Could you share what changes you’ve been seeing to topics and areas being audited, as well as any changes to the type of service that Internal Audit is providing to the organization?

Richard Chambers: What we’re seeing is really unprecedented. I’ve been in Internal Audit for 45 years, and I can’t recall an era or a period any time over the course of those years that I’ve been in this profession, where I’ve seen so much change in such a short period of time, not only in how we do our work, but also in where we’re focused. The pandemic and the twin crises of the health aspect and the financial aspect are having a profound effect on the risks that organizations are facing. We’re seeing that across all industries and around the world, Internal Audit is stepping up at a lot of organizations to be that immediate source of insight and assurance to give boards and management better confidence about how the company and the organization is positioned to address the crisis.

 

As I always say, effective Internal Audit departments know how to follow the risk. The risks are going to be somewhat subtly different from organization to organization, but there’s a bucket of risks that we’re seeing internal audit diving into to a greater extent than we have before. Certainly health and safety is something that you wouldn’t normally see Internal Audit involved in, but as organizations are facing health and safety risks, Internal Audit has an opportunity to step up there — and has been.

 

Business continuity — I don’t think we’ve ever seen a period where there was more disruption of business operations, so business continuity and supply chain continues to be a challenge. And then with cyber and privacy, we’re so much more dependent now on virtual operations that it expands the risks related to cybersecurity.

 

We’re also seeing Internal Audit getting pulled in more and more to what I call the cost reduction and containment reviews. This is more related to the financial part of this crisis, but it’s something I’ve seen repeatedly over the course of my career — whenever the economy turns swiftly and suddenly, Internal Audit is often asked to come in and help find places where we can get better efficiency and effectiveness and reduce costs.

Q: We’ve heard from audit teams that they’ve been putting some traditional assurance projects on hold over the last 6-8 weeks. Do you see this as just a short term impact due to the fact that organizations need Internal Audit to be all hands on deck to address key areas, or is this going to be a longer term impact on the type of work that Internal Audit performs for their organization?

Richard Chambers: I think that the answer is probably somewhere in between. I think that we’re likely to see some long-term impacts in terms of where internal audit coverage is and how we do our work. I do think that those COVID-related risks areas I mentioned are not likely to see long-term emphasis by Internal Audit, though we are likely to see long-term impacts on how Internal Audit undertakes its work. 

 

I would also say we’re seeing some short and intermediate impacts on Internal Audit that typically accompany the kind of economic environment we find ourselves in. The IIA is publishing the latest of our quick polls and the results are pretty revealing. 45% of Internal Audit departments indicate that their budgets will be reduced over the next 12 months, and of that, 86% said their travel budgets are going to be reduced. So virtually everybody is going to see some impact there, and what is even more troubling to me is that more than a quarter of them say that they’re going to be losing staff over these next 12 months. You can’t have that kind of an impact on Internal Audit and its budget and not see that manifest itself in the extent to which we’re able to provide certain audit coverage.

Q: What type of guidance would you give to these internal audit teams that may be suffering or experiencing a reduction in budget, whether it’s through, headcount or other types of budget spend. How can they still provide that same type of assurance that’s expected of them with the same or less resources?

Richard Chambers: I think that’s actually the key. We’re facing an expectation gap if we don’t step up to meet that kind of thinking from boards and management about what value we can add. So we’re at a point where there’s an expectation going up of what we should be able to do for the organization, but at the same time our resources are going down. That’s where I think we have to get much smarter about how we operate.

 

This newest poll that we’re publishing has some pretty interesting insights about some of the changes in internal audit processes over the next 12 months. 80% expect that they’re going to be more options to work remotely for their staff. 73% are expecting to have much more flexible audit plans than they’ve had in the past, and 71% say they’re going to decrease the amount of time that they spend auditing on site. I think these trends mean that we can be more efficient. I’m not saying we can provide the same level of assurance or coverage or advice with fewer internal auditors, but we’ve got to get smarter about how we do it if we expect to be able to continue to add value in organizations.

Q: Having spoken to so many forward-thinking audit teams, especially those that are using purpose-built Audit Management Solutions, how does technology make them successful, and how can that continue to make them successful in 2020 in light of COVID-19?

Richard Chambers: I think we’re likely to see a significant pivot toward more technology solutions. We’ve seen over the years that Internal Audit departments are incrementally incorporating more technology solutions, whether it’s automated work papers that we saw starting to come in 20 years ago, or whether it’s, you know, even in some organizations using robotic process automation, and so forth. What I would add is that any Internal Audit department that is still deploying 20th-century processes is going to be in real trouble in being able to operate in this environment. I wrote a blog recently on the reporting process alone and how you’ve got to be more timely. We’re operating in a very dynamic environment. The risks this week may not be the risks next week, and if you start auditing a risk this week, and then six weeks later you’re finally giving feedback to management, they’re probably going to have identified a solution and moved on. If we’re going to be relevant, we’ve got to be timely. 

 

Even before you get to the audit process, using technology in maintaining a continuous risk assessment is so critical. 53% of those who responded to our latest survey indicated that they’re going to be increasing the frequency of risk assessments in the coming year. I think some could say, “well, that’s good news,” but I would say, maybe that’s only the glass being half full. I would think everybody had better be increasing the frequency of their risk assessments — really, we shouldn’t be talking about frequency, we should be talking about continuous. Some of the technology tools that are out there enable a more continuous examination of risks.

Q: What advice would you have for that Chief Audit Executive and audit team who may find themselves sitting on the sidelines in their organization, to start adding more value to the organization?

Richard Chambers: Well, it really has to start with an aspiration to be a change agent in the organization. We have people in our profession who aspire to drive change in the organization. And if you’re comfortable waiting back until you’re called upon, in all likelihood, the organization you serve isn’t going to call you. You’ve really got to be proactive, and that starts with communication. You should be in there having regular dialogue with management, the Audit Committee, and the Board about what Internal Audit can be doing right now to give them some comfort, assurance, and advice on how the organization can navigate this crisis. So, my first piece of advice is to be proactive and communicate. 

 

Then I think what you should do is to listen and identify the risks that are of the greatest concern to management and the Board. I know when I was a Chief Audit Executive many years ago, I had a couple of cases where the organization suddenly was facing a crisis, and I had a challenge of getting the attention of leadership to say how Internal Audit can help. What I found would work more often than not, is to really understand what it is that’s keeping that person or that group of managers awake at night, and then diving in — that’s how you really demonstrate your value. If you’re auditing off of last year’s plan, in all likelihood, no one really cares, but that’s the problem, no one really cares.

Q: To wrap things up, would you tell us about current and future resources from the IIA for internal auditors to navigate through COVID-19, and closing advice for internal auditors?

Richard Chambers: We recognized almost immediately that this was going to be an unprecedented era and that internal auditors were going to need to band together. Progress through sharing has always been the IIA’s motto, and I think it’s been our mission for the last three or four months — to be out there sharing all the information we can get our hands on. The IIA has a COVID-19 Resource Center that the IIA launched almost three months ago. I would encourage internal auditors to stay focused on your organization and the risks that your organization is facing, but also to learn from others, benchmark, identify leading practices, and be out there as a change driver in your own organization.