In this episode of AuditTalk, Harold Silverman (Managing Director, Professional Practices at The Institute of Internal Auditors Inc.), Heron Schelp (Chief Audit Executive at AGCO Corporation), and AuditBoard’s Scott Madenburg discuss how internal audit can be more successful in today’s accelerated environment by:
- Integrating remote auditing and other lessons learned from 2020 into future internal audit methodologies.
- Strategically utilizing audit technologies, data analytics, and automation to further build relationships and increase the effectiveness of audit work.
- Rethinking how to recruit, retain and deploy people in remote and hybrid environments.
Listen to the full conversation, and read the can’t-miss highlights below.
How are successful internal audit functions incorporating lessons learned from 2020?
Heron Schelp: “In March 2020, everybody went remote… the team gathered together and started looking for ideas on how we can make this work, even though we’re not in the same place. We already had some technology — for example, AuditBoard was already implemented — that helped us document and track where everybody is on testing, especially from a SOX standpoint. We also had technologies like MS teams rolling out in the company, and we were able to put our co-sourcing partner and our internal teams in the same environment where even though they were remotely working, they could connect easily to get the answers to questions or concerns they had, and to share information right away. That’s the major thing that happened last March and it proved itself successful.”
Harold Silverman: “As a veteran of this profession my first thought when we shifted to working from home was, how do we keep moving? Being in the field, conversations in conference rooms, working in a tight-knit group in the office is all part of the culture of internal audit — internal audit is a hands-on profession… The IIA did a number of quick polls to our Audit Executive Center members and other Chief Audit Executives… two things really became clear. One is that functions within organizations that had strong relationships existing with their management were provided an opportunity to add value during the pandemic. Second, organizations with internal audit functions that had made investments in technology were way ahead. Products like AuditBoard, Zoom, Teams — where they’re able to stay connected and share work with their staff and with management… Controlling for industry, those that had the relationships and the investments in technology were given a seat at the table as crisis management and resilience plans kicked in.”
Heron Schelp: “As a manufacturing company, a lot of our site audits are related to inventory, receiving and shipping products, and material handling, which are really hard for us to audit remotely. We could probably use remote cameras and things like that, but we decided to focus on the areas that we could effectively audit remotely in 2020. In 2021, we have the expectation that we are going to be able to go to the sites… I would guess that we’ll continue to travel, but less — instead of three or four weeks in the field, we’ll spend just one week there. We’ll get more laser focused on what we need to do at the site, and then do everything else remote.”
Harold Silverman: “There’s a joke I’ve heard that we’re not working from home, we’re actually living at work. And I think that brings an interesting dynamic on organizational culture. If your office was traditionally 8:30 to 5:30 or 8 to 6, that’s broken down — in many ways, we are connecting at different hours at different times… it depends upon the culture of the organization, but we are hearing often it’s can be easier to catch people because their schedules are not as rigid as they were in the office or when there was an administrator to schedule their time and keep them on pace. You’re able to find them during off times and at weird times. I’m not sure if that’s a better thing or a worse thing, and I will defer to everybody’s individual judgment as to whether a longer day with more flexibility is better than shorter day where you drive into the office and home in the evening, but you could leave everything in the office when you walk out the door.”
Scott Madenburg: “With site visits, ask yourself, where is your talent? You might have folks now that are more geographically distributed who can help on those site visits. I’m also hearing about deputizing individuals to help on site visits in those remote places that you can have further reliance on.”
How can teams leverage technology to build relationships, perform more effective audit work, and provide greater levels of independent and objective assurance?
Heron Schelp: “We have the co-sourcing and the internal teams on the AuditBoard platform, and we even have access to our external auditors. Essentially we don’t have to be concerned about how to transfer tasks from internal audit to external audit, or how to make sure that they only see things that were finalized — we use the tool to manage all of that. Without AuditBoard, probably we would be sending emails or trying to put together a SharePoint site where we could upload information, download spreadsheets, and it would make it way more problematic for version control. It does help a lot that the co-sourcing partner has access to the same things as my internal team — it’s really one team.“
Harold Silverman: “It is not easy to make that business case [for automation], but I think it’s a business case that you need to make because it is the future. I’m fearful for those internal audit functions that aren’t able to make investments in RPA and advanced data analytics and visualization… they’re going to start falling farther behind not just the benchmark of other internal audit functions, but farther behind the expectations of their stakeholders because businesses are becoming more automated, data is coming in decision-making, data is coming to the users faster and faster and faster. If we’re still in sampling mode looking at the last six months and picking 30 transactions, our conclusions and our advice just isn’t going to be relevant to our internal stakeholders.”
Scott Madenburg: “If you think about the costs and the expenditure when we’re putting our plans and budgets together, travel costs add up. What we’re hearing from a lot of the companies is that with remote auditing we can reallocate that budget to technology that will make us more efficient and effective.”
Heron Shelp: “I see RPA and automation in two different ways. I see it from the business side, and how much the business has been able to leverage it. Then we as internal audit have to change our approach when we’re auditing that particular side of the business that has automated pieces of the process or their controls. We must understand how we need to change — we need to have IT skills and business skills together to be able to audit those pieces of the business effectively. On the other hand, if you look at how internal audit can leverage data analytics and RPA, how much can we automate to be more efficient and more effective in our own profession? I can run data analytics, pinpoint the outliers, and then focus on those outliers instead of taking a population of thousands of records, sampling 30 that potentially is going to drive my conclusion about the control. I think that’s where internal audit is going in the future… definitely the business side of things is running faster, and we probably need to catch up to that.”
How can internal audit talent be enhanced to provide opportunities to individuals and add more value to organizations as well as the profession as a whole?
Harold Silverman: “A high performing internal audit function doesn’t just take a great CAE or a great methodology — it takes great people. But that has always been theoretically limited to the people within an hour’s drive or on public transportation of the office. I think we’re going to see a new front in that war for talent. If we’re going to be working a lot remotely and spending less time in the field, then people don’t necessarily need to be in the same place if we have the right technologies. From an employer standpoint, it really opens up the opportunity to hire people that you have never had access to. There’s a flip side — and I think this is overall a good thing from the people perspective — all of a sudden they’re not limited. They can go almost anywhere… it’s going to be much easier to match up talent with the right jobs and vice versa.”
Harold Silverman: “The number one competency that Chief Audit Executives across North America answered would be more in demand coming out of the pandemic was communication skills — the ability to be flexible in how you communicate. Not everything can be done sitting down at a table. Being able to be more innovative, more creative in how you communicate is number one.”
Heron Schelp: “I would say that being comfortable with technology, being comfortable working remotely, meaning the ability to stay on track with stakeholders and auditees in the same way we were doing in the office, but while remote — those are the key things going forward.“
Looking for an even deeper dive into ways to future-proof internal audit? Watch the related on-demand webinar. Stay tuned for more AuditTalk videos featuring audit community leaders about industry issues, insights, and experiences!
