A new reality for internal audit A new reality for internal audit A new reality for internal audit

From our early and tentative responses to COVID-19, we moved to rapid closure of borders, significant organisational and operating model change, and mass societal hibernation. Organisations and their internal auditors were asked to adapt and change at unprecedented pace.

Looking forward, we now have the opportunity to harness lessons learnt and retain legacy benefits from COVID-19 to position ourselves for the future. This article considers our long-term predictions for internal audit functions in the ‘new normal’, while contemplating areas for internal audit professionals to consider in the near future, to continue providing value to organisations.

COVID-19 has disrupted internal audit significantly – both how we execute our work, as well as the type of work we have been asked to perform. Organisations are asking internal audit to leverage this disruption, to support the move to a more resilient and innovative future operating model.

We make four predictions for internal audit, to recognise and retain the positive shifts from COVID-19 disruption.

In Mike Jacka’s recent blog post for the IIA, he mused that we’ve been interested in, but struggling with, the issues of data, analytics, and technology for over a quarter of a century.

COVID-19 forced the rapid uptake and implementation of critical controls monitoring by many internal audit functions – underpinned and enabled by repeated and remote data analytics. This provides the required momentum for internal audit to continue driving data analytics.

Gone are the days of beautifully crafted, long and time-consuming internal audit reports. These have thankfully been replaced with targeted planning, shorter, sharper internal audit reviews and increased collaboration with auditees. Examples of these continued changes include the following:

• greater implementation of agile internal audit approaches
• shorter cycles for internal audit planning/regular refresh and challenge, rather than an annual ‘set and forget’ internal audit plan
• concise and timely reporting of observations.
   

Throughout COVID-19, we’ve seen internal audit provide timely and valued assistance to their organisations, beyond the scope of their annual internal audit plan. Internal audit functions will likely continue to be called upon to provide proactive assistance to organisations, in an ‘Advisor’ capacity. This may include the following:

• providing assurance not only to the Audit Committee, but also advice to the first and second line on appropriate control designs to respond to rapid risk changes
• continuing responding to and assisting the organisation (while maintaining independence!). COVID has demonstrated the ability for internal audit to do much more for our organisations, without impeding independence.
  

Internal audit has demonstrated its ability to adapt quickly to new technologies. Technology will become a core skillset for auditing as we see organisations embrace automation and technology solutions even more than they had pre-COVID-19. The following should be considered.

• Use of bots as part of the internal audit workforce, delivering repeatable tasks to free up capacity to focus on more strategic reviews.
• Continuous remote monitoring, enabled by data analytics systems and automated routines.
• Greater use of visualisation and dashboarding tools.
• Uptake of process data mining, to provide visual analysis of processes and variations.

It's important that we innovate and prepare for the new world for internal audit, post COVID-19 – harnessing the benefits from recent changes and using these as a platform for transformation. However, internal audit still needs to support near-term business priorities providing critical assistance during organisational response and recovery.

Internal audit should continue to provide timely and meaningful support, as it has for the last couple of months.

Practical areas for internal audit to add value as organisations look forward include the following.

• Readiness to return: Ensuring processes to support a staged return to work, including appropriateness of policies and procedures to ensure the safety of people, management of premises and sadly, of potential future confirmed COVID-19 cases.
• Business continuity and crisis management: Work with the business to ensure lessons learnt are identified, documented and established into future plans.
• Check and challenge new process design: To ensure adequate consideration of new and changing risks, and review, rationalisation and normalisation of procedures developed during the initial response.
• Compliance monitoring: Implement additional monitoring to support ongoing compliance with Government Safework requirements and COVID Safe plans, together with adherence to government grant and stimulus requirements (i.e. Jobkeeper).