Page 18 - Internal Auditor M.E. (English) - June 2018

conversations with colleagues TO cOMMenT on the article,
eMail the author at farah.araj@gmail.com

the questions which need to be asked by the auditors in formal access to the right people and reports. This is a way to Is the next evolution © 2015 EYGM Limited. All Rights Reserved. ED None
the course of audits. The machine is then used as much as keep up to date and if you’re not able to get access then such
possible to collect possible answers but it is again the Human an issue would need to be escalated. The second dimension of big data, big
who decides about the quality of answers. relates to having a seat at the table. This is where many CAEs
How does the mandate of the internal audit function impact struggle and I would attribute it largely to management’s judgment?
the value that it delivers to stakeholder? For instance perception of internal audit. This perception comes about
may functions still have a SOX only or compliance only when internal audit has not been able to demonstrate that it
mandate. While understanding your market, identifying
understands the business or does not discuss topics that are
The mandate of the internal audit function to give applicable to management’s agenda. The more value internal opportunities and assessing risks are the basics
independent assessments and to be the third line of defense audit demonstrates the more likely the CAE has a seat at the of business performance. Analytics is the key to
is fundamental and will not change, however it is what table. With increased value you get increased acceptance unlocking the future potential and transforming
internal audit looks at that is changing. What internal audit of the function and hence you get more budget and more the way decisions are being made.
departments look at drives their perception and value. This is authority.
partly due to the mandate and partly due to capabilities of the I would recommend that CAEs start with 1 to 1 meetings with ey.com/mena
internal audit team. High performing internal audit functions key stakeholders, use the Audit Committee and CEO to set the
are like fine German cars while other departments look more right tone and push for the appropriate access. The onus then
like wagons. There is also the scenario of German cars being falls on the CAE to listen, adapt the audit plan and add value Raise the Red Flag - English
used like wagons and that would be the result of the limited accordingly. The harsh reality is that if you as a CAE are not
mandate. Some stakeholders don’t really care about the full able to get that seat at the table after persistent tries, then it
potential of an internal audit function and focus internal would be wise to consider alternative employment as you will
audit’s efforts mainly on ICOFR or compliance. This is short not be successful in the long term.
sighted thinking by stakeholders: they must look to build the Finally, how can CAEs know whether they are adding
internal audit function an organization really needs rather strategic value to the business?
than the internal audit function they want to have. There
is a role for the CAE to educate stakeholders about the full The most important metric to measure this is whether the
potential of internal audit and the horsepower it has under its CAE receives requests from management asking for internal
hood! CAEs need to invest in new ways of working and show audit support to provide advisory or even assurance services.
innovative results. These would come not just from the second line but also from
a broad spectrum of senior operational leaders. Similarly,
Some CAEs may be in a sort of Catch-22 situation: they don’t consider whether the business calls you and consults with
have the right resources to add value so they are unable to you. This is critical as it goes back to my point on having
add value and when they ask for resources they don’t get experienced auditors with industry experience.
them because they are not adding value! The CAE, through
education or innovation, needs to break out of this box and Another approach is to just go and ask your stakeholders if
present a different value proposition. Find out what others are you’re adding strategic value. They should be senior enough
doing and educate stakeholders to remain relevant. Get buy in to give you honest feedback. Also, I’d say take a step back and
look at what is important to the organization and then look
for a proof of concept for analytics or for a high value audit. at what you’re doing as an internal audit function. If they are
Doing nothing leaves the CAE at risk as one day a new and aligned then you’re probably adding value!
more forward thinking Audit Committee may come on board
and then the CAE will be viewed as someone who is out of If I have to leave your readers with a couple of parting
touch with modern times. thoughts, they would be:
Many CAEs struggle to stay close to the business and keep • Address risks and topics beyond today’s scope (including
up to date with all the changes and initiatives happening digital risks); and
across the company. What advice do you have for them?
• Focus on becoming an agent of positive change within your
There are two dimensions to this. The first relates to getting organization.
The better the question. The better the answer.
16 INTERNAL AUDITOR - MIDDLE EAST JUNE 2018
The better the world works. INTERNAL AUDITOR - MIDDLE EAST 15
APRIL 2016