Audit committees focus on operational risk: FBI targets corporate corruption banking group proposes self-regulation for risks management transparency linked to ethical workforce financial restatements increase sharply

Internal Auditor, June, 2008 by T. McCollum

AUDIT COMMITTEES ARE EXPECTING INTERNAL AUDIT departments to make strategic, operational, and business risk a higher priority as demands of compliance with the U.S. Sarbanes-Oxley Act of 2002 have eased in the past year, according to the 2008 State of the Internal Audit Profession Study by PricewaterhouseCoopers (PwC) LLP. The survey of 674 internal auditors notes that strategic, business, and operational factors contributed to rapid shareholder losses in more than 80 percent of cases involving large companies in recent market studies. Despite these findings, 87 percent of Fortune 500 respondents and 79 percent of other respondents spend less than 20 percent of their resources on audits that are not related to financial compliance.

[ILLUSTRATION OMITTED]

The report's author, Dennis Bartolucci, U.S. leader of PwC's Advisory practice in Chicago, says many audit committees are becoming more concerned with operational risks, such as risks in a company's supply chain--highlighted by product safety recalls in the pharmaceutical and toy industries, among others. "Audit committees are starting to ask internal auditing to express its perspective on what the company is doing with enterprise risk management--and what internal auditing is doing in this area," he says. "They are asking internal auditing, 'Is our company doing the right thing? Is it doing enough?'"

The survey findings reflect this changing focus. Sixty-three percent of respondents consider operational risk to be significantly important to audit committees, although only 52 percent say providing assurance on the effectiveness of the company's risk management processes is significantly important to audit committees. Nearly 60 percent of respondents have implemented a risk assessment process that updates the company's risk universe annually and elicits stakeholder input on key risks.

Another sign that internal auditors are changing their focus is that fewer respondents (27 percent) dedicate half or more of their internal audit resources to Sarbanes-Oxley Section 404 compliance, compared to 4I percent in PwC's 2007 survey. Respondents attribute the decreased compliance focus to efficiency gains and adopting the top-down, risk-based approach to evaluating internal controls over financial reporting that is specified by the U.S. Public Company Accounting Oversight Board's (PCAOB's) Auditing Standard No. 5 (AS5).

However, insufficient audit skills may hinder efforts to focus on operational risks, as many internal auditors who joined the profession in recent years have only worked on Sarbanes-Oxley projects. Seventy-four percent of respondents say the lack of skills necessary to deliver appropriate audit coverage is a medium-to-high risk. Respondents say analytical skills and risk management and assessment skills are their highest priority.

Lengthy audit cycles are another audit concern, with nearly 80 percent reporting that their average cycle time is three months or more per audit. Factors contributing to long audit cycles include excessively broad audit scopes, inadequate risk assessments, inefficient methodologies, ineffective communications with stakeholders, and delays in writing the draft report.

Baitolucci says internal audit departments must improve their skills and efficiency to meet the audit committee's changing demands. Moreover, chief audit executives must take a more strategic approach to risk and the audit department's mission. "That means having a good understanding of the challenges and risks the organization faces and a reasonable plan for how the audit function can add value," he says.

The PwC State of the Internal Audit Profession Study is available from www.pwc.com.