E-Business: An Internal Audit Dilemma? - Brief Article

Internal Auditor, August, 2000 by Sean Ballington, Anthony Tortorice

THE GLOBAL RISK INSIGHT SERIES

Today, companies all across the business spectrum and the world are eagerly embracing electronic commerce. Many of the business models that were developed for brick-and-mortar environments - where the pace of commerce was slower and the rate of change more manageable - no longer apply. Accordingly, e-business initiatives that do not recognize the changing terrain will fail, because they will be unable to accommodate the demands of e-commerce.

To address this challenge, PricewaterhouseCoopers, with the assistance of Carnegie Mellon University, has developed the E-Business Maturity Model (EMM@[TM]). EMM@[TM] helps organizations in two key ways: first, to understand how well the organization has adopted - or can adapt to - e-business, and second, to identify ways to enhance e-business capabilities. The model is designed to cover the entire e-business life cycle and provides both management and internal audit with a valuable assessment and design tool.

A Changing Landscape: Auditing Beyond Brick and Mortar

Doing business on the web differs radically from doing business in the traditional marketplace. The velocity of change on the Internet - which can be thought of as speed times mass - is far faster than change in the brick-and-mortar business world. Businesses must respond to new challenges, introduce new products and anticipate new market developments with unprecedented speed.

In addition, e-business initiatives are often much broader in scope than conventional business projects. Today, it is not unusual for companies to have dozens - if not hundreds - of e-business initiatives being implemented simultaneously. So how does internal audit know where to focus and be of value?

Audit Success in a Connected World

In this new landscape, a conventional approach to internal auditing is unlikely to provide sufficient assurance at the required speed. What's more, internal audit may be perceived as negative, counter-productive and constraining to the success of the e-business initiative. If internal audit is to add value in the e-business world, new approaches are required.

E-business does not alter internal audit's basic risk management and assurance objectives. However, the nature and complexity of conducting business in the connected environment mandate that internal audit address a wider range of business, and do so with greater speed. In fact, the assurance role of internal audit is actually becoming more important.

To deliver value, internal audit must understand how e-business is radically changing traditional business models and how these new business models should be applied throughout a company's e-business life cycle. Effective implementation of new business models will be the foundation for the future success of companies - and the internal audit function - in the e-business world.

The E-Business Maturity Model - EMM@[TM]

PricewaterhouseCoopers developed the E-Business Maturity Model based on its extensive experience with business models. In addition, we designed EMM@[TM] with a firm understanding of risk management in an e-business world.

EMM@[TM] helps business managers and internal auditors comprehend the entire e-business project and business' e-business maturity cycle from conception to completion.

As a result, EMM@ [TM] enables companies to get a better understanding of issues such as maturity projections and strategic choices.

The model defines five levels of e-business maturity in an organization reflecting that - from a risk and control perspective - different levels of control are required at different stages of an e-business life cycle.

Specifically, EMM@ [TM] addresses nine e-business domains:

* Security

* Legal

* Tax

* Delivery and Operations

* Systems and Technology

* Performance Management

* Processes

* Organizations and Competencies

* Strategy

Each of the model's domains specifies the critical business issues that occur within that domain. The model then offers over a thousand good practice recommendations that address business issues within each domain.

With these capabilities, EMM@ [TM] improves the ability of internal audit and corporate management to:

* Identify how well an e-business is performing from a risk perspective and identify current business issues that need to be addressed.

* identify and help address business issues associated with the roll-out of an e-business strategy.

* Assess an organization's current state of e-business adaptability against that of the industry as a whole.

Conclusion

The scope and velocity of change in the e-business world require companies to adopt new business models to ensure the success of all of their e-business projects. Internal audit must adjust its approach if it is to remain relevant and continue to deliver value.

The basic objectives of internal audit - risk management and assurance - remain unchanged. Risks cannot simply be ignored due to the velocity of change inherent in e-business. Successful internal audit will demand a deep understanding of e-business models and how risks change as an e-business project comes to full maturity. Internal audit will require the same knowledge and technologies that are re-inventing business.