Boards, audit committees and senior management now want internalaudit to take on a bigger and more strategic role in helpingcompanies manage an increasing array of business risks, accordingto PwC's 2012 State of the Internal Audit Profession study. Thesurvey polled 1,530 executives from 16 industries in 64countries.

“The survey shows the trend has changed from just a few yearsago, when internal audit was limited to the finance and compliancefunction,” says Jason Pett, internal audit services leader for PwC.“At the end of the day, the work of internal audit is with keyrisks to the business. Internal audit needs to be aligned with thebusiness to make sure it is allocating time and effort to thehigh-risk areas.”

Stakeholders and chief audit executives (CAEs) say theirbusinesses now face more risks than ever before and identified 15risk areas. They want internal audit to bring its objective pointof view to focus on evaluating processes and controls in theseother areas, Pett says. The top areas where stakeholders are askingfor increased internal audit focus are data privacy and security,and regulations and government policies, according to the survey.

Risk areas that respondents said receive too little attentionfrom internal audit include: talent and labor (33%), competition(32%), new product introductions (31%), mergers and acquisitionsand joint ventures (29%), commercial market shifts (25%) and largeprogram risk (25%).

“One hundred percent of stakeholders and CAEs say internal auditneeds to spend more time, not less, on business risks,” Pett says.“What successful companies are doing is inviting internal audit toparticipate early on in strategic discussions on where the businessis moving,”

Internal audit has the ability to have a real impact if itsobjective point of view is inserted throughout the process, hesays. For instance, with M&A, internal audit can evaluate theprocesses and the control environment of the acquisition target,its Foreign Corrupt Practices Act profile and the impact of theacquisition on the overall business and culture of the acquirer.“So companies can know what they are getting before they get it,”Pett says, instead of bringing internal audit in after theacquisition to tell the organization what it bought.