Internal audit teams are expanding their work to focus more on operational and strategic risks, after having spent much of their time since Sarbanes-Oxley was enacted 10 years ago looking at financial reporting and compliance risk.
The change shows internal audit groups are responding to the evolving needs of senior executives and boards of directors, says Richard Chambers, president and CEO of the Institute of Internal Auditors. “As we’ve gone through this global economic crisis, the risk portfolios of most big companies have shifted,” Chambers says. “Today they’re dealing with operational risk more so than financial reporting risk, and the whole challenge of effective risk management itself is important for most boards and senior management.”
The shift in focus means internal audit groups are altering their recruiting to put less weight on accounting expertise and more on understanding the company’s business. “You have to know the business if you’re going to audit the business,” Chambers says. “That’s become a primary recruiting priority for chief audit executives."
Three-quarters of the executives surveyed by E&Y say the work of internal audit has a positive impact on the company’s risk management. But executives are looking for more, with 80% saying they see room for improvement in their company’s internal audit function, according to the survey.