the eight attributes: delivering internal audit excellence as

The eight attributes

Delivering internal audit excellence asstakeholders expect more

Figure 1:

Stakeholder perception of internal audit value

Source: PwC State of the Internal Audit Profession Study, 2013-2016

58%54%

48%54%

2013 2014 2015 2016

% of stakeholders reporting internal audit addssignificant value

Stakeholder expectations of Internal Audit are rising at thesame time Internal Audit’s mandate is becoming morecomplex. As expectations rise, PwC’s trend data shows thatInternal Audit has increased the value it delivers. Whilethis is a positive trend, there is room for improvement asstakeholder perception of Internal Audit performance hasremained flat.

2 PwC

The eight attributes: Delivering internal auditexcellence as stakeholders expect more

Finding your focus –keeping pace withstakeholderexpectations

Discussions with stakeholders andCAEs as well as our experiencedelivering internal audit serviceshave consistently pointed to theimportance of eight core attributes(Figure 2) shared by well-regardedinternal audit functions, regardlessof their mandate, scope of work, orsize. PwC introduced theseattributes in 2010 and our researchcontinues to tell us that there is astrong correlation betweenstakeholders’ perception of valueand internal audit’s performanceagainst these attributes.Stakeholders also shared that thehighest performing internal auditfunctions, those adding thegreatest value to theirorganizations, are not onlydelivering on their core mandateof providing assurance but areaspiring to deliver value as atrusted advisor, a conceptintroduced by PwC in 2013 andfurther explained in Figure 3.

In this paper, we provide moreinsight into these eight attributes,and how internal audit leaderscan think about their ownperformance in delivering thevalue stakeholders expect.

Figure 2:

Eight core attributes

Figure 3:

Internalaudit

Quality andinnovation

Talent model

Risk focus

Businessalignment

Stakeholdermanagement

Costoptimization

Technology

Service culture

Assuranceprovider

Assuranceprovider

Assuranceprovider

Assuranceprovider

ProblemSolver

ProblemSolver

ProblemSolver

Insightgenerator

Insightgenerator

Trustedadvisor

Providing value-added services andproactive strategic advice to thebusiness well beyond the effective andefficient execution of the audit plan

Alignexpectations

Buildcapabilities

Deliver quality

Increase value

Unrealized value

Taking a more proactive role insuggesting meaningful improvementsand risk assurance

Bringing analysis and perspective onroot causes of issues identified in auditfindings to help business units takecorrective action

Delivering objective assurance of theeffectiveness of an organizations’internal controls

84% of Internal Audit functions classified by stakeholders as Trusted Advisors report veryeffective leadership

3 PwC


Business alignment

What it meansInternal Audit has a clear understanding of the strategicdirection of the company and the expectations of itsstakeholders. It aligns its scope and resulting auditplan with the business direction in the context of theseexpectations. The function maintains alignment throughstrategic planning and coordination with other lines ofdefense. Internal Audit incorporates stakeholderexpectations into its mission and vision and clearly definesthe value it will deliver to the organization. Measurementof progress toward the mission and vision and resultingactions to align with the business are communicated. Todeliver on this attribute, Internal Audit routinely staysabreast of business goals, objectives and decisions whilekeeping a pulse on the company through its regulatoryfilings, competitor and industry information, and insightsgained through participation in strategic discussions.

How internal audit is performing

Capturing unrealized valueAlignment with the business is critical to Internal Auditachieving its mandate to serve the company. Researchreveals one-third of stakeholders who perceive theirinternal audit function as providing assurance level servicedo not feel they are performing well at this attribute. Weoften speak about internal audit leadership having a “seatat the table,” and many believe this is accomplishedthrough regular attendance in strategic meetings.However, it is what CAEs do with that seat at the tablethat changes the perception of stakeholders. Assuranceproviders often remain on the periphery of the discussion

and focus resources on auditing risks and controls relatedto initiatives once the business moves forward. From thevantage point of the stakeholder, a trusted advisortypically has a more collaborative and active seat at thetable, providing a proactive point of view on risk. Trustedadvisors are sharing insights on how to navigate the mostcritical risks as strategic decisions are made and aligningtheir talent model to address risks as they unfold.

Attributes at work

Intuit is a financial software company headquartered inthe U.S. Seven years ago Intuit’s internal audit functionwas comprised of six people. Today it has evolved into ahighly valued function five times its earlier size. InternalAudit is seen as having a very strong brand and a holisticoutlook. Team members are viewed as subject matterexperts with insights and access across the company.

During this transition, two strong professionals led theelevation of the function’s status within the organization.Initially, Internal Audit’s leader was an executive frominside Intuit, deeply knowledgeable about many facets ofIntuit’s business. This worked to position Internal Auditas a team that could help drive change and evaluatedecision options. When areas such as security, logicalaccess and large system implementations were identified,the company began turning to Internal Audit forexpertise. As the function matured and elevated in value,Intuit hired a new internal audit executive – a seasonedinternal audit professional and strong leader. Thisindividual has been instrumental in bringing ininnovative internal audit practices, and building thecurrent team and breadth of skills required. InternalAudit is now a conduit for top caliber talent joining thefunction and often going on to other management roles.This broad set of skills and ability to attract top talent,allows internal audit to more closely align with thebusiness, provide proactive advice, and add valueregardless of where risks are arising in the business.

65%

68%

67%

83%

92%

89%

2014

2015

2016

Trusted advisor Assurance provider

% of companies where Internal Audit isperforming well at business alignment

Source: PwC State of the Internal Audit Profession Study, 2013-2016Source: PwC State of the Internal Audit Study, 2014-2016

4 PwC


Risk focus

What it meansInternal Audit takes a holistic view of risks that considersinternal, external and emerging risk factors. The functionhas a thorough understanding of the company’s riskculture, the risk appetite of the business, and regulatoryand legal requirements. Internal Audit invests theappropriate time to perform a dynamic risk assessmentthat encompasses top-down, strategic perspectivesfocused on identifying the most critical risks facing thebusiness today and in the future. This strategic top-downrisk focus is often calibrated with a bottoms-up approachcentered on where risks are manifesting themselves in thebusiness today. For certain areas, such as IT risks, asecond-tier, more specific risk assessment is performed,leveraging subject matter experts to pinpoint where theserisks may materialize. In anticipation of business changesand at regular intervals, the risk assessment is refreshed tokeep the audit plan focused on the most critical andvalue added areas.


Capturing unrealized valueThe risk assessment process is not only a requirementto meet IIA standards, but foundational to how InternalAudit develops both its strategic vision and audit plan.How a risk assessment is carried out, the frequency withwhich it is updated, coordination with other lines ofdefense and the resulting audit approach can make allthe difference in the value Internal Audit delivers. Thoseinternal audit functions delivering the greatest value arecontinuously evaluating the risk profile of the organizationand anticipating changes versus reacting to them. Thesefunctions understand the various second line of defenseactivities and their respective maturities. For example,often times Internal Audit is evaluating the EnterpriseRisk Management function, adapting the internal auditplan to focus on management’s response to risks and thenrefining the plan to focus on the residual risk.

While assurance providers are focusing on risks from aninside point of view, trusted advisors are gatheringinternal and external points of view by researchingindustry trends and leveraging subject matter expertise.Trusted advisors then incorporate these factors into theiraudit plan and share the insight gained with the business,enabling the business to more proactively manage or takeadvantage of the risks. Trusted advisors do not limit theiraudit plans based on their in-house capabilities, they gooutside to find the right resources to address the risksfacing the business. Leveraging the power of dataanalytics, reporting and visualization tools, they influencebusiness decisions, and adapt audit coverage to deliver thegreatest value.53%

69%

66%

84%

93%

92%

2014

2015

2016


% of companies where Internal Audit isperforming well at risk focus


5 PwC


Stakeholder management

What it meansInternal Audit effectively understands and managesrelationships with a broad set of stakeholders.Stakeholder expectations are well understood across thefunction and communication protocols are in place. Theinternal audit strategic plan is calibrated to align withthese expectations. A shared definition of value ismeasured through one-on-one feedback sessions andsurveys allowing for timely action on feedback. InternalAudit communicates with impact, leading value-drivenconversations. An effective stakeholder management planoften enhances business alignment and elevates InternalAudit’s awareness and resulting focus on critical risks.


Capturing unrealized valueA strategically designed communication plan is at thecore of stakeholder management. Many internal auditfunctions believe they communicate well. They sharethe audit plan, hold audit kick off meetings, report outon findings and observations, follow up on resolutionof audit issues and listen to the auditees throughoutthe process. Yet, often there is limited interactionoutside of these activities, resulting in misalignmentbetween expectations and what Internal Audit isdelivering. Trusted advisors often drive accountability

across their teams by structurally aligning individual teammembers to specific stakeholders, providing clearexpectations to expand interaction beyond the audit androutinely measuring results and driving actions to improveperformance. When done well, value is delivered. Internalaudit team members enhance their understanding of thebusiness and its risks through these interactions and are inturn able to be more responsive in adapting audit plansand talent model as new risk areas emerge.

Attributes at work

At Hewlett Packard Enterprises (“HP”), InternalAudit collaborates across the business in multiple ways,maintaining alignment while still achieving objectivity.They are an active participant within the company’s RiskCouncil that convenes enterprise risk management, legaland regulatory compliance, cyber security, and globalresiliency to discuss global risk management activitiesand explore opportunities to optimize risk management.They are an advisor to the ethics and compliancecommittee and work with ERM to identify mega risksfor the company and provide input to the riskvetting process.

Many of HP’s business units have a compliance functionand sub-specialties within that such as global trade orsales operations. Internal Audit routinely interacts withthese areas to share knowledge and build awareness.Further, Internal Audit offers a certification program forthe various second line of defense functions wanting tobuild their skill sets and achieve higher levels of maturity,which enables a higher level of reliance on the workproduct and conclusions of these other assuranceproviders by Internal Audit and others and drivesimproved alignment between the various risk andcompliance functions and internal audit.

Internal Audit’s active effort to remain aligned to thebusiness and engage in strategic initiatives pays off.Stakeholders view Internal Audit as innovative andadaptive to business change. Internal Audit is seenas a valuable strategic partner that understands risksand sees issues across the enterprise and is calledupon to contribute thought leadership on navigatingrisks through many of HP’s business opportunitiesand challenges.

52%

51%

56%

78%

82%

86%

2014

2015

2016


% of companies where Internal Audit isperforming well at stakeholder management


6 PwC


Cost optimization

What it meansInternal Audit optimizes cost by delivering efficient andvalue-added services through robust, well communicatedaudit methodology and processes. Methodology isregularly evaluated, the use of analytics is embeddedthroughout, and processes are standardized and simplifiedto maximize effectiveness while optimizing cost. Flexiblestaffing models are inclusive of: internal and externalresources; various staff levels; strategically positionedresources (globally, if applicable); and specialized skillsets(such as IT and sector expertise). Processes are in place,such as time reporting, to measure productivity andcost-effectiveness of services. Investments in internalaudit infrastructure are aligned to the same metrics usedby other service functions within the business.


Capturing unrealized valueWhile the business environment and resulting riskscontinue to evolve dramatically, internal audit budgetsare not increasing at the same pace, driving internalaudit leaders to continuously do more with the same orless budget. How internal audit functions address theserealities is often indicative of where they fall on the valuespectrum. Assurance providers are cost conscious andfocused on monitoring budgets and staffing levels, limitingexpenses and taking corrective actions. Withadvancements in technology they are also looking toenable processes with better audit management systemsand adapt audit strategies to incorporate the power of dataanalytics within traditional sampling methodologies.

Those internal audit functions delivering at a higher valuelevel have been re-thinking the audit equation from riskassessment to reporting. They are honing in on residualrisk by gaining a deeper understanding of second line ofdefense activities, embedding data analytics to monitorthe more traditional risks and creating more cost-effectiveapproaches to audit more complicated risk areas byemploying flexible staffing models that more effectivelymatch the supply of specialized skills against demand.

44%

54%

52%

79%

79%

85%

2014

2015

2016


% of companies where Internal Audit isperforming well at risk focus


7 PwC


Talent model

What it means

Internal Audit possesses the appropriate mix of coreinternal audit talent, subject matter expertise, businessacumen and position parity to align to its mandate andmeet expectations of stakeholders, including regulators.The talent model is flexible, balancing the need forspecific industry and risk expertise against the likelyutilization of that expertise. The model includes theincorporation of regular training and performancefeedback to enhance the department and facilitategrowth and individual leadership development.Talent is managed to include the appropriate balanceof technical skills and softer skills such as conflictmanagement, intellectual curiosity, critical thinking,relationship development, and overall leadership.


Capturing unrealized valueThis attribute continues to receive low performancescores from stakeholders–even from those who viewInternal Audit as a trusted advisor–indicating the talentmodel within Internal Audit may not be keeping stridewith the changing risk profile of the organization it serves.With the vast majority of functions reporting that financialcontrols (95%), general information technology (90%)and compliance (89%) skills make up the core of theirdepartments, it is clear that the core skill sets haveremained relatively unchanged in the past decade.

Meanwhile, risk profiles of companies beyond controlsover financial reporting and general IT are increasing incomplexity and stakeholders’ demands for Internal Audit’sinvolvement in these areas is increasing. Those internal

audit functions that are proactively adapting their talentmodel to address this expanding risk profile are deliveringgreater value.

This is not an easy undertaking. It requires a dynamicstaffing model, which is complex to manage. In theseorganizations, rotations in Internal Audit are valued andsupported by the business leadership, beyond finance.These functions delivering the greatest value are strategicin their use of a co-sourcing partner. Internal auditfunctions delivering this higher level of value know theyhave gotten it right when the business takes clear actionsbased on their recommendations and their talent is soughtafter by stakeholders to fill business leadership needsbeyond financial reporting roles.

Attributes at work

Eli Lilly and Company is a global pharmaceuticalcompany headquartered in the U.S. In addition tocovering Sarbanes Oxley (SOX) and financial audits,Internal Audit is heavily focused on IT. Not only does thefunction require auditors to have specific IT skills, theyalso must have the global business acumen to work aspeers with stakeholders and external auditors. This iswhat the risk profile of the company demands andstakeholders expect.

The department is comprised of a mix of internally andexternally recruited talent. The largest source of internaltalent comes from the finance and IT organizations but,given Eli Lilly is highly regulated, Internal Audit alsorecruits from HR, legal, and ethics and compliance.Resources are also recruited with specific industry orregulatory knowledge such as Foreign Corrupt PracticesAct, pharmacodes or high-risk areas with health careproviders. While technical background is vital, strongcritical thinking skills and communication skills are seenas equally important.

The function is structured for 100% rotation with anaverage commitment of three to five years. Resourcesare also rotated in from the business for short-termassignments, such as to help with SOX audits, and forhelp with an audit in a specific geography. The functionis seen as an attractive career step that offersinternational travel and has a track record of developingpeople sought out by the business who are promotedupon leaving the function.

% of companies where Internal Audit isperforming well at talent management


36%

45%

40%

65%

68%

72%

2014

2015

2016


Source: PwC State of the Internal Audit Study, 2014-2016

8 PwC


Quality and Innovation

What it meansInternal Audit promotes quality and innovationthrough well-defined standards that align to overallIIA standards (and any sector specific regulatory ordomain standards). The function performs formal qualityand promotes a culture that rewards innovation andcontinuous improvement of core processes. The auditplan aligns with the company’s risk profile and changesas risks change. The form and message of internal auditreports and communications are based on facts, supportthe achievement of Internal Audit’s mission and strategicobjectives and influence stakeholders to take action.A function that consistently delivers a quality service andproduct is also focused on the strategic imperatives of thebusiness. Data analytics, reporting and visualization toolsare consistently used to deliver on the core mandateand innovate.


Capturing unrealized valueAssurance providers take purposeful action to develop andmaintain a quality program that aligns to IIA standards, toconsistently train the team, to ensure proper oversight andto monitor quality on an ongoing basis. Trusted advisorsembed innovation in the culture of the function, whetherthat is making wholesale changes to risk assessment andexecution methodologies by leveraging data visualizationtools, creating new reliance approaches across the otherlines of defense, or re-inventing reporting techniques toenhance the stakeholder experience. Trusted advisorsprovide benchmarking and points of view on the maturityof business processes and visually present audit findingsin ways that enable them to assess the business impact ofa process/control breakdown. They consistently identifyopportunities to innovate.

% of companies where Internal Audit isperforming well at quality and innovation


30%

46%

43%

73%

78%

83%

2014

2015

2016



9 PwC


Technology

What it meansInternal Audit leverages technology effectively in theexecution of the entire lifecycle of the audit process.Robust audit management systems are either interfacingwith or embedded into enterprise wide governance, riskand compliance (GRC) tools. Data analytics are designedand deployed enabling focus on the right risk areasand business issues as well as generating efficienciesthroughout the audit process. Analytics and visualizationtools are used to enhance the understanding andevaluation of risks and to identify business process andcontrol breakdowns. Continuous auditing techniques areleveraged to increase coverage or provide early warning ofrisk indicators to the business. To deliver on this attribute,the internal audit team must understand the complexitiesof their company’s systems architecture and innovate byusing technology to drive audit efficiency.


Capturing unrealized valueOur research shows that internal audit functions haveimproved their performance in the use of technology yearover year. Yet, despite this improvement, stakeholdersrate performance in this attribute lowest among the eight,which could indicate Internal Audit is not innovating atpace with technological advancements and stakeholders’expectations. For years, Internal Audit has leveragedcomputer assisted audit techniques (CAATS). Today, thesetechniques and associated tools are being outpaced byhigher functioning technology that enables Internal Auditto embed analytics and visualization throughout the auditlifecycle. New data enabling tools are integrated into auditmethodology and sometimes embedded into the auditmanagement system. This path to enhancing the useof technology is not easy and even trusted advisorsexperience resistance along the way. For example, thefirst time Internal Audit evaluates a full population ofdata and pinpoints the risks and related control failuresstakeholders are not generally enthusiastic. However, asthese roadblocks surface, strong internal audit leadershave the courage of their conviction and are able toinfluence stakeholders’ perception. They are able todemonstrate the value being delivered and areinfluencing the first and second lines of defense tobegin leveraging data themselves to enhance the overallcontrol environment and protect the company fromcontrol breakdowns.

29%

34%

29%

51%

58%

57%

2014

2015

2016


% of companies where Internal Audit is performingwell at leveraging analytics and technology


10 PwC


Service culture

What it meansInternal Audit serves its many stakeholders, whilemaintaining objectivity, by having a well-defined mandate(mission, vision and scope) and clear reporting lines. Theinternal audit team and the organization can succinctlyarticulate Internal Audit’s mandate and brand. A clientservice plan is in place that drives purposeful engagementwith the business, anticipates needs, drives timeliness andresponsiveness, and focuses on bringing valuable insightto inform business decisions. Regular feedback is solicitedfrom stakeholders, and the department measures resultsand develops improvement actions as needed.


Capturing unrealized valueWhile police/military forces serve and protect theircommunities, internal audit functions often dislike beingreferred to in this same characterization. Yet, whenInternal Audit communicates by simply providingmanagement with information about planned audits anddiscusses scope and objectives, it can feel to stakeholders abit like receiving a citation. The best service cultureoriented functions go beyond this, by anticipatingstakeholder needs, and exhibiting broad business

awareness and unrelenting focus on getting to the rootcause of issues. Internal audit functions delivering at thishigher level are also active contributors in executivesessions and board meeting on matters beyond theirimmediate mandate because they have proactivelypositioned and educated themselves to have a point ofview beyond today’s risks and controls.

Internal audit taking action & howPwC can helpThrough our research, we have gained tremendous insighton collective stakeholder expectations, we know that theexpectations of each individual organization’sstakeholders vary dramatically. Consistent themes haveemerged around those internal audit functions perceivedas delivering great value: they proactively set a vision forhow Internal Audit can deliver, they have the courage toget stakeholders aligned and they possess the courage tostay the course for the good of the company - even duringthis time of significant change. And, while trusted advisorsconsistently receive higher performance ratings in oursurveys than those performing at the assurance providerlevel, we encourage internal audit leaders to gain a deeperunderstanding of stakeholder expectations andperformance along the eight attributes before they takeaction. For some functions, understanding stakeholderexpectations and perceived performance may result in aneed to enhance their stakeholder management programby raising brand awareness, educating stakeholders onmandate, and improving risk focus and currentcapabilities. Other functions may identify the need to aligntheir risk focus to the business, invest in underlying auditprocesses, enable the function with better technology andenhance their overall talent model. Bypassing thisimportant step may result in over or under investing in thejourney ahead.

As Chief Audit Executives chart their course to enhancingthe eight attributes of effective Internal Audit andcapturing unrealized value, PwC can be of assistance.Organizations may benefit from performing an ExternalStrategic Assessment leveraging PwC’s proprietary Profilertool or from a variety of Internal Audit services. To learnmore about how we can enhance your journey visitwww.pwc.com/internalaudit.

% of companies where Internal Audit isperforming well at demonstrating aservice culture


51%

54%

55%

75%

83%

87%

2014

2015

2016



11 PwC

High performance crosses many company demographics

Oftentimes it is easier to see how high performance in each attribute can be accomplished in large organizationswith significant internal audit resource. However, for each year that PwC has tracked performance on the eightattributes those internal audit functions delivering the most significant value and achieving the highestperformance ratings represent a variety of department sizes.

An analysis of the top 5% of internal audit functions (as determined by their company managing risks very welland their functions being highly valued by stakeholders) showed this group was diverse in company size,geography and industry. The top 5% also outperformed others on each of the eight attributes. Thus, regardless ofthe company or composition of Internal Audit, high performance in the eight attributes is both necessaryand achievable.

Demographics of the top performing 5% of internal audit functions

Company size Headquarters location

Subject to Sarbanes Oxley Private vs. public companies

0% 5% 10% 15% 20%

< $500 million

$500 million-$1 billion

$1-1.9 billion

$2-4.9 billion

$5-9.9 billion

$10-19.9 billion

$20-49.9 billion

$50 billion or more

0% 20% 40% 60% 80%

Canada

U.K.

South Africa

U.S.

Othercountries

Yes 69%

No 31%

Private20%

Public 80%

© 2016 PwC. All rights reserved. PwC refers to the US member firm or one of its subsidiaries or affiliates, and may sometimes refer to the PwC network.Each member firm is a separate legal entity. Please see www.pwc.com/structure for further details.

To have a deeper conversation about how this subject may affect your business, contact:

Jason PettPartnerUS Internal Audit Solutions Leader+1 410 659 3380

[email protected]

Rachael PersonPartnerInternal Audit Solutions+1 646 471 1349

[email protected]

Michelle HubblePartnerUS Internal Audit SolutionsCenter of Excellence Leader+1 309 680 [email protected]

Victoria WagonerDirectorInternal Audit Solutions+1 816 223 7789

[email protected]

the eight attributes: delivering internal audit excellence as

Documents