Maximising internal audit value

Transcription

1 Maximising internal audit value 2013 State of the internal audit profession survey Russia supplement April 2013

2 Introduction For 9 years PwC has conducted a global survey of the State of the internal audit profession and for the past 3 we have produced a Russian supplement. This document presents key findings of our Russian respondents against the background their global peers. In many ways Russian organizations face the same challenges around internal audit as their global peers: Natalie Danilkina Director, Internal Audit Leader in PwC Russia - Management and audit committee members are not fully aligned on their expectations of internal audit, and may be settling for too little - Internal audit departments often lack sufficient capabilities, staff skills and resources to deliver value in an ever-changing risk landscape - Internal audit continues to struggle to maximise the impact of its contribution, particularly in areas outside its traditional focus However, these challenges are greatly magnified in the context of Russian business culture - Lack of constructive engagement with board and audit committees in the context of a developing corporate governance environment - Lack of established company wide risk management framework in which to operate - Lack of use of internal audit software to make work more efficient, or data analytic tools to make work more effective - Severe shortages of staff with requisite skills, and low levels of professional qualification The best Russian internal audit departments operating within organizations committed to sound corporate governance practices are leading a period of progressive development of the Russian profession. PwC Russia s goal with this publication and related thought leadership, multiple monthly external events, and outstanding, innovative client service is to promote the development of the profession in Russia and bring value to the companies we serve and the country we work in. 1

3 Contents 1. Alignment 1.1 Risk based internal audit planning 1.2 Communication 3 2. Capabilities 2.1 Use of Information Technology 2.2 Data analytics 2.3 Methodology and professional qualifications 7 3. Contribution 3.1 Where internal audit budgets are going 3.2 Value added by internal audit The opportunity 4.1 Delivering value across a spectrum of approaches 4.2 Areas of frequent disagreement 4.3 Benchmark tool Participants 18 Our Team 20 2

4 Alignment Global view Key stakeholders are not aligned in their view of what internal audit should be focused on and what value they expect from it. In particular 79% of board members see significant value from internal audit but only 44% of management. Management want more value! 1 3

5 Russian Perspective 1.1 Risk based internal audit planning The best way to ensure alignment with stakeholders around internal audit planning is to have an agreed company-wide approach to risk assessment. We asked, do you have a robust framework for delivering quality and risk focused services? Nearly 40% of the survey participants update their risk assessment and plan twice a year. The majority of the other functions update annually. 85% of the Heads of Internal audits that responded to this question prepare a risk focused annual plan that is based on a documented assessment of key business risks. This is comparable with the level reported in the IIA s 2011 survey for Russia. Russia: Frequency for updating your risk focused IA plan (DNP = Data not provided) DNP When necessary Monthly Quarterly Bi annually Annually 0% 20% 40% The challenge for many Russian heads of internal audit is that there is no common approach by management to risk identification and measurement. So, even if internal audit prepares its own risk assessment, it does so without real buy-in from management. Global: Frequency for updating your risk focused IA plan Although most of our Russian respondents say they prepare a risk based plan and update it regularly, the question is to what extent management is actively engaged in this process. Do the key stakeholders of your Internal Audit function share the same assessment of critical risks? 4

6 Russian Perspective 1.2 Communication Alignment depends on regular, quality conversations with key stakeholders. We asked how often do you communicate with your board and audit committee? a) Audit Committee communications Of those Heads of Internal Audit ( Heads of Internal audit ) who responded just 64% meet their Audit Committee Chair on a quarterly basis, and most of the remainder meet less often. This is noticeably less than global peers, where around 19% meet as often as monthly with their Audit Committee chair. However, all Heads of Internal audits from Financial Services or listed companies who participated meet their Audit Committee chairman every quarter Russia: Frequency Heads of Internal audit meets with Audit Committee Chair (DNP = Data not provided) Global: Frequency Heads of Internal audit meets with Audit Committee Chair DNP Other - only No meeting Annually Quarterly Monthly Weekly 0% 20% 40% 60% Do you have enough contact with, and support from, your Audit Committee Chair? 5

7 Russian Perspective 1.2 Communication Alignment depends on regular, quality conversations with key stakeholders. We asked how often do you communicate with your board and audit committee? b) Communication with executive management Of Heads of Internal audits who responded to this question, 64% meet their CEO, CFO or other administrative management on a weekly basis. This is more common for organisations from the FS sector. 81% of Heads of Internal audits (including all of those from the FS sector) actively participate in their company's executive management team meetings. Russia: Frequency Heads of Internal audit meets with executive management (DNP = Data not provided) Global: Frequency Heads of Internal audit meets with executive management DNP Other - only No meeting Annually Quarterly Monthly Weekly 0% 50% 100% Russia: Heads of Internal audit actively participates in Executive Management team meetings Global: Heads of Internal audit actively participates in Executive Management team meetings 19% 1% Don't know 41% No 81% Yes 58% 0% Not answered Yes International benchmarks indicate that Heads of Internal audit s are meeting their Audit Committee chairs more frequently than in Russia, typically more than 5 times per year 6

8 Capabilities Global view Three aspects of internal audit performance showed the greatest opportunity for improvement: Leveraging technology e.g. audit software & advanced data analytics Obtaining, training and sourcing the right talent to match the organization s risk profile Promoting quality improvement and innovation 2 7

9 Russian Perspective 2.1 Use of Information Technology We asked, do you use technology to increase the effectiveness & efficiency of your IA activities? Automated internal audit software Russia: Use of automated audit software by the IA function Of all participants that responded to this question only 43% are using automated audit software. This is: a) Comparable with the level reported in the 2011 IIA survey for Russia; but 57% 43% Yes No b) Lower than 2012 international benchmarks, where approximately 60% of functions are using automated software. As Russian businesses grow in size and complexity, audit issues become correspondingly more, and more complex. Global: Use of automated audit software by the IA function To be efficient an internal audit function needs to discuss and agree details thoroughly with line management, and still report promptly at various levels up all the way up to board level. Drafting and redrafting numerous versions of the same issue depending on the audience can consume a large part of IA dept time without adding value. Finding ways to make the recording and reporting process more efficient is key to the effectiveness of Russian IA departments. The relative lack of use of internal audit software marks the Russian profession apart from its global peers. 8

10 Russian Perspective 2.2 Data analytics We asked, do you use data analytics a) 86% told us they are using data analytics to some extent; b) 57% said they are using data analytics on all or most of their audit engagements; c) Use of data analytics does not appear to be impacted by the size of the company or IA function, industry sector or listing; and d) The majority (i.e. 79%) told us have plans to expand the use of data analytics. However, most have not developed a clear and formal implementation plan. Russia: Extent of use of data analytics by IA functions in Russia (DNP = Data not provided) Global: Extent of use of data analytics by IA functions in Russia DNP Not used or benefits not achieved Used on some specific audits Used on majority of audits Integrated and used on all audits 0% 20% 40% Russia: Future plan for use of data analytics by IA functions in Russia (DNP = Data not provided) Global: Future plan for use of data analytics by IA functions in Russia DNP No Yes - plan under development Yes - formal plan exists 0% 10% 20% 30% 40% 50% 60% Globally, data analytics are widely viewed as important, yet few are using analytics regularly for instance only 31% of IA departments use data analytics regularly. From their responses Russian Heads of Internal audits use data analytics more than their global counterparts. Are our Russian results a perception or a reality? 9

11 Russian Perspective 2.3 Methodology and professional qualifications We asked, do you have a formally documented internal audit methodology and apply international quality standards? 86% of the Heads of Internal audits that responded to this question use both the IIA Standards and documented policies, procedures and methodologies to drive the quality and consistency of their IA activities. Russia: Obtained an external quality assessment of the IA function as part of a continuous improvement program However, less than 30% have obtained an external quality assessment of their function s actual level of compliance with IIA Standards and its alignment with stakeholder quality and service expectations (note: the global benchmark of 64% is significantly higher) 71% 29% Yes No c) And, do your staff hold professional qualifications? On average, 20 to 29% of the IA staff of the survey participants hold professional qualifications such as CIA, ACCA and CIMA. This level has increased in comparison with the 2011 IIA Survey. However, it is significantly lower than the 2012 international benchmark of 71% of IA resources holding professional qualifications. Russia: Obtained an external quality assessment of the IA function as part of a continuous improvement program NDP DNP Less than 5% of IA team Between 5 and 9% Between 10 and 19% Between 20 and 29% Between 30 and 50% More than 50% 0% 10% 20% 30% 40% 50% The number of internal auditors in Russia with professional qualifications is significantly below international benchmarks. Do your key stakeholders support your efforts to continuously improve your internal audit activities and increase the level of professional qualifications of your staff? 10

12 Contribution Global view As companies improve their own performance to contend with an ever-changing risk landscape, internal audit is under increasing pressure to keep pace. Less than 50% of management saw internal audit performing well on the eight core attributes fundamental to any internal audit function. 3 11

13 Russian Perspective 3.1 Where internal audit budgets are going We asked what are the plans for 2013 internal audit budget? In comparison with 2012, Heads of Internal audits, on average, expect their financial budgets to increase in 2013, typically by 6 to 10%. This reconfirms the trend in our 2011 IIA Survey where the majority of participants indicated their budget was increasing year on year. These results are broadly in line with global trends see comparison below. Russia: Obtained an external quality assessment of the IA function as part of a continuous improvement program (DNP = Data not provided) NDP DNP Decrease > 20% Decrease 11 to 20% Decrease 6 to 10% Decrease 1 to 5% No change Increase 1 to 5% Increase 6 to 10% Increase 11 to 20% Increase > 20% Global: How do you think your 2013 budget for internal audit will be different from 2012 s budget? It will experience 0% 20% 40% Are your stakeholders supporting increased investment into those areas of greatest internal audit need: a) leveraging technology eg audit software & advanced data analytics b) obtaining, training and sourcing the right talent to match the organization s risk profile c) promoting quality improvement and innovation 12

14 Russian Perspective 3.2 Value added by internal audit The big question is, what value is added for that cost? We asked: Where does your IA function add most value, and where can you add more value? a) Performance what is going well Based on the feedback received Heads of Internal audits, IA functions are performing well and adding most value in the following 3 areas: a) Investing into relationships with their stakeholders; b) Focusing on their company s critical risks; and c) Promoting quality improvement and innovation. This is an interesting result because these are the three areas of greatest weakness among global peers according to our survey. Are Heads of Internal audit perceptions of their performance in line with those of their stakeholders? b) Performance what needs to be improved In contrast Heads of Internal audit s identified the following areas for improving their performance: a) Delivering activities with a greater service focus; b) Leveraging technology to improve operational effectiveness and efficiency; c) Obtaining training and / or sourcing the right talent for IA needs. These are key areas which are consistently a challenge for Russian internal audit teams: Developing more of a problem solving culture among the team Leveraging technology to make the administration of audits efficient, and audit work itself dramatically more focused and effective Shortage of staff, and urgent need for training at all levels: not just one off courses, but more importantly on the job training by experienced professionals. As head of internal audit are challenging yourself and your team enough to create more value for your organisations? 13

15 The Opportunity Global view We have summarised our global findings into a simple map showing the way forward for internal audit. Locally, we have expanded this to include an extra dimension for Russia. Cultural barrier Unrealized value Assurance provider Problem solver Assurance provider Insight generator Problem solver Assurance provider Trusted advisor Insight generator Problem solver Assurance provider The survey data showed that when stakeholders indicated they viewed internal audit as providing significant value, there was a different level of service being provided Revisia Revisia Revisia Revisia Revisia Cataloguing list of exceptions Objective assurance Enterprise risk coordination Incremental value contributed Proactive advice 4 Business partner 14

16 Russian Perspective 4.1 Delivering value across a spectrum of approaches Just as with their global peers, internal audit functions in Russia cover a spectrum of value delivery. Unlike their global peers, internal audit functions in Russia have started from a different level from international practice and have first to overcome a significant cultural barrier, as shown in the previous table. This cultural barrier has been inherited from Soviet times where there was a more narrowly defined tradition of internal audit referred to as Revisia. We have identified 8 core elements of Revisia set out on the following page which are effectively a counterpart to the 8 core attributes that are the necessary foundation of any international internal audit function. Many Russian internal auditors do not start from a blank page when they learn about international standards. Their strongly held conviction in the tradition of Revisia is a challenge to their understanding and application of international best practice. Our global survey showed that when stakeholders indicated they viewed internal audit performance as strong, there was a qualitatively different, broader, level of service being provided. 15

17 Russian Perspective 4.2 From our experience there are 8 areas of frequent disagreement between the Soviet tradition of Revisia and International Internal Audit best practice 1. The purpose of internal audit is to identify instances of fraud and breaches of policy through detailed substantive testing so offenders can be punished It is not the role of internal audit to test key controls so that processes can be made more efficient 2. It is not the role of an internal auditor to use judgement Extrapolation is to stray from the principle of sticking to facts. Prioritisation is the task of the superior body to whom auditors report. Filtering results risks appearing to be collaborating with the accused to hide facts from that superior body. An internal audit report should be an unfiltered, unprioritized catalogue of breaches, report length being the key performance indicator of the effectiveness of internal audit s work 3. Materiality is not a relevant concept for internal audit All breaches are equally potentially serious 4. Future risk is not a fact and so not a subject for internal audit Internal audit should limit its scope to examining historical documentary evidence, or current performance In particular a) they must not recruit from, nor supply to, the general pool of their organisation s staff b) they should not collaborate with auditees in any way, for instance in problem solving 6.It is not the role of internal audit to provide consultancy Consultancy implies a) unprofessionally close relationship with management b) exercise of judgment c) concern for future risk d) extrapolating from facts - each of which are breaches of internal audit discipline 7. It is not the role of internal audit to provide assurance International internal audit practice operates within a climate of corporate trust of its staff providing assurance that that trust continues to be justified. Russian internal audit practice operates within a climate of corporate distrust of its staff and serves to provide evidence why such distrust continues to be justified. 8. International auditing standards are not relevant to Russia Because of Russian specifics which western auditors do not understand 5. Internal auditors must be independent In this context it is not surprising that the practice of internal audit co-sourcing with external firms, common practice throughout developed economies, scarcely exists in Russia today. 16

18 Russian Perspective 4.3 Benchmark tool Use the following aide to compare your Internal Audit function against Russian and international benchmarks and see where it can add further value. Area Your Company PwC survey benchmark IIA GAIN 2012 global benchmark 1. Alignment 1.1 Prepare a risk focused annual audit plan, that is based 85% (Yes) 92% (Yes) on a documented business risk assessment 1.12 Frequency for updating audit plan Annually 77% Annually 4% Bi annual 16% Quarterly or more frequently 1.2 Heads of Internal audit participates in Executive 81% (Yes) no data Management meetings Potential Top 3 actions you will areas for take in 2013 to increase adding more the value delivered by value from your IA function IA Action 1: 2. Capabilities 2.1. Use automated audit software and electronic working 57% (No) 59 % (Yes) papers 2.2 Use of data analytics to perform IA activities Use on majority of 61% (Regularly use) audits 2.21 Plan to expand the use of data analytics in the future 79% (Yes) no data 2.3 Use IIA professional standards to guide their IA 86% (Yes) no data activities 2.31 Have documented policies, procedures and 86% (Yes) no data methodology for the IA function 2.32 Have obtained an external quality assessment of the IA function as part of a continuous improvement program 30% (Yes) 64% (Yes) Action 2: 3. Contribution 3.1 Cost: expected change in IA financial budget in 2013 (in comparison with 2012) Increase by 6-10% Action 3: 3.2 Value added 3.21 Top 3 areas where IA is performing well and delivering 1. the most value Investing into relationships with stakeholders 2. Focusing on their company's critical risks 3.Promoting quality improvement and innovation no data 3.22 Top 3 areas for IA to focus on to improve performance and deliver greater value Delivering activities with a greater service orientation focus 2.Leveraging technology to improve operational effectiveness and efficiency 3.Obtaining training and / or sourcing the right talent for Ian needs no data Action 4: 4. Opportunity 4.1 Have you considered obtaining a proposal from an external internal audit provider for cosourcing Action 5: 17

19 Participants 5 18

20 Russia perspective Participants This report presents the results of PwC global survey in which Russian commercial companies participated during the months of November and December The goal of the survey is to help participants and stakeholders assess the state of their internal audit function and the value it delivers within their company relative to other companies. Responses to the survey were primarily provided by Heads of Internal Audit functions. Analysis of Survey Participants a) Industry sector Participants from all PwC industry sectors 25% 6% 31% 38% EUM FS CIPS TICE (Energy, Utilities & Mining) (Financial Services) (Consumer & Industrial Products & Services) Technology, Information, Communications & Entertainment) b) Annual revenue Participants from large and small organisations in Russia > 50 bn $ bn $ bn $ 5-9.9bn $ 1-4.9bn < $ 1 bn 0% 10% 20% 30% 40% c) Stock exchange listing 50% of the Survey Participants are listed on the Russian Stock Exchange; and 31% are listed on an international stock exchange (i.e. US or UK) 19

21 Our Team Our survey indicates a general shortage of skilled internal audit staff throughout Russia while heads of internal audit are under pressure to deliver more value by applying modern auditing techniques and technology At the same time PwC Russia has a dedicated team of more than 100 risk assurance professionals, of whom 30 are dedicated internal audit specialists. They are capable of carrying out a range of services, from individual assignments to full scale, multiyear co-sourcing engagements. We believe our internal audit professionals have the skills and capability to help your internal audit function respond to the challenges they are facing. We believe the best way of doing this is through cosourcing where our team works side by side with your internal audit team plan and execute internal audit engagements. Cost of cosourcing It is universally assumed in Russia that external providers of internal audit services are much more expensive than internal and will have no clue about the company they audit. However few, if any Russian companies, take the time to test this assumption. When companies look at the cost of internal audit function they generally ignore related costs such as payroll taxes, overhead, cost of equipment and office space etc. They also ignore inefficiencies such as staff turnover and recruitment cost, holidays, sickness, training time and expense, internal administration and general down time. Finally they ignore the much bigger cost of management time taken to deal with audit and follow up of immaterial or poorly understood issues. When it comes to potential value added few companies are even aware of the service they could get but currently don t get. The most efficient way to test this assumption is to invite a proposal for cosourcing services. Benefits of cosourcing Working with internal audit teams and management to develop a common assessment of risks from which to derive an internal audit plan to which management is committed Helping develop an audit plan that provides assurance over risks aligned with shareholder value objectives (i.e., strategic, operational, technology, compliance, financial) Ensure internal audit work is well integrated with other assurance, compliance, and monitoring functions to avoid duplication or control gaps Greater efficiencies through standardized audit methodology and tools Helping implement audit software to make audits faster and more efficient Helping your team focus scarce resources on audit areas having greatest impact More efficient staffing model PwC can bring a wide range of specialist for a few days at a time as needed no need to have such skills on permanent payroll Enhanced quality and value added using PwC s global internal audit methodology Innovative applications of technology including data analytics and meaningful metrics to measure performance Benchmarking of processes using PwC s Global Best Practices benchmarking tool Above all PwC can bring fresh insight to the overall organisation and role of internal audit to identify opportunities for value added currently being missed. PwC Russia is ready to provide such proposals and has the team to execute them with superior quality Given the state of the Russian internal audit profession summarised in this document we believe it is reasonable and timely for every large company audit committee at least to consider requesting a proposal from an external firm such as PwC for cosourced internal audit services to test whether a fresh approach could add value to their business. 20

22 Contact us Michael Hurle Partner, Risk Assurance Russia Leader Tel: +7 (495) Natalia Danilkina Director, Internal Audit services Tel: +7 (495) Jean-Pierre Garitte Senior Advisor, Internal Audit Services Tel.: +7 (495) PwC Russia ( provides industry-focused assurance, tax, legal and advisory services. Over 2,300 professionals working in PwC offices in Moscow, St. Petersburg, Ekaterinburg, Kazan, Novosibirsk, Krasnodar, Voronezh, Yuzhno-Sakhalinsk and Vladikavkaz share their thinking, experience and solutions to develop fresh perspectives and practical advice for our clients. The global network of PwC firms brings together more than 180,000 people in 158 countries PricewaterhouseCoopers Russia B.V. All rights reserved. PwC refers to PricewaterhouseCoopers Russia B.V. or, as the context requires, other member firms of PricewaterhouseCoopers International Limited, each of which is a separate legal entity.