By: Ehab R. Saif, CMA, CIA, CFE is an Internal Audit Manager at a private holding company in Abu Dhabi.


“In the current volatile and unstable economic conditions, internal audit functions are required, like never before, to assume different responsibilities and wear multiple hats to achieve the goals of the reorganization programs”.

 The current business environment is very volatile and unstable worldwide and this is especially clear in Middle East. The characteristic of this stage are mainly uncertainty and lack of clear strategic direction.

Working in such business environment adds a lot of responsibilities and pressure on the available resources. This is of course applicable to the internal audit resources which are required to participate in different organizational efforts aiming to reduce costs, increase efficiency and ensure proper restructuring of key business activities.

In such circumstances, internal audit functions are required, like never before, to assume different responsibilities and wear multiple hats to achieve the goals of the reorganization programs.

Acting as the Second Line of Defense:

Most reorganization programs will result in hard decisions related to job cuts at different organizational levels. The reduction in head count might be permanent or temporary which in both cases means weaker internal controls, at least, during the period of the restructuring.

Assuming compliance and risk management responsibilities is one of the common scenarios for internal audit resources in such circumstances. For example, internal auditors might be required to review some business transactions to ensure its compliance with internal policies and alignment with reorganization objectives.

Having in depth knowledge of the internal controls gives internal audit resources the ability to perform compliance related activities including financial and operational compliance in a very efficient and effective manner.

Internal audit departments can also review, identify gaps and recommend improvements related to the reorganization plans as they have best understanding of overall organizational operations, departments and intradepartmental workflows.

Risks to Independence and Objectivity

One of the major internal auditors’ concerns is always Independence and Objectivity which is clearly reflected in Standard 1100 of the IIA standards which states that the internal audit activity must be independent, and internal auditors must be objective in performing their work. However, participation in restructuring efforts requires high level of flexibility to convince restructuring committees that internal auditors are well rounded resources who can employ their knowledge in internal controls and utilize their internal business relationships to add value to the organization.

Unfortunately, in most of the cases internal auditors will not have a say in whether they are involved in such reorganization programs. BoD/business owners will usually ask internal auditors to be involved in the reorganization efforts due to the lack of trusted and knowledgeable resources. This might be more applicable in family businesses where internal audit is considered a trusted agent to accelerate changes and ensure that the BoD/owners’ decisions are implemented.

The independence issues normally appear when the Chief Audit Executive (CAE) or the internal audit resources are required to report on specific assignments to the reorganization committee which might consists of current or future management employees. The impairment of independence might also result from performing some compliance and risk management activities which are subject to internal audit reviews in the future.

Considering the factors mentioned above, there are clearly some risks associated with assuming second line of defense responsibilities temporarily. The CAE is required to report such risks to the audit committee/BoD before acceptance of assigned responsibilities

Adding Value in Difficult Times

The internal audit resources should plan their work in a smart and effective manner to add the maximum value to the reorganization efforts while maintaining the highest possible level of independence and objectivity. Such activities might include, but not be limited to, the following:

  • Efficiency reviews that focus on cost optimization in which internal auditors review previous practices in various business departments and recommend improvements that will decrease costs or/and increase efficiencies.
  • Liquidity assessment reviews that highlight potential gaps in cash flow for management action given that most reorganization efforts involve major debt restructuring and cash flow difficulties which require close attention by the reorganization committee.
  • Process gap analysis reviews that help reorganization committee to conduct proper process reengineering exercises.
  • Limited ad-hoc assignments or investigations that assist reorganization committee to reach certain conclusions on various organizational matters.

IIA Response

As a response to the increasing pressure on the internal audit resources to perform second line of defense activities, the Institute of Internal Auditors (IIA) has issued a practice guide called “Internal Audit and the Second Line of Defense” which addresses the specific cases where BoD/business owners ask CAEs to assume responsibilities for risk management, compliance, and other governance functions.

As per the practice guide, the CAE should ensure the following before and during assuming such responsibilities:

  • Discussion of risks with management and the BoD/business owners.
  • Acceptance and ownership of risks by management.
  • Clear definition and assignment of roles for each activity where second line of defense activities overlap with third line of defense activities.
  • Periodic independent assessment of internal audit’s second line of defense roles and responsibilities.

The practice guide has also specified some of the activities that the internal audit should avoid in such cases which include:

  • Setting the risk appetite, owning or managing risks.
  • Assuming responsibilities for accounting, business development, and any other first line of defense functions.
  • Assuming accountability for risk management or governance processes.
  • Providing assurance on second line of defense activities performed by internal audit.

The practice guide above was subsequently followed with a new IIA Standard which is Standard 1112 “Chief Audit Executive Roles Beyond Internal Auditing”. The new IIA Standard specified certain safeguards to address the impairments resulted from assuming responsibilities that fall outside the internal auditing which include periodic evaluation of reporting lines and developing alternative processes to obtain assurance related to the areas of additional responsibility.

Another sensible change in IIA standards was introduced in Standard 1130.A3 which allowed internal audit resources to provide assurance services where they had previously performed consulting services, provided the nature of the consulting did not impair objectivity. This means that internal audit functions will need robust processes to assess requests for consulting engagements to help prevent independence issues in future audit plans.


Organizational changes might not always be in the favor of the employees and this usually creates more pressure and discomfort for the available resources. Internal auditors are usually one of the most impacted resources as they are required to assume more responsibilities.

In addition to the reorganization programs, internal auditors might be asked to assume second line of defense responsibilities due to many reasons including, but not be limited to, the following:

  • BoD/business owners do not understand or appropriately value the importance of an independent and objective third line of defense.
  • Internal audit has the necessary skill set or relevant expertise for specific risk management and/or compliance activities.
  • The organization is small and cannot support distinct control and assurance functions.

Internal auditors might have two options when it comes to assuming second line of defense activities which are either to quite the job in order to protect their independence or to accept such responsibilities with a strategy of how to achieve the required objectives with a clear transition plan to relieve internal audit from such responsibilities in the future.

There is a good saying to remember in this regard. It says “I can’t change the direction of the wind, but I can adjust my sails to always reach my destination”. It is extremely important for internal auditors to be mentally prepared for such circumstances, especially in the current economic conditions, which will help them perform and excel without unnecessary hard feelings.