In an exclusive interview, Internal Auditor Middle East connected with Richard Chambers, CIA, QIAL, CGAP, CCSA, CRMA, the President and CEO of The Institute of Internal Auditors (IIA) globally. Since assuming leadership of the IIA, Richard has led The IIA to achieve record membership and has presided over the launch of several strategic initiatives. Previously, Richard served in leadership roles at a variety of institutions including, PwC, the US Postal Service, and the US Army.
In addition to his IIA role, Richard serves on the Committee of Sponsoring Organizations of the Treadway Commission (COSO) Board of Directors and the International Integrated Reporting Council (IIRC).
Finally, Richard has authored two award-winning books: Trusted Advisors: Key Attributes of Outstanding Internal Auditors, which was released in early 2017; and Lessons Learned on the Audit Trail, which is currently available in five languages.
Internal Auditor Middle East connected with Richard Chambers during his most recent trip to the United Arab Emirates.
How has the internal auditing profession changed over the past 5 years?
I think there have been some quite positive trends. Regulators, boards, and other stakeholders are increasingly seeing the value a strong internal audit function can bring. And, possibly as a result of this enhanced appreciation, resources devoted to internal auditing have shown a steady climb. There is every reason to feel good about the trajectory of the profession, but, of course, to maintain that favorable status, we have to continue delivering value, anticipating rather than merely reacting to stakeholder expectations.
What are the new trends influencing Internal audit? E.g. artificial intelligence and robotics?
Like any profession, internal audit is subject to the changing demands and opportunities brought by technology. We need to expand our expertise in fields such as cybersecurity, artificial intelligence (AI), data analysis algorithms, and data privacy — all of which are now in our purview due to technology.
But technology is just one facet of a larger topic: business disruption. Our research indicates that the coming years will be characterized by significant disruption in business models, markets, and strategies. This is likely to place increasing pressure on boards and executive management to address more complex and rapidly escalating issues in the workplace. Internal audit must position itself to be part of the solution.
We believe internal auditors should help their organizations deal with disruption by keeping a laser focus on the things they historically do well: assurance, risk management, controls, and governance. They should also engage with subject matter experts and enhance their own skills to keep a finger on the pulse of emerging technologies and pursue the necessary technology-relevant training.
How much of the changes to our profession can be attributed to changing stakeholder expectations?
Given some of the recent misdeeds by companies around the world, it is reasonable to expect that stakeholders will look to internal audit to provide strong assessments of operations. However, I do not think this is solely a stakeholder-driven development. Internal auditors, as a profession, have been proactive in encouraging attention to the issue, both directly and indirectly — directly, by advocating for the benefits of better systems and controls (and internal audit’s role in assuring them, of course) and indirectly, by delivering performance that proves our point.
“More than ever, Middle Eastern businesses need trusted advisors who embrace disruption as an opportunity rather than a setback”
So what will internal audit look like in the next 5 years?
I think there will some major shifts in focus. For example, I believe there will less emphasis on internal controls and more on how well management is managing risks. This is likely to be accompanied by a reduced focus on auditing traditional financial reporting and transaction areas (such as accounts payable) and more attention paid to areas representing strategic organizational risks. As internal auditors increasingly rely on technology to improve audit efficiency and effectiveness, and we embrace a more diverse talent and skill mix into our ranks, I believe we will be perceived less as “the police” and more as trusted advisors supplying valuable assurance and advisory services.
Do you believe your view of the future of internal audit is relevant to the Middle East region?
Absolutely. No part of the world is an island unto itself, and the same pressures affecting organizations outside the Middle East are being felt in the Middle East as well, as your companies become increasingly engaged in global business. This global engagement means that what happens to internal audit around the world will also affect internal audit functions in the Middle East.
Given where the profession is heading, what should an internal audit department’s 2020 strategy include?
Based on my previous comments, it is probably not a surprise that I would recommend leveraging technology aggressively. It is not a “badge of honor” to use old technology. Be future-focused; for example, learn how advanced analytics embedded in cognitive computing (often considered AI) can be used to improve internal audit. Doing so may necessitate my second recommendation: broadening the skill sets in internal audit by looking beyond just accounting and finance personnel. Remember that technology expertise and soft skills are also needed in internal audit. And, finally, do not shy away from the difficult areas to audit, especially technology (e.g., blockchain), culture, and strategic initiatives. Auditing accounts payable is important, but limiting internal audit to only that sort of work is a sure path to irrelevance.
How important will it be to become a trusted advisor in the future?
As long as our organizations need internal audit to help them — and I see no end to that — it will be important for internal auditors to be trusted advisors. Organizations currently face issues such as culture and strategy that are enormously impactful and require skills that go beyond the services provided by a traditional compliance auditor. Trusted advisors can bring to these issues a high level of skill and finesse, coupled with a business acumen born of an in-depth knowledge of the organization’s challenges, operations, risks, and market opportunities. It is hard to imagine that organizations will ever decide these contributions are anything other than critical.
Will conformance to the IIA Standards remain relevant?
The research says yes. Our recent survey on the internal audit common body of knowledge indicates that, of the half of the stakeholders who know of the Standards, 94 percent say conformance brings value. I doubt that stakeholders will ever come to believe it is a good idea to have an internal audit function that is ignorant of and/or nonconforming with the standards of the profession. Based on that, I believe that CAEs should assume that conformance will soon be an imperative, if it is not already.
Any final advice to CAEs on how they can remain relevant over the next 5 years?
Internal audit is facing some significant challenges, many of which I have mentioned in my comments. Heads of audit can create the changes that will enable the profession to meet those challenges, but they cannot do so by using traditional approaches. Internal audit must ramp up its agility and innovation.
Some of our recent research shows that the majority of audit executives agree with the need to become more agile and innovative, but unless they start to address that now, they leave the profession vulnerable to being left behind. They cannot afford to wait until it is “safe” to change or the “time is right.” No one is expecting them to see into the future. But they do need to understand what is going on in the business and in their own departments and be willing to challenge the status quo. Not everyone can be a leader, but they can become fast followers in adopting new mindsets, advanced technology, flexible processes, and a staffing model that searches diverse backgrounds to find candidates who can think analytically, communicate well, and understand the business.