When the world pivots, how do you harness the momentum?

Authors
Lisa Hartkopf

EY US-Central Advanced Manufacturing Consulting Markets Leader

Highly experienced consulting and risk leader. Bringing the depth and breadth of consulting to advanced manufacturing. Leader of ideas. Hiker. Skier. Mother.

Chee Kong Wong

EY Asia-Pacific Risk Leader and Governance Risk and Compliance (GRC) Technology Leader

Passionate about harnessing data and technology for transformation, RegTech, FinTech, and diversity & inclusiveness. Avid street photographer.

Contributors

Cindy Doe

6 minute read 11 Dec. 2020
Upvote

Show resources

  • When the world pivots, how do you harness the momentum? (pdf)

    Download 2 MB

The best functions are showing that with the right operating model, talent and technologies they can provide more risk coverage and insights.

In brief

  • An IA function of IT and Finance generalists can no longer be effective.
  • The progressive IA ecosystem has a talent mix that includes data scientists and digital workers.
  • By migrating to advanced technologies, tools and platforms already in use by the wider company, IA can become more agile, efficient and transparent.

As many people have pointed out, the COVID-19 pandemic was no “black swan,” a term used to describe unpredictable, rare and catastrophic events. Many had warned of the dangers posed by ever-intensified global contact networks, but how many companies had modeled what a pandemic would mean to their business operations? How many had begun to diversify supply chains for resilience, and how many had fully transformed themselves into digital powerhouses? The need to be resilient as the result of a new environment and the ability to reshape quickly in the face of extra complexity and uncertainty has never been more evident. However, almost half (47%) of those polled during a recent EY webcast reported themselves as “reactionary” when it came to their response to disruptions.

When the COVID-19 pandemic hit, companies that were gradually automating routine processes were faced with digitalizing their operations almost overnight. Retail moved online. Office personnel working in a central office through a secured network were working remotely over consumer wi-fi networks. Cyber attacks1 and cyber fraud crept in through the security cracks. Technology departments working with risk professionals scrambled to keep up. While the pandemic heightened security threat levels for many companies, these challenges will remain even after the full impact of COVID-19 pandemic subsides. Remote working and online transactions are here to stay.

Who is best positioned to help evolve to the new normal, making sure the enterprise processes are controlled, compliant and efficient?

Internal audit: a transitioning business tool

Internal auditors, it is often said, view the world through the rear-view mirror. But the best internal audit (IA) function looks through the windshield, too, to scan the horizon for possible threats and potential opportunities. IA is increasingly a functional business tool, not a function within the business. Companies are not abandoning the traditional assurance mandate; instead, they are getting more assurance coverage in less time, allowing them to monitor a broader set of risks.

The best IA functions are showcasing that with the right operating model, talent and technologies they can provide more risk coverage and greater insights, cheaper. New tools and technologies allow for evaluating an entire population versus having to resort to individual sample methods. Many audit committees are pushing their IA functions to “return to better” — seeking opportunities to reorganize the structure and mandate to meet the demands of the future versus those of yesterday.

While we argue this digital transformation lies at the heart of an evolving IA function, it also needs to be integrated into progressive change in the operating model and talent mix. Technology on its own cannot deliver the competitive advantage a company needs; rather, it needs a three-dimensional approach:

  1. Operating model: top IA functions are often more integrated than other company functions.
  2. Technology: the pandemic is escalating moves to digital.
  3. Talent: as businesses evolve, the IA talent agenda is no longer viewed as the traditional department fixed costs, but rather to utilize the top talent across the ecosystem.

How EY can help

Internal audit

Organizations are increasingly relying on Internal Audit (IA) to provide them with insights into diverse and emerging risks

Read more
digital is no longer an optional activity

Operating model

Moving from a linear operating model to an ecosystem of tools and resources demands wider skills and experience. An IA function of IT and Finance generalists can no longer be effective. The resources and design disposition used to optimize the assurance activities IA provides are different from those you need to provide insights. These in turn demand different skills from those designing technology enhancements that allow for an improved control environment.

Transitioning some of the fixed costs of an in-house IA function to a more flexible cost base adds agility to the operating model. Moreover, a third party can add insights and perspectives above and beyond the in-house function, which enhances the overall control environment while building valuable insights.

An effective progressive operating model will not only embrace real-time risk assessments and dashboard reporting, but also offer a flexible IA plan. By utilizing advanced analytics, IA functions can model alternative potentialities, plot risks and highlight gaps in strategic plans. However, one of the major challenges facing traditional IA teams is that they don’t have the skills to execute complex analytics. Moreover, technology is evolving rapidly, making a major investment in one tool today redundant tomorrow. IA needs access to a wider toolbox of skills and technology to be effective in the longer term.

Technology

Companies that can fully integrate IA tools within the digital architecture of their operations will benefit from a frictionless flow of data using the same taxonomies and the same data sources as every other part of the business. This will allow IA to analyze much broader data sets than it was able to previously, now enabling the building out of actionable insights for the C-suite. It will facilitate greater transparency, remove duplication and accelerate the pace of insight into real time.

By migrating to advanced technologies, tools and platforms already in use by the wider company, IA can become more agile, efficient and transparent. Real-time analytics can deliver instant insight into potential risks faster and more consistently across the business and across geographies. These technologies also enable better communication to non-audit professionals, using dashboards, data visualization and analytics to create meaningful, real-time reports for the C-suite.

Talent

The progressive IA ecosystem has a talent mix that includes data scientists and digital workers. Digital tools are replacing linear and sequential approaches of “plan, execute, report” into a compressed and simultaneous activity. Fluid monitoring can respond quickly to changing needs. And as the volatility of the operating environment continues to challenge companies across the world, this agility is no longer a nice-to-have but a must-do.

Far-sighted audit chairs are harnessing the digital fluency of young team members to accelerate and lead transformation. Unfettered by decades of doing things in rigid and specific ways, they can innovate creating new uses for established technologies that better meet emerging needs.

Some senior executives may be surprised that IA departments do not need to house all the required source of this talent, skills or technologies. The purpose of creating an ecosystem made up of third parties, guest auditors and other talent allows for greater risk and insight coverage through skills and technologies not possessed as a fixed cost within the department.

The next chapter for IA functions

In the current world of rapid change, an IA model built as an ecosystem can take advantage of capabilities, assets and the provider’s scale to bring flexibility in skills, technologies and cost. Many organizations that have optimized their IA function operate this teaming model and do so at an operating cost at or below that of running a full in-house function.

As the IA function accelerates its journey from rear-facing reporter to forward-looking advisor, building a hybrid model that blends internal teams with external expertise can deliver flexible and future-proofed capabilities.

The future IA function will act as an all-seeing watchtower challenging the full risk landscape for its business leaders. To continue to be the guardians of trust, IA needs to drive over, around and through the organization; be fluid and agile; and always respond to new challenges and risks while monitoring data in real time.

next chapter for IA functions

Summary

Did your IA function play an important role in the organization throughout the pandemic, helping identify and assess a growing set of new risks? Many functions pivoted and did just that, while many could not. How your IA function performed can be telling. If your organization was one with an IA function that was on the outside looking in, maybe it’s time to consider building a better IA function.

About this article

Authors
Lisa Hartkopf

EY US-Central Advanced Manufacturing Consulting Markets Leader

Highly experienced consulting and risk leader. Bringing the depth and breadth of consulting to advanced manufacturing. Leader of ideas. Hiker. Skier. Mother.

Chee Kong Wong

EY Asia-Pacific Risk Leader and Governance Risk and Compliance (GRC) Technology Leader

Passionate about harnessing data and technology for transformation, RegTech, FinTech, and diversity & inclusiveness. Avid street photographer.

Contributors

Cindy Doe

Related topics COVID-19 Risk
Upvote