Three questions to answer for a forward-looking internal audit function

Delivering more value to executives means shedding old mindsets and outmoded technology, especially as the risk landscape gains complexity.

In brief

• IA functions must widen their focus to include upside and outside risks, but they are held back by manual processes, spreadsheets and patchwork solutions.
• Automation, analytics and dashboard visualizations can enable continuous risk monitoring, helping professionals shift from being reactive to proactive.
• The EY VIA platform can be used to drive integration, digitization and automation across the IA life cycle, with the flexibility for configuration.

The COVID-19 pandemic instantly became the biggest risk event of the past decade, adding more complexity to a landscape already full of it, in the form of accelerating technology, rapidly converging business models, increasing regulation, and an evolving workforce of the future with different priorities and needs. Facing a need to deliver more data-driven insights, many internal audit (IA) functions are hobbled by ineffective software and backward-looking mindsets.

Click to play video.

To be successful, organizations need to shift their focus from simply mitigating risk to embracing new upside opportunities. IA functions have a vital role to play in enabling that shift and becoming a valued partner to the C-suite group. Executives must be equipped with what they need to know to make decisions confidently, across broader dimensions of risk — yet too many IA functions are still focused on the past.

IA professionals must be willing to rethink how they deliver value and where they focus their efforts. They need to be empowered with a truly digital platform that can fundamentally improve baseline assurance while delivering higher value through deeper insights to stakeholders.

Instead, IA functions are saddled with a patchwork of solutions that don’t necessarily work together. Auditors are using spreadsheets, or maybe a governance, risk management and compliance (GRC) tool with no connection to data analytics or ability to generate one-click reporting. Low-value, manual processes are eating up time and resources to produce audits with little value. Executives are left without a holistic view of their audit universe or a full understanding of all the dimensions of risk.

EY Virtual Internal Auditor (VIA) is a new platform to replace this inefficiency and fragmentation with integration, customization and collaboration. As you imagine a future state for IA with new technology and new possibilities, here are three questions to ask.

1. How many programs will your auditors need to use?

Among many other tasks, IA functions should document their work, manage issue tracking, measure progress and generate reports. Many auditors can find themselves working in several programs in some of these areas, complemented with manual processes. Workflows can be inefficient and hard to define, with little transparency or visibility at a given moment.

Think about how your function will approach its tasks across five key areas: strategy and IA management, risk assessment, audit planning, execution, and reporting and communication. To what extent do you have technology across these areas, and how much of it is integrated? EY VIA is a platform for the end-to-end IA life cycle to become fully digital and automated; it considers the different core and edge capabilities, validating that the right governance, process and capabilities and enablers are in place for each area of the life cycle.

2. How well are your tools connected to automation and analytics?

By introducing analytics and automation, IA functions can expand and enhance the depth of their risk analyses and demonstrate their worth in becoming a trusted advisor to the C-suite. Automation frees IA professionals from rote tasks like trying to input data or move it from one system to another, among other low-value responsibilities.

With these technologies, functions can better enable root-cause analyses and continuous risk monitoring to shift from being reactive to proactive in their audit responses, providing information that helps anticipate future risks and recommend measures that mitigate or reduce risk.

This functionality should be integrated in any solution you consider. EY VIA includes automation and analytics, as well as dashboards and other visualizations that are critical for executive decision-making in real time. For instance, those in EY VIA show constantly updating information based on ratings, related processes and deadlines.