Rising to the next floor www.pwc.com/ca/iastudy A Canadian perspective on

www.pwc.com/ca/iastudy
Rising to the next floor
A Canadian perspective on
the 2012 State of the internal
audit profession study
Rising to the
next floor
A Canadian perspective
on the 2012 State of the
internal audit profession study
Rising to the next floor
In Aligning Internal Audit: Are you
on the right floor?, our 2012 State of
the internal audit profession study,
we explored the rising importance of
risk management and the increasing
expectations of internal audit’s
contribution to the effort of managing
risk. This year, 1,530 executives from
a number of industries and countries
participated in our annual survey.
While our previous studies surveyed
only chief audit executives (CAEs) on
current issues and challenges, this
year’s survey expanded to include
key stakeholders such as executive
management, audit committee chairs
and board members. The survey was
also complemented by a number of
one-on-one interviews with CAEs
and stakeholders, enabling us to
develop a complete outside-in view
of the profession for the first time.
In our global study, an overwhelming
80% of the respondents felt that
risks to their organizations were
increasing. While we found that
traditional risks continue to evolve,
new risks are also emerging.
The survey also explored the
stakeholder and CAE perception
of how well internal audit is at
managing risks, and where internal
audit needs to expand its focus.
Finally, the survey results helped us
identify the changing expectations
for internal audit and the new
“floor” or standard that internal
audit needs to work towards.
This paper highlights key similarities
and differences between the Canadian
and global results, and what it may
mean for internal audit functions in
Canada. Additional findings related
to the global study can be found
at www.pwc.com/ca/iastudy.
1
Today’s complicated
risk landscape
2
Rising to the next floor
85% of Canadian respondents feel the risks to
their organizations are increasing
Risk is getting more
risky in Canada
In Canada, 85% of the respondents
felt the risks to their organizations
were increasing, which is relatively
aligned to the global results of 80%.
It’s interesting to note that while
Canada fared better than many global
economies during the downturn,
a slighter higher percentage of
Canadian respondents perceive their
risks as having increased. This could
be due to the relative and historical
stability of the Canadian financial
markets. Due to this, organizations
may exhibit a lower appetite for risk
and are not commonly faced with
risks arising out of instability.
The 15 most critical risks facing
many organizations (see figure 1
below) that global respondents
were surveyed on, are also of
concern to Canadian respondents.
In particular, the top seven most
frequently cited risks in Canada
are regulations and government
policies; economic uncertainty;
financial markets; competition; talent
and labour; reputation and brand;
and data privacy and security.
Figure 1: The 15 most cited risks
Economic
uncertainty
Talent and labor
New product
introductions
Regulations and
government policies
Reputation
and brand
Fraud and ethics
Competition
Commercial
market shifts
Business
continuity
Financial
markets
Energy and
commodity costs
Mergers,
acquisitions, and JVs
Data privacy
and security
Government spending
and taxation
Large
program risk
3
Expanding the
scope of risk
Talent and labour risks are gaining
importance, and globally it was
identified as being a key risk that
receives too little attention from
internal audit. Many organizations
are finding that there’s a lack of talent
with specialized skills to address
new and complex issues such as data
privacy and security threats.
An interesting observation was that
in Canada, none of the stakeholders
(compared to 30% globally) and
only 5% of the CAEs (compared
to 18% globally) believed that
talent and labour risks were being
managed well. Why is it that this risk
is perceived as not being managed
well in Canada? The results may be
a reflection of the lack of measures
taken by Canadian companies to
mitigate the risk of the retiring baby
4
Rising to the next floor
boomer generation. In PwC’s 14th
Annual Global CEO Survey last year,
55% of the respondents from Canada,
compared to 35% globally, indicated
that the retiring boomer generation
was a key challenge they expected to
face over the next three years, which
further highlights the importance of
this issue for Canadian organizations.
With a significant percentage of
the Canadian population slated
to retire over the next decade,
organizations could face a severe
talent crunch, which may have
multiple repercussions. There could be
a talent deficit, resulting in increased
salaries or even reduced performance.
There’s also the possibility that the
next line of executives may not be
ready in time to take over these newly
vacant roles if succession planning
isn’t in place. These are major risks for
organizations, especially when we look
at the scale.
“Aligned with global results, there’s a belief
amongst the Canadian executives interviewed
that internal audit functions should focus
beyond traditional risks and compliance
assurance activities.”
Matthew Wetmore, National Internal Audit Leader, PwC
Canadian CAEs and stakeholders
responses were aligned around
most risks and how well they are
being managed with the exception
of regulations and government
policies. While 58% of Canadian
CAEs believed they were managing
regulations and government policies
well, only 10% of stakeholders had
the same response. This disparity
could be explained by a lack of
communication between the CAEs
and stakeholders, or a different
understanding of the many Canadian
regulations and policies at play.
Regardless of the reasons, it’s
important for Canadian organizations
to keep in mind that alignment
around the most critical risks is
essential for prioritizing and enabling
effective allocation of resources. A
misalignment in either direction
would cause CAEs to improperly
direct resources to the areas
stakeholders consider most critical
and miss the opportunity to deliver
value to the organization.
While Canadian stakeholders agreed,
for the most part, that internal audit
is focusing on other top risks and
emerging risk areas, they emphasized
that internal audit can’t lose focus on
traditional risk areas such as controls
within processes and fraud and ethics.
They expect internal audit to be very
good at managing these traditional
risks, and then look beyond this and
manage new risks as well.
5
Stakeholder
expectations of
internal audit
6
Rising to the next floor
Besides the focus on risks, Canadian
stakeholders would like internal audit
to expand their role and deliverables.
While the primary role for internal
audit has traditionally been providing
assurance services, stakeholders
indicated that they would like internal
audit to take on a more advisory role
by adding insights to their findings.
Stakeholders would like internal audit
to come up with a point of view and
practical solutions in their reports.
In our stakeholder conversations,
we heard ongoing discussion and
debate on the amount of controls and
compliance work that internal audit
should do compared to advisory work.
What is that magic percentage –
60%, 40% or a different percentage?
An interesting comment to this
dilemma was that the line between
the assurance and advisory role for
internal audit is blurring.
Our interviews have also disclosed
that it’s often challenging for internal
audit to support several stakeholders
with different perspectives and
feedback on prioritizing risks. Some
Canadian CAEs point out that they
are challenged due to the size of
the organization and the number of
stakeholders and activities that they
have to deal with.
7
Rising to a new floor
8
Rising to the next floor
The basic role of internal audit has
always been providing assurance
for compliance and financial risks.
However, risks have shifted and the
expectations for internal audit have
increased under the backdrop of a
changing landscape. Internal audit
functions now need to rise to a new
floor (i.e. standard), by providing
assurance on a broader range of
risks, communicating deeper insights
and staying in alignment with
stakeholder expectations. Internal
audit capabilities and practices
that were considered leading just
a few years ago are now part of the
new floor of performance. Similar
to the global responses, Canadian
stakeholders also expect internal
audit to rise to this new floor and
raise their performance.
As stakeholder expectations of
internal audit rise, there’s significant
pressure for internal audit to do more.
In Canada, 61% of the respondents
indicated that there will likely be an
increase in the budget for internal
audit, compared to only 42% globally.
There’s an opportunity for Canadian
organizations to get the most out of
this increase in expenditure and lead
the way in meeting rising stakeholder
expectations.
Canadian stakeholders need to raise their
performance for managing risk, providing
deeper insights and building communications
and reporting.
9
Considerations for
Canadian businesses
10
Rising to the next floor
Based on the survey results and our
discussions with stakeholders and
CAEs in Canada, we’ve explored
some of the key considerations
for Canadian businesses.
Managing emerging
and expanding risks:
alternative service
delivery
Similar to global findings, Canadian
respondents indicated that audit plans
are often built based on the internal
resources that they have and not on
top-down risk assessments to help
manage critical risks. It’s likely then
that the expansion of internal audit’s
risk management profile is limited by
the resources that it has available.
With many organizations potentially
increasing budgets, there’s an
opportunity to leverage specialists
from outside the organization. This
co-sourcing or outsourcing approach
can address complex risks that are
constantly shifting as well as boost
performance levels. In addition, a few
of the organizations we interviewed
told us that they have staff rotations
programs in place — an approach
that could work well for organizations
across many sectors. This practice
helps companies leverage talent
when talent is scarce, giving
high-potential employees broader
experience and exposure within the
company, and brings business skills
into internal audit.
Earning a seat
at the table
Stakeholders expect internal
audit to play a bigger role in the
management of critical risks. This
is the time for internal audit to seize
the opportunity and increase their
overall importance and role within
the business. The business also
gains from internal audit being an
equal partner and providing a level
of assurance and insight over risk
management. If internal audit can
truly provide a valuable point of
view on matters such as what people
are doing in other industries, and
comes up with practical solutions
and insights, then it doesn’t matter
if they are performing assurance
or advisory duties as long as they
are adding depth and value to their
organizations.
Internal audit has to be nimble and
quick to change so that they can
shift gears quickly to address the
needs of its many stakeholders and
their various points of view that we
mentioned earlier. This also helps
internal audit address changes
and critical issues as they occur,
especially when the current risk
landscape is growing and rapidly
changing. Another way to stay agile
is by simplifying reporting so that
more issues can be addressed along
the way, and time is not spent on
processes that may not add as much
net value to the organization.
11
Building trust and
increasing dialogue
Both audit committee chairs and
CAEs view face-to-face meetings
as the most valuable form of
communication that allow both
parties to respond quickly to critical
issues. While audit committee chairs
understand the value that internal
audit brings, internal audit also
gains from audit committee chairs’
experience and counsel. When
internal audit informally reaches out
to audit committee chairs for advice
and insight, rapport can be built,
leading to better decision-making and
collaboration. The same holds true for
internal audit managing relationships
with other stakeholders.
12
Rising to the next floor
Improved communication helps
mitigate some of the misalignment
in perspectives that exist around
internal audit’s performance and
management of risks. For example,
the survey results showed a lot
of disparity in the perception of
how regulatory and compliance
related risks were being managed
by Canadian organizations. With
effective communication, internal
audit and stakeholders are more
likely to hold a similar view of the
requirements and performance.
The tone-at-the-top establishes the
organizational culture and helps build
trust and on-going dialogue. Our
interviews revealed the importance of
the board, CEO and audit committee
chair in empowering and providing
support to internal audit. However, in
our most recent 15th Annual Global
CEO Survey, only 53% of Canadian
CEOs expected to change their
approach to risk compared to 67%
globally. With a significant percentage
(85%) of CAEs and stakeholders
perceiving risks as having increased,
more support for internal audit
and recognition of the risks will be
required from Canadian CEOs.
Only if this support is in place,
can internal audit activities and
stakeholder expectations be aligned
and critical business objectives
met. In our experience, to build
trust and respect for internal audit,
organizations should also select
a CAE who is ideally a visible and
respected leader from within the
senior management team. This level
of support empowers the internal
audit function to expand their scope
and rise to the new floor.
Summary
For the most part, Canadian results
were in alignment with global results,
though some differences emerged.
In Canada, 85% of the respondents
viewed their risks as having
increased, which was slightly higher
than the 80% globally. It’s important
for the CAE to be a key member of
the leadership team, and to receive
top-down support in order to manage
these expanding and emerging risks.
Canadian stakeholders would also
like internal audit to expand the role
it plays to keep up with emerging
risks while continuing to focus on
traditional risks. They want to see
internal audit perform an advisory
role in addition to its existing
assurance role. This can be achieved
if internal audit seeks to add value
by providing more insight in its
findings. It’s important for internal
audit to communicate closely with
the audit committee chair and other
stakeholders to be able to meet their
expectations.
For more information and to
read the global study, please visit
www.pwc.com/ca/iastudy to
download a copy of the PwC’s 2012
State of the internal audit profession
study.
Methodology
The 2012 State of the internal audit
profession survey was conducted in
the fourth quarter of 2011 and the
first quarter of 2012 and includes
1,530 respondents across the globe.
More than 660 global non-internal
audit stakeholders shared their
points of view through participation
in the 2012 State of the internal
audit profession survey in addition
to approximately 870 global CAEs
across the globe. Nearly 100 global
CAEs and stakeholders, including 10
of Canada’s leading organizations
also participated in one-on-one
interviews, enabling PwC for the
first time to share a comprehensive
outside-in look at the profession.
With the changing risk landscape and
increasing stakeholder expectations,
internal audit functions need to rise
to the new “floor” or standard in
terms of performance by expanding
their role, communicating well and
being more agile. This will help them
earn a seat at the table — one audit at
a time.
13
www.pwc.com/ca/iastudy
Who to call
National Internal
Audit Leader
Matthew Wetmore
National Internal Audit Leader
403 509 7483
306 668 5930
[email protected]
Vancouver
Mike Harris
Partner
604 806 7711
[email protected]
Sunil Rajan
Director
604 806 7644
[email protected]
Calgary
Jill Johnston
Director
403 781 1844
[email protected]
Edmonton
Arun Gupta
Partner
780 441 6717
[email protected]
Alexander Hilsbos
Director
780 441 6774
[email protected]
Saskatoon
Paul Vail
Manager
306 668 5912
[email protected]
Winnipeg
Robert Reimer
Partner
204 926 2442
[email protected]
Toronto
Bruce Webster
Partner
416 815 5250
[email protected]
Rani Turna
Partner
416 869 2911
[email protected]
Peter Koch
Associate Partner
416 814 5899
[email protected]
Robin Taylor
Managing Director
416 869 8683
[email protected]
© 2012 PricewaterhouseCoopers LLP. All rights reserved. “PwC” refers to PricewaterhouseCoopers LLP, an
Ontario limited liability partnership, which is a member firm of PricewaterhouseCoopers International Limited,
each member firm of which is a separate legal entity. 2527-21 0712
Issa Habash
Director
416 365 8840
[email protected]
Liane Kim
Director
416 815 5268
[email protected]
Janet Rieksts-Alderman
Director
416 687 8598
[email protected]
Ottawa
Darren Budd
Director
613 755 5659
[email protected]
Montreal/Maritimes
Josée St-Onge
Partner
514 205 5159
[email protected]
Kelly Ohayon
Director
514 205 5146
[email protected]
Scan the QR code to
download this report.