Internal audit: make risk your business

Make risk your businessThe economic winter and its icy winds blowing through boardrooms should give directors the strongest incentive to review their risks and how they are managed. More than ever, boards need assurance they have identified the right risks, they have the right mitigation arrangements in place, and controls are well-designed and effective.

Internal auditors exist to provide boards with objective assurance about risk management and internal control. While they are not the only source of such assurance, they alone have the flexibility, the freedom and the remit to provide assurance which is timely, objective and independent.

Directors should be asking urgent questions about internal audit. Is it properly staffed? Is it encouraged and required to review key risks facing the business? Does it have the right skills and seniority? Best practice boards will want to ensure they have effective and capable internal audit departments, focused on the right areas.

Boards in all sectors, including banks now in public ownership, should also reconsider the reporting lines for internal audit. Most internal audit departments report to an audit committee. Although this has benefits, some of internal audit’s value may be lost in an audit committee’s focus on a narrow set of risks ­ financial reporting ­ and in the limited time spent by other directors on the committee’s reporting.

By contrast, commentators such as international governance expert Mervyn King and Lord Smith, the eponymous author of the report on audit committees, are moving strongly in favour of a higher internal profile for internal audit. King has said the place of internal audit today is ‘in the boardroom, not the backroom’. Lord Smith, at a recent internal audit conference, was very clear that, had he been writing his report now, he would have called strongly for highly-placed and well-resourced internal auditors.

Only internal audit is unconstrained by the responsibilities of management or the regulation of external auditors and can give the board complete and unbiased opinions. Only internal audit supplies boards with the expertise to provide assurance across a gamut of risks.

Boards should act now to obtain the internal audit service and assurance they need in these troubled times. Insisting on a boardroom presence for internal audit will benefit the top team and all stakeholders.

Philip Ratcliffe is president of the Institute of Internal Auditors ­ UK and Ireland