Internal audit: make risk your business

Make risk your businessThe economic winter and its icy winds blowing through
boardrooms should give directors the strongest incentive to review their risks
and how they are managed. More than ever, boards need assurance they have
identified the right risks, they have the right mitigation arrangements in
place, and controls are well-designed and effective.

Internal auditors exist to provide boards with objective assurance about risk
management and internal control. While they are not the only source of such
assurance, they alone have the flexibility, the freedom and the remit to provide
assurance which is timely, objective and independent.

Directors should be asking urgent questions about internal audit. Is it
properly staffed? Is it encouraged and required to review key risks facing the
business? Does it have the right skills and seniority? Best practice boards will
want to ensure they have effective and capable internal audit departments,
focused on the right areas.

Boards in all sectors, including banks now in public ownership, should also
reconsider the reporting lines for internal audit. Most internal audit
departments report to an audit committee. Although this has benefits, some of
internal audit’s value may be lost in an audit committee’s focus on a narrow set
of risks ­ financial reporting ­ and in the limited time spent by other
directors on the committee’s reporting.

By contrast, commentators such as international governance expert Mervyn King
and Lord Smith, the eponymous author of the report on audit committees, are
moving strongly in favour of a higher internal profile for internal audit. King
has said the place of internal audit today is ‘in the boardroom, not the
backroom’. Lord Smith, at a recent internal audit conference, was very clear
that, had he been writing his report now, he would have called strongly for
highly-placed and well-resourced internal auditors.

Only internal audit is unconstrained by the responsibilities of management or
the regulation of external auditors and can give the board complete and unbiased
opinions. Only internal audit supplies boards with the expertise to provide
assurance across a gamut of risks.

Boards should act now to obtain the internal audit service and assurance they
need in these troubled times. Insisting on a boardroom presence for internal
audit will benefit the top team and all stakeholders.

Philip Ratcliffe is president of the Institute of
Internal Auditors ­ UK and Ireland