When is what’s

working worth
changing?
How internal audit can
build trust through
transformation.
Converging forces shifting the way
Disruptive technologies
Innovation and rapid development of technology have enabled companies to move from traditional
execution to digital processes and business models to create new markets and products.

internal audit responds to risk IA has the unique and challenging opportunity to not only embed technology into the process, but
leverage what the organization is doing to provide leadership with insightful assur

Pace of change to the business

Internal audit (IA) functions have been “transforming” for the past 20 years. However, many As the pace of change is growing, processes and systems have become more complex and sometimes
internal auditors still audit substantially the same way they have in the past. Converging forces will disintegrated. More data is being generated which presents internal audit with the challenge, but also the
opportunity, to focus on the best way to consume and provide new and valuable observations.
challenge the efficacy and relevance of internal audit. By designing the disruption and preparing for
change, internal audit can join the business in the future state journey.
Changing regulatory environment
Recently, sweeping changes in regulation and increasing uncertainty in the geopolitical environment have
highlighted the need for an organization to have a focused and responsive control environment.
IA must also understand the new risks and impacts that evolving regulations present.

Market disruptions
Regardless of industry or sector, the market is changing. Megatrends such as digital are quickly
demonstrating that organizations cannot survive with their traditional “business as usual” approach.
IA should understand these outside risks and provide management with the risk lens they need to make
decisions impacting the organization.

Workforce of the future

New skills and roles are required to operate emerging technologies and understand digitalized processes
and business models.
Changing workforce dynamics will require IA to develop a more flexible, adaptive and collaborative work
environment.

Globalization
Organizations are looking beyond borders to expand into new markets and tap into new networks of
talent and sourcing.
IA must also think globally and understand the risk profiles of different regions to help the business plan.
Technologies will enable functions to gather data, understand transactions, and assess risks with a global lens.

2 | When is what’s working worth changing? How internal audit can build trust through transformation. When is what’s working worth changing? How internal audit can build trust through transformation. | 3
 What does the internal audit
Internal audit future state vision
transformation journey look like?

By blurring the lines between people and technology, IA functions can optimize the operating model and create a IA transformation can be broken down into three phases. Throughout each phase, management should be focusing on
dynamic audit approach that allows a quicker response to risk and deeper insights into the risks that might matter the incremental changes to the operating model, people and technology as well as broader transformation efforts to start on
most to leadership. Organizations must rely on trust to be successful, and IA can help build that brand of trust by helping the path to the future.
management respond to risks faster and with better information. Transformation is key to improving how IA provides
assurance on the downside risks that are preventable, insight into the upside risks that management should be exploring,
and foresight into the outside risks that are on the horizon. Throughout the phases of the transformation journey, both 1. Understand the current state
processes and technology should be challenged concurrently to design a disruption that makes sense for the environment.
Identify To kick-start the transformation:
Transformation is made up of individual adjustments to behavior coupled with advances in technology and can be small Gain a common ground •• Understand the current state through maturity or functional performance
and targeted, large and strategic, or both! assessment
•• Analyze megatrends and disruptive, rapid changes to the risk environment
•• Evaluate the IA mandate and align on value drivers
•• Understand the desired stakeholder journey

2. Define the future state

Develop Transformation teams can leverage several approaches to

Brainstorm solutions and explore their potential brainstorming. Also engage with industry experts and digital
subject-matter resources to explore the “art of the possible” and
Apply identify leading practices. Each team should consider:
Choose the way forward •• Mandate and purpose development
•• Operating model with a clear vision for people and technology
•• Technology landscape
•• Talent development
At this point, decisions must be made to determine the future state road
map. That road map should have a clear definition of technology, solutions
to talent needs, and an operating model that is dynamic and data-driven.
Change management and culture is a key to successful transformation. A
teaming approach to transformation and a well-designed disruption can
help facilitate a transformation and build the brand of IA in the organization.
Internal and external stakeholders hold equal weight in measuring the impact
and success of any major transformation.

3. Activate the transformation journey

Deploy Deployment of the new methodology and implementation of the future state
Deploy a new IA organization model road map requires strong governance backed by the chief audit executive or
head of IA. Successes that have been realized can be communicated during
steering committee meetings, audit committee and other informal terminals
to gain business support and recognize teams for their progress.

4 | When is what’s working worth changing? How internal audit can build trust through transformation. When is what’s working worth changing? How internal audit can build trust through transformation. | 5
Disrupting IA by design
Operating model

The operating model defines how we work and execute the audit plan as well as the resourcing model that will be
employed; it is driven by the internal audit mandate. The mandate will be determined by your individual business needs, What is your mandate?
but challenging your mandate to obtain the right mix of assurances is imperative to the department’s effectiveness. The
operating model of the future looks outside the walls of IA and takes into consideration the other risk functions, identifies Assurance-focused
what would best address business needs and the current risk profile of the organization, and defines key performance Driving assurance is often a non-negotiable component of IA’s mandate. However, an assurance-focused IA department
indicators that focus on delivering value. does not mean transformation is out of reach. Companies with strong foundational processes and controls can and should
invest heavily on optimizing and compressing the level of effort required for these non-negotiable activities, allowing IA to
take on more strategic projects.

Key questions to consider For example, technologies such as optical readers and robotics can be implemented to aid in and perform assurance testing.
Account reconciliation bots increase the accuracy and speed of testing execution, while optical readers transform sample
•• How do the three lines of defense currently operate?
documentation into a format that is easily analyzed with minimal manual effort. For mandates focused on driving assurance,
•• What is the appetite of the business to coordinate?
functions may need to engage new resources with experiences and working knowledge of changing regulatory requirements.
•• What is the current state and, based on the mandate, where does the function want to be?
•• How will we report on our accomplishments and communicate successes or risks?
Blend of assurance/advisory
In addition to covering the “basics,” the function is designed to provide high-quality, relevant risks & controls insights as
Transformation considerations an integral part of its activities. This insight is not a by-product, but an explicit outcome from the function’s activities.

•• Consider the population of dynamic outputs that report on more of a real-time basis to meet the needs of different A blended internal audit plan has a larger percentage of operational reviews and strategic projects throughout the year,
stakeholders yet still has a large hand in providing compliance assurances. This approach also allows functions to respond to business
•• Define what technologies can be leveraged to drive efficiencies and help the function focus on risk identification risks in a dynamic manner — for example, executing data analytic reviews on remote locations or leveraging a sector
•• Co-develop a structure that aligns to the organization and business unit strategies subject-matter resource to drive a high-impact audit around a strategic initiative.
•• Establish future targets and metrics to track progress
•• Define a program that purposefully aligns resources
•• Identify ways to run IA like a business Advisory-focused
The IA function serves as a trusted risk and controls advisor to business management around transformational company-
wide initiatives, challenges and changes in the organization. The function has world-class talent that understands the
business, subject-matter depth, and experiences to effectively provide this level of service.

The goal of an advisory-focused IA department should be that they are a trusted business advisor that doesn’t just
execute tests without providing insights. IA must be working in harmony with the other risk functions within the
organization to have adequate risk coverage and an approach to risk that complements and enhances the perspectives
provided to management.

6 | When is what’s working worth changing? How internal audit can build trust through transformation. When is what’s working worth changing? How internal audit can build trust through transformation. | 7
Disrupting IA by design
Technology

Digitalization has a place throughout each phase of the IA life cycle, and advancements in technology are making it possible
for functions to gather more and more data that can be transformed into insights to the business. Technology can also Robotic process Risk assessment Planning and scoping Ways of working
improve the overall audit experience for both the auditor and auditee by facilitating real-time documentation, providing automation
better and faster reporting of results and producing a sleeker deliverable. Collaborative environments are essential to • Accelerated • Automated • Enhanced audit
successful transformations and technology helps to connect practitioners to information and facilitate innovation by tools to gather planning alerts manuals and
delivering broader analytics leveraging multiple data points. IA can also leverage advances in the speed of information to New tools and stakeholder procedures
• Offshore
better collaborate with business partners and provide management with more real-time insights to their business. cloud-based feedback
platforms
• Collaboration
• Enhanced sourced technology
of risk inputs • Continuous training
Key questions to consider Internet • Improved data and development of
of Things analysis digital skills
•• How can technology better enable the function (e.g., replace repetitive tasks, increase coverage, drive insights)? (smart devices)
•• What is the organization’s digital strategy?
•• Where should the innovation be focused?
•• What data is available in the current IT landscape? Blockchain

Reporting Continuous analytics Audit execution

Transformation considerations Big data and

analytics • Audit Committee • Contiuous process • Flexible audits
•• Define objectives and user requirements for risk assessment and the entire IA life cycle reporting mining ranging form short
•• Understand the technology platforms that are being used by the business today notice assessments
• Flexible, real- • Automated mining
•• Identify the technology that will be implemented over the next year to deep dives based
time status to technologies
•• Define technology development thresholds, data requirements and how data will be accessed Fully-utilized management on risks
ERPs • Real time audit
•• Capture and consume industry benchmarks and appetite • On-site, off-site
• Real-time tracking alerts
•• Analyze the overall feasibility and any budget restrictions that could impact the transformation of issues and analytical
•• Develop a plan that considers quick wins, mid-term, and long-term implementation plans that include future investments • Dashboards that procedures
• Control alert you to risks
Machine dashboards • RPA-enabled
learning and AI
testing

8 | When is what’s working worth changing? How internal audit can build trust through transformation. When is what’s working worth changing? How internal audit can build trust through transformation. | 9
Disrupting IA by design
People

People have always been a pivotal piece of IA operations. A new workforce has emerged, and organizations are learning There are three core components of
how to adapt and utilize new skill sets and ways of working to operate in the Transformative Age. Chief audit executives talent development that IA should
cannot rely on the standard learning and career development plans of the past. If they did, they would be facing define during their transformation:
unsatisfied and disengaged employees with dwindling skill levels that are not relevant to the business. A people plan that
encompasses innovative and ongoing feedback is a key pillar to IA’s successful transformation and sustaining of results. Learning
The development of tailored, structured formal
learning curriculums to develop soft and technical
skills within internal audit employees.
Key questions to consider
•• How is your staff rotation program currently structured?
Coaching
•• What are the current skill sets of the department?
Meaningful conversations that help develop new
•• What skill sets will be required in the future (e.g., critical thinking, problem solving)
skills and insights and transform learning and
•• How are you enhancing your employees’ experience through technology?
experiences into practice.
•• How do you use technology to better communicate with your colleagues and business partners?
•• How are you using technology to create a more productive and cost-efficient function?
•• How will you maintain employee engagement and retention at a high level? Structured experiences
•• How does your workspace enable an innovative and energized environment? Planned activities that help develop the skills and
•• How is IA impacting the organization? knowledge that are critical to auditor development.
Most individual development comes from everyday
experiences.

Transformation considerations
•• Analyze people considerations such as headcount, sourcing options, talent management and change communications
•• Establish a rotation program enabling team members to work across regions/functions Transforming the people and talent development model
•• Transition to a flexible people resource model (nearshore/offshore hub, flexible workforce, freelance network)
•• Define expectations at each rank and provide feedback on a periodic basis Continuously assess
For each level,
Identify the IA function Develop key performance and update your talent
develop learning maps,
levels for which talent indicators to measure development plan for
coaching opportunities
development plans will the effectiveness of the effectiveness and
and structured
be developed talent development plan keeping pace with
experiences
organizational change

10 | When is what’s working worth changing? How internal audit can build trust through transformation. When is what’s working worth changing? How internal audit can build trust through transformation. | 11
Starting the transformation journey EY contacts

While the definition of the future will only continue to evolve as new technologies emerge, many are beginning their
journey to get ahead of the disruption and remain relevant to their organization. No two transformations will be the
same, and now, more than ever, organizational alignment should be at the heart of each decision.

Creating the plan

•• Define your purpose and communicate that with the organization
•• Build a well-defined transformation road map
•• Evaluate technology in each phase of the IA life cycle
•• Concentrate on future ways of working and changing talent needs as a result of the transformation
•• Encourage team members to innovate and be part of the change – be disruptive!
Amy Brachio Esi Akinosho Lisa Hartkopf
Global Advisory Risk EY Global Advisory IA Leader EY Americas Advisory
and Performance +1 713 750 8670 IA Leader
Improvement Leader [email protected] +1 312 879 2226
+1 612 371 8537 [email protected]
[email protected]

Martin Wiedemann Julia Langdon Hiroyuki Shimamori

EY EMEIA Advisory IA Leader EY Asia-Pacific Advisory EY Japan Advisory IA Leader
+49 711 9881 27466 IA Leader +81 3 3503 1110
[email protected] +61 3 8650 7289 [email protected]
[email protected]

12 | When is what’s working worth changing? How internal audit can build trust through transformation. When is what’s working worth changing? How internal audit can build trust through transformation. | 13
Notes Notes

14 | When is what’s working worth changing? How internal audit can build trust through transformation. When is what’s working worth changing? How internal audit can build trust through transformation. | 15
EY | Assurance | Tax | Transactions | Advisory

About EY
EY is a global leader in assurance, tax, transaction and advisory
services. The insights and quality services we deliver help build
trust and confidence in the capital markets and in economies the
world over. We develop outstanding leaders who team to deliver
on our promises to all of our stakeholders. In so doing, we play a
critical role in building a better working world for our people, for
our clients and for our communities.

EY refers to the global organization, and may refer to one or

more, of the member firms of Ernst & Young Global Limited, each
of which is a separate legal entity. Ernst & Young Global Limited,
a UK company limited by guarantee, does not provide services
to clients. Information about how EY collects and uses personal
data and a description of the rights individuals have under data
protection legislation are available via ey.com/privacy. For more
information about our organization, please visit ey.com.

Ernst & Young LLP is a client-serving member firm of

Ernst & Young Global Limited operating in the US.

© 2019 Ernst & Young LLP.

All Rights Reserved.

EYG no. 002221-19Gbl

1806-2727848

ED None

ey.com