No Result
View All Result
SUBSCRIBE | NO FEES, NO PAYWALLS
MANAGE MY SUBSCRIPTION
NEWSLETTER
Corporate Compliance Insights
  • Home
  • About
    • About CCI
    • Writing for CCI
    • NEW: CCI Press – Book Publishing
    • Advertise With Us
  • Explore Topics
    • See All Articles
    • Compliance
    • Ethics
    • Risk
    • FCPA
    • Governance
    • Fraud
    • Internal Audit
    • HR Compliance
    • Cybersecurity
    • Data Privacy
    • Financial Services
    • Well-Being at Work
    • Leadership and Career
    • Opinion
  • Vendor News
  • Career Connection
  • Events
    • Calendar
    • Submit an Event
  • Library
    • Whitepapers & Reports
    • eBooks
    • CCI Press & Compliance Bookshelf
  • Podcasts
  • Videos
  • Subscribe
  • Home
  • About
    • About CCI
    • Writing for CCI
    • NEW: CCI Press – Book Publishing
    • Advertise With Us
  • Explore Topics
    • See All Articles
    • Compliance
    • Ethics
    • Risk
    • FCPA
    • Governance
    • Fraud
    • Internal Audit
    • HR Compliance
    • Cybersecurity
    • Data Privacy
    • Financial Services
    • Well-Being at Work
    • Leadership and Career
    • Opinion
  • Vendor News
  • Career Connection
  • Events
    • Calendar
    • Submit an Event
  • Library
    • Whitepapers & Reports
    • eBooks
    • CCI Press & Compliance Bookshelf
  • Podcasts
  • Videos
  • Subscribe
No Result
View All Result
Corporate Compliance Insights
Home Internal Audit

4 Major Audit Risk Themes for 2018

by Malcolm Murray
December 4, 2017
in Internal Audit
business planning

Prepare to Plan or Plan to Fail

Coauthored by Bart Edgerton

As Audit teams start thinking about their 2018 plans, being able to identify new trends in emerging risk areas that threaten to disrupt enterprise performance over the next year is critical. This explains 12 risks, connected by four major risk themes, that organizations need to have on their radar and what Audit teams need to do to more effectively identify and communicate these risks to their organizations and stakeholders.

Global unpredicted events this year – election results, natural disasters, corporate scandals – have heightened executive and board sensitivity towards risk. Consequently, Audit committees are increasingly tasking Internal Audit to provide assurance over a wider set of risks, beyond traditional financial and operational focus areas.

Annually, CEB, now Gartner, surveys more than 200 Audit heads globally on risks that should be top of mind for organizations in the next year. This year, our Audit Plan Hot Spots report identified four overarching themes that underlie the risks that Chief Audit Executives (CAEs) express as critical to including on their audit plans in 2018:

Theme 1: Organizational Dispersion

To lower costs and increase agility, organizations are expanding their use of third parties and nontraditional employment structures. By outsourcing formerly core departments, such as IT infrastructure management and leveraging more contingent or temporary employees, the traditional boundaries of an organization are becoming blurry. This gives rise to three risks in 2018:

An evolving workforce makes strategic workforce planning more difficult. This year marks the first time that five generations have been in the workforce simultaneously. With staff more likely to be mobile or with shorter tenure than before, this situation has created knowledge management challenges for organizations.

Cloud computing has formed a new type of relationship with third parties who hold important data on customers and employees. Information traditionally kept in-house is now managed elsewhere, making oversight more challenging. Further, the fact that the three leading cloud vendors make up 70 percent of the cloud market share has led to unintentional vendor lock-in effects.

Finally, while data privacy is a perennial concern, the forthcoming General Data Protection Regulation (GDPR) in the E.U. will generate a new set of challenges, making organizations responsible for the use of its data by third parties. Data privacy risk is compounded by the regulatory fragmentation, with different regulations being put in place in China and Russia.

For these risks, there are specific audits that should be added to the audit plan, like examining cloud vendor agreements, but there are also factors that can be integrated as a lens across different audits, such as data integrity and talent sufficiency.

Theme 2: Digitalization

The digital transformation of businesses continues to alter the ways in which organizations operate. This leads to many well-publicized risks, but also significant upside. However, to leverage this upside, organizations must overcome the following risks:

Digitalization preparedness is essential for organizations but made more difficult by the rapid pace of automation and use of robotics, both of which require often untrained employees to engage with unfamiliar technologies. Large gaps in digital acumen will need to be overcome in 2018.

Data breaches now happen daily. A majority of these occur because of human error, such as an end-user clicking on a phishing link or IT personnel de-prioritizing systems maintenance and patching. An environment of increasing digital activity compounds these difficulties, making the risk of poor information security behaviors more pronounced.

Increased dependency on IT systems leads organizations to become more vulnerable to disruptions. Such business continuity and disaster recovery (BCDR) concerns have also been brought to light by extreme weather events – such as hurricanes and flooding – that are now occurring more often given the warming climate.

Audit can help the organization tackle these risks by looking at governance over new technology, including behavioral aspects in information security audits and performing comprehensive BCDR audits.

Theme 3: Transparency

Social media has made it easier for outsiders to peer inside organizations. While increased visibility into an enterprise is often a critical feature of an ethical workplace, this also gives outsiders the potential to exploit hidden or unknown vulnerabilities and move fast. This relates to three risks:

Fraud is on the rise, partly because of the increased access to technological tools like Fraud-as-a-Service offerings. This has led to amplified regulatory scrutiny as well as tools that make it easier to examine previously undetectable frauds. The result is increased exposure to both frauds and regulatory action stemming from it.

Employees once had to work at a company in order to attempt to influence its corporate culture. Today’s increased visibility has resulted in growing investor and public scrutiny over corporate culture, often with an emphasis on ethics and diversity. Poor culture is seen as a root cause of recent headlines involving misconduct at a number of organizations.

Finally, the same visibility is leveraged by investors. Shareholder intervention often comes from activist investors seeking shorter-term returns but is also likely to come from passive investors, with long-term concerns like sustainability.

To tackle these, Audit should revisit the scope of its fraud efforts; explore separate culture audits or including cultural aspects in all audits and finally discussing with management whether corporate functions are providing sufficient visibility into potential shareholder interventions.

Theme 4: Regulatory and Market Volatility

Uncertainty has been a key facet of 2017, with business leaders across the globe being unsure what policy outcomes to expect. This uncertainty is manifest in three risks:

Geopolitical uncertainty itself poses a significant risk for many organizations, with global trade largely growing slower than GDP and a severe lack of resolutions to important policy questions in developed markets.

New revenue recognition standards, coming into effect in January, have left organizations unprepared, despite them being years in the making. Most organizations underestimate both the complexity of implementation and changes to the internal control framework that will be required.

Finally, growth and innovation pressures have affected most C-suites. Evolving customer preferences have made it difficult to achieve growth objectives and risk aversion at many organizations. This has also limited their ability to place the right bets on innovation.

Political and growth risks may seem difficult for Audit to tackle, but risk can be mitigated by activities like examining the organizations’ R&D and insurance portfolios. In terms of new revenue recognition standards, these warrant Audit revisiting its internal control framework to see if there is a need to update controls, such as segregation of duties.

Internal Audit’s Challenge

Across 2018, it will be critical for organizations to manage these 12 risks. To do so, Audit must provide assurance over new risks that may not be traditionally part of its portfolio and continue to evolve its assurance approach while maintaining its objectivity and independence.


Tags: Cloud ComplianceCorporate CultureThird Party Risk Management
Previous Post

Six Questions with an Ethics & Compliance Officer: Ling-Ling Nie

Next Post

AI & Data Analytics: The Fraud Mitigation Dream Team

Malcolm Murray

Malcolm Murray

Malcolm Murray is Research VP and Fellow at Gartner. He works with heads of Audit at Fortune 500 companies to better leverage data analytics, automation and other assurance functions to drive actionable change within their organizations. A Chartered Financial Analyst, originally from Stockholm, Sweden, Malcolm holds an M.Sc. in Business and Economics from the Stockholm School of Economics, an MBA from INSEAD and a Master of International Management from HEC in Paris.

Related Posts

credit score gauge

Sales at All Costs? Unified Credit Risk Management Can Squash Bad Deals Before They Happen

by Matthew Debbage
March 15, 2023

The collapse of a business doesn’t usually happen all at once. There are warning signs. Late payments, legal filings and...

ProcessUnity Unify Third Party Risk and Cybersecurity Whitepaper-f

Unify Third Party Risk & Cybersecurity for Sustainable Resiliency

by Corporate Compliance Insights
March 14, 2023

Align risk reduction efforts by bringing together third-party and cybersecurity functions White Paper Unify Third-Party Risk & Cybersecurity for Sustainable...

cloud computing security

Cloud Security Isn’t Just on Your Provider; It’s Your Job, Too

by Wolters Kluwer
March 1, 2023

Organizations want to embrace all the benefits the cloud has to offer while still protecting their sensitive data. Engaging a...

risk cliff

Gartner: 84% of Enterprise Risk Management Teams Have Overlooked a Third-Party Issue

by Staff and Wire Reports
February 21, 2023

A staggering eight in 10 executive risk committee members say their organizations have experienced operations disruptions due to a third-party...

Next Post
business group high five

AI & Data Analytics: The Fraud Mitigation Dream Team

Compliance Job Interview Q&A

Jump to a Topic

AML Anti-Bribery Anti-Corruption Artificial Intelligence (AI) Automation Banking Board of Directors Board Risk Oversight Business Continuity Planning California Consumer Privacy Act (CCPA) Code of Conduct Communications Management Corporate Culture COVID-19 Cryptocurrency Culture of Ethics Cybercrime Cyber Risk Data Analytics Data Breach Data Governance DOJ Download Due Diligence Enterprise Risk Management (ERM) ESG FCPA Enforcement Actions Financial Crime Financial Crimes Enforcement Network (FinCEN) GDPR HIPAA Know Your Customer (KYC) Machine Learning Monitoring RegTech Reputation Risk Risk Assessment SEC Social Media Risk Supply Chain Technology Third Party Risk Management Tone at the Top Training Whistleblowing
No Result
View All Result

Privacy Policy

Founded in 2010, CCI is the web’s premier global independent news source for compliance, ethics, risk and information security. 

Got a news tip? Get in touch. Want a weekly round-up in your inbox? Sign up for free. No subscription fees, no paywalls. 

Follow Us

Browse Topics:

  • CCI Press
  • Compliance
  • Compliance Podcasts
  • Cybersecurity
  • Data Privacy
  • eBooks Published by CCI
  • Ethics
  • FCPA
  • Featured
  • Financial Services
  • Fraud
  • Governance
  • GRC Vendor News
  • HR Compliance
  • Internal Audit
  • Leadership and Career
  • On Demand Webinars
  • Opinion
  • Resource Library
  • Risk
  • Uncategorized
  • Videos
  • Webinars
  • Well-Being
  • Whitepapers

© 2022 Corporate Compliance Insights

No Result
View All Result
  • Home
  • About
    • About CCI
    • Writing for CCI
    • NEW: CCI Press – Book Publishing
    • Advertise With Us
  • Explore Topics
    • See All Articles
    • Compliance
    • Ethics
    • Risk
    • FCPA
    • Governance
    • Fraud
    • Internal Audit
    • HR Compliance
    • Cybersecurity
    • Data Privacy
    • Financial Services
    • Well-Being at Work
    • Leadership and Career
    • Opinion
  • Vendor News
  • Career Connection
  • Events
    • Calendar
    • Submit an Event
  • Library
    • Whitepapers & Reports
    • eBooks
    • CCI Press & Compliance Bookshelf
  • Podcasts
  • Videos
  • Subscribe

© 2022 Corporate Compliance Insights

Welcome to CCI. This site uses cookies. Please click OK to accept. Privacy Policy
Cookie settingsACCEPT
Manage consent

Privacy Overview

This website uses cookies to improve your experience while you navigate through the website. Out of these, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities of the website. We also use third-party cookies that help us analyze and understand how you use this website. These cookies will be stored in your browser only with your consent. You also have the option to opt-out of these cookies. But opting out of some of these cookies may affect your browsing experience.
Necessary
Always Enabled
Necessary cookies are absolutely essential for the website to function properly. These cookies ensure basic functionalities and security features of the website, anonymously.
CookieDurationDescription
cookielawinfo-checbox-analytics11 monthsThis cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Analytics".
cookielawinfo-checbox-functional11 monthsThe cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional".
cookielawinfo-checbox-others11 monthsThis cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Other.
cookielawinfo-checkbox-necessary11 monthsThis cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary".
cookielawinfo-checkbox-performance11 monthsThis cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance".
viewed_cookie_policy11 monthsThe cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data.
Functional
Functional cookies help to perform certain functionalities like sharing the content of the website on social media platforms, collect feedbacks, and other third-party features.
Performance
Performance cookies are used to understand and analyze the key performance indexes of the website which helps in delivering a better user experience for the visitors.
Analytics
Analytical cookies are used to understand how visitors interact with the website. These cookies help provide information on metrics the number of visitors, bounce rate, traffic source, etc.
Advertisement
Advertisement cookies are used to provide visitors with relevant ads and marketing campaigns. These cookies track visitors across websites and collect information to provide customized ads.
Others
Other uncategorized cookies are those that are being analyzed and have not been classified into a category as yet.
SAVE & ACCEPT