Sunday, December 8, 2019
Corporate Compliance Insights
  • Home
    • Home
  • About
    • About CCI
    • Writing for CCI
    • Advertise With Us
  • Articles
    • See All Articles
    • Compliance
    • Ethics
    • Risk
    • FCPA
    • Governance
    • Fraud
    • Audit
    • HR Compliance
    • Cybersecurity
    • Data Privacy
    • Financial Services
    • Leadership and Career
  • Industry News
  • Jobs
  • Events
    • Webinars & Events
    • Submit an Event
  • Downloads
    • eBooks
    • Whitepapers
  • Podcasts
  • Videos
  • Subscribe
No Result
View All Result
  • Home
    • Home
  • About
    • About CCI
    • Writing for CCI
    • Advertise With Us
  • Articles
    • See All Articles
    • Compliance
    • Ethics
    • Risk
    • FCPA
    • Governance
    • Fraud
    • Audit
    • HR Compliance
    • Cybersecurity
    • Data Privacy
    • Financial Services
    • Leadership and Career
  • Industry News
  • Jobs
  • Events
    • Webinars & Events
    • Submit an Event
  • Downloads
    • eBooks
    • Whitepapers
  • Podcasts
  • Videos
  • Subscribe
No Result
View All Result
Corporate Compliance Insights
Home Audit

4 Major Audit Risk Themes for 2018

by Malcolm Murray
December 4, 2017
in Audit
business planning

Prepare to Plan or Plan to Fail

Coauthored by Bart Edgerton

As Audit teams start thinking about their 2018 plans, being able to identify new trends in emerging risk areas that threaten to disrupt enterprise performance over the next year is critical. This explains 12 risks, connected by four major risk themes, that organizations need to have on their radar and what Audit teams need to do to more effectively identify and communicate these risks to their organizations and stakeholders.

Global unpredicted events this year – election results, natural disasters, corporate scandals – have heightened executive and board sensitivity towards risk. Consequently, Audit committees are increasingly tasking Internal Audit to provide assurance over a wider set of risks, beyond traditional financial and operational focus areas.

Annually, CEB, now Gartner, surveys more than 200 Audit heads globally on risks that should be top of mind for organizations in the next year. This year, our Audit Plan Hot Spots report identified four overarching themes that underlie the risks that Chief Audit Executives (CAEs) express as critical to including on their audit plans in 2018:

Theme 1: Organizational Dispersion

To lower costs and increase agility, organizations are expanding their use of third parties and nontraditional employment structures. By outsourcing formerly core departments, such as IT infrastructure management and leveraging more contingent or temporary employees, the traditional boundaries of an organization are becoming blurry. This gives rise to three risks in 2018:

An evolving workforce makes strategic workforce planning more difficult. This year marks the first time that five generations have been in the workforce simultaneously. With staff more likely to be mobile or with shorter tenure than before, this situation has created knowledge management challenges for organizations.

Cloud computing has formed a new type of relationship with third parties who hold important data on customers and employees. Information traditionally kept in-house is now managed elsewhere, making oversight more challenging. Further, the fact that the three leading cloud vendors make up 70 percent of the cloud market share has led to unintentional vendor lock-in effects.

Finally, while data privacy is a perennial concern, the forthcoming General Data Protection Regulation (GDPR) in the E.U. will generate a new set of challenges, making organizations responsible for the use of its data by third parties. Data privacy risk is compounded by the regulatory fragmentation, with different regulations being put in place in China and Russia.

For these risks, there are specific audits that should be added to the audit plan, like examining cloud vendor agreements, but there are also factors that can be integrated as a lens across different audits, such as data integrity and talent sufficiency.

Theme 2: Digitalization

The digital transformation of businesses continues to alter the ways in which organizations operate. This leads to many well-publicized risks, but also significant upside. However, to leverage this upside, organizations must overcome the following risks:

Digitalization preparedness is essential for organizations but made more difficult by the rapid pace of automation and use of robotics, both of which require often untrained employees to engage with unfamiliar technologies. Large gaps in digital acumen will need to be overcome in 2018.

Data breaches now happen daily. A majority of these occur because of human error, such as an end-user clicking on a phishing link or IT personnel de-prioritizing systems maintenance and patching. An environment of increasing digital activity compounds these difficulties, making the risk of poor information security behaviors more pronounced.

Increased dependency on IT systems leads organizations to become more vulnerable to disruptions. Such business continuity and disaster recovery (BCDR) concerns have also been brought to light by extreme weather events – such as hurricanes and flooding – that are now occurring more often given the warming climate.

Audit can help the organization tackle these risks by looking at governance over new technology, including behavioral aspects in information security audits and performing comprehensive BCDR audits.

Theme 3: Transparency

Social media has made it easier for outsiders to peer inside organizations. While increased visibility into an enterprise is often a critical feature of an ethical workplace, this also gives outsiders the potential to exploit hidden or unknown vulnerabilities and move fast. This relates to three risks:

Fraud is on the rise, partly because of the increased access to technological tools like Fraud-as-a-Service offerings. This has led to amplified regulatory scrutiny as well as tools that make it easier to examine previously undetectable frauds. The result is increased exposure to both frauds and regulatory action stemming from it.

Employees once had to work at a company in order to attempt to influence its corporate culture. Today’s increased visibility has resulted in growing investor and public scrutiny over corporate culture, often with an emphasis on ethics and diversity. Poor culture is seen as a root cause of recent headlines involving misconduct at a number of organizations.

Finally, the same visibility is leveraged by investors. Shareholder intervention often comes from activist investors seeking shorter-term returns but is also likely to come from passive investors, with long-term concerns like sustainability.

To tackle these, Audit should revisit the scope of its fraud efforts; explore separate culture audits or including cultural aspects in all audits and finally discussing with management whether corporate functions are providing sufficient visibility into potential shareholder interventions.

Theme 4: Regulatory and Market Volatility

Uncertainty has been a key facet of 2017, with business leaders across the globe being unsure what policy outcomes to expect. This uncertainty is manifest in three risks:

Geopolitical uncertainty itself poses a significant risk for many organizations, with global trade largely growing slower than GDP and a severe lack of resolutions to important policy questions in developed markets.

New revenue recognition standards, coming into effect in January, have left organizations unprepared, despite them being years in the making. Most organizations underestimate both the complexity of implementation and changes to the internal control framework that will be required.

Finally, growth and innovation pressures have affected most C-suites. Evolving customer preferences have made it difficult to achieve growth objectives and risk aversion at many organizations. This has also limited their ability to place the right bets on innovation.

Political and growth risks may seem difficult for Audit to tackle, but risk can be mitigated by activities like examining the organizations’ R&D and insurance portfolios. In terms of new revenue recognition standards, these warrant Audit revisiting its internal control framework to see if there is a need to update controls, such as segregation of duties.

Internal Audit’s Challenge

Across 2018, it will be critical for organizations to manage these 12 risks. To do so, Audit must provide assurance over new risks that may not be traditionally part of its portfolio and continue to evolve its assurance approach while maintaining its objectivity and independence.


Tags: Cloud Compliancecorporate cultureData Privacythird party risk management
Previous Post

Six Questions with an Ethics & Compliance Officer: Ling-Ling Nie

Next Post

AI & Data Analytics: The Fraud Mitigation Dream Team

Malcolm Murray

Malcolm Murray is Research VP and Fellow at Gartner. He works with heads of Audit at Fortune 500 companies to better leverage data analytics, automation and other assurance functions to drive actionable change within their organizations. A Chartered Financial Analyst, originally from Stockholm, Sweden, Malcolm holds an M.Sc. in Business and Economics from the Stockholm School of Economics, an MBA from INSEAD and a Master of International Management from HEC in Paris.

Related Posts

engineer tinkering with robot brain

Artificial Intelligence: Building the Foundation for Internal Audits that Deliver Value

October 22, 2019
illustration of scattered financial reports on green background

Financial Reporting Control Considerations

September 18, 2019
The word "agile" imposed on amorphous shape

3 Ways Internal Audit Can Strike a Balance Between Productivity and Control

July 3, 2019
red paper airplane breaking away from group of white paper airplanes flying in formation

Internal Audit’s Changing Role in a Changing Technological Environment

May 7, 2019
Next Post
business group high five

AI & Data Analytics: The Fraud Mitigation Dream Team

Free Downloads

OFAC whitepaper cover
Compliance Job Interview Q&A
Reputation Risk Management Research

RSS SEC Litigation News

  • Iconix Brand Group, Inc., Neil R. Cole and Seth Horowitz December 5, 2019
    SEC Charges Iconix Brand Group and Former Top Executives with Accounting Fraud
  • Lester Burroughs December 5, 2019
    SEC Charges Connecticut Man with Defrauding Retail Investors
  • SBB Research Group LLC, et al. December 4, 2019
    SEC Charges Hedge Fund Adviser and Top Executives with Fraud

Jump to a Topic:

anti-corruption anti-money laundering/AML Artificial Intelligence/A.I. automation banks Big Data blockchain board of directors board risk oversight bribery CCPA/California Consumer Privacy Act Cloud Compliance communications management corporate culture corporate governance culture of ethics cyber risk data analytics data breach data governance decision-making Dodd-Frank DOJ due diligence fcpa enforcement actions GDPR GRC HIPAA information security internal audit internet of things (IoT) KYC/know your customer machine learning monitoring regtech reputation risk risk assessment Sanctions SEC social media risk technology third party risk management tone at the top training whistleblowing
No Result
View All Result

Privacy Policy

Follow Us

  • Facebook
  • Twitter
  • LinkedIn
  • RSS Feed

Category

  • Audit
  • Compliance
  • Compliance Podcasts
  • Cybersecurity
  • Data Privacy
  • eBooks
  • Ethics
  • FCPA
  • Featured
  • Financial Services
  • Fraud
  • Governance
  • HR Compliance
  • Leadership and Career
  • News
  • Opinion
  • Resource Library
  • Risk
  • Uncategorized
  • Videos
  • Webinars
  • Whitepapers

© 2019 Corporate Compliance Insights

No Result
View All Result
  • Home
  • About
  • Articles
  • News
  • Podcasts
  • Videos
  • Whitepapers
  • eBooks
  • Events
  • Jobs
  • Subscribe

© 2019 Corporate Compliance Insights