Prepare to Plan or Plan to Fail
Coauthored by Bart Edgerton
As Audit teams start thinking about their 2018 plans, being able to identify new trends in emerging risk areas that threaten to disrupt enterprise performance over the next year is critical. This explains 12 risks, connected by four major risk themes, that organizations need to have on their radar and what Audit teams need to do to more effectively identify and communicate these risks to their organizations and stakeholders.
Global unpredicted events this year – election results, natural disasters, corporate scandals – have heightened executive and board sensitivity towards risk. Consequently, Audit committees are increasingly tasking Internal Audit to provide assurance over a wider set of risks, beyond traditional financial and operational focus areas.
Annually, CEB, now Gartner, surveys more than 200 Audit heads globally on risks that should be top of mind for organizations in the next year. This year, our Audit Plan Hot Spots report identified four overarching themes that underlie the risks that Chief Audit Executives (CAEs) express as critical to including on their audit plans in 2018:
Theme 1: Organizational Dispersion
To lower costs and increase agility, organizations are expanding their use of third parties and nontraditional employment structures. By outsourcing formerly core departments, such as IT infrastructure management and leveraging more contingent or temporary employees, the traditional boundaries of an organization are becoming blurry. This gives rise to three risks in 2018:
An evolving workforce makes strategic workforce planning more difficult. This year marks the first time that five generations have been in the workforce simultaneously. With staff more likely to be mobile or with shorter tenure than before, this situation has created knowledge management challenges for organizations.
Cloud computing has formed a new type of relationship with third parties who hold important data on customers and employees. Information traditionally kept in-house is now managed elsewhere, making oversight more challenging. Further, the fact that the three leading cloud vendors make up 70 percent of the cloud market share has led to unintentional vendor lock-in effects.
Finally, while data privacy is a perennial concern, the forthcoming General Data Protection Regulation (GDPR) in the E.U. will generate a new set of challenges, making organizations responsible for the use of its data by third parties. Data privacy risk is compounded by the regulatory fragmentation, with different regulations being put in place in China and Russia.
For these risks, there are specific audits that should be added to the audit plan, like examining cloud vendor agreements, but there are also factors that can be integrated as a lens across different audits, such as data integrity and talent sufficiency.
Theme 2: Digitalization
The digital transformation of businesses continues to alter the ways in which organizations operate. This leads to many well-publicized risks, but also significant upside. However, to leverage this upside, organizations must overcome the following risks:
Digitalization preparedness is essential for organizations but made more difficult by the rapid pace of automation and use of robotics, both of which require often untrained employees to engage with unfamiliar technologies. Large gaps in digital acumen will need to be overcome in 2018.
Data breaches now happen daily. A majority of these occur because of human error, such as an end-user clicking on a phishing link or IT personnel de-prioritizing systems maintenance and patching. An environment of increasing digital activity compounds these difficulties, making the risk of poor information security behaviors more pronounced.
Increased dependency on IT systems leads organizations to become more vulnerable to disruptions. Such business continuity and disaster recovery (BCDR) concerns have also been brought to light by extreme weather events – such as hurricanes and flooding – that are now occurring more often given the warming climate.
Audit can help the organization tackle these risks by looking at governance over new technology, including behavioral aspects in information security audits and performing comprehensive BCDR audits.
Theme 3: Transparency
Social media has made it easier for outsiders to peer inside organizations. While increased visibility into an enterprise is often a critical feature of an ethical workplace, this also gives outsiders the potential to exploit hidden or unknown vulnerabilities and move fast. This relates to three risks:
Fraud is on the rise, partly because of the increased access to technological tools like Fraud-as-a-Service offerings. This has led to amplified regulatory scrutiny as well as tools that make it easier to examine previously undetectable frauds. The result is increased exposure to both frauds and regulatory action stemming from it.
Employees once had to work at a company in order to attempt to influence its corporate culture. Today’s increased visibility has resulted in growing investor and public scrutiny over corporate culture, often with an emphasis on ethics and diversity. Poor culture is seen as a root cause of recent headlines involving misconduct at a number of organizations.
Finally, the same visibility is leveraged by investors. Shareholder intervention often comes from activist investors seeking shorter-term returns but is also likely to come from passive investors, with long-term concerns like sustainability.
To tackle these, Audit should revisit the scope of its fraud efforts; explore separate culture audits or including cultural aspects in all audits and finally discussing with management whether corporate functions are providing sufficient visibility into potential shareholder interventions.
Theme 4: Regulatory and Market Volatility
Uncertainty has been a key facet of 2017, with business leaders across the globe being unsure what policy outcomes to expect. This uncertainty is manifest in three risks:
Geopolitical uncertainty itself poses a significant risk for many organizations, with global trade largely growing slower than GDP and a severe lack of resolutions to important policy questions in developed markets.
New revenue recognition standards, coming into effect in January, have left organizations unprepared, despite them being years in the making. Most organizations underestimate both the complexity of implementation and changes to the internal control framework that will be required.
Finally, growth and innovation pressures have affected most C-suites. Evolving customer preferences have made it difficult to achieve growth objectives and risk aversion at many organizations. This has also limited their ability to place the right bets on innovation.
Political and growth risks may seem difficult for Audit to tackle, but risk can be mitigated by activities like examining the organizations’ R&D and insurance portfolios. In terms of new revenue recognition standards, these warrant Audit revisiting its internal control framework to see if there is a need to update controls, such as segregation of duties.
Internal Audit’s Challenge
Across 2018, it will be critical for organizations to manage these 12 risks. To do so, Audit must provide assurance over new risks that may not be traditionally part of its portfolio and continue to evolve its assurance approach while maintaining its objectivity and independence.
Malcolm Murray is an Audit research leader at CEB. He works with heads of Audit at Fortune 500 companies to better leverage data analytics, automation and other assurance functions to drive actionable change within their organizations. A Chartered Financial Analyst, originally from Stockholm, Sweden, Malcolm holds an M.Sc. in Business and Economics from the Stockholm School of Economics, an MBA from INSEAD and a Master of International Management from HEC in Paris.
