Gartner surveyed over 300 Chief Audit Executives (CAEs) in 2018 on their resource and time investments, priorities and challenges in 2019. Gartner VP Malcolm Murray examines the report’s key findings on the impact to the audit function.
Today’s audit leaders are grappling with a double-edged sword, according to our latest “state of the audit function” research survey at Gartner. Technology-driven change has the potential to drastically improve the efficiency of routine audit tasks, improve the quality and actionability of the insights audits provide to the business and deepen ownership of risk management in the business. At the same time, however, this shift is creating new risks and business models faster than audit and other assurance functions can keep up with.
Skills
Harnessing data analytics and robotic process automation technology to support audit’s workflow is critical, but it needs new skills. These skills, however, require financial investment. Yet budget growth fell to just 2 percent in 2018, down from 5 percent in 2016 and 2017; therefore, audit needs to get smart about how it uses its scarce skills.
With data and analytics experts in very high demand across all functions, industries and geographies, many audit leaders will struggle to transform their function with new capabilities to cope with higher-velocity business processes in the digital age.
The scarcity of critical skills could explain the rise in prevalence of co-sourced resources in audit functions, with its share of total audit budget creeping up from 8 percent in 2017 to 9 percent in 2018, and 67 percent of organizations saying they used co-sourced audit support in 2018, up from 62 percent in 2017. In any case, whether or not the audit function has the skills it needs, it seems clear that technology-related change will continue to disrupt and expand the range of business activities and processes for which audit must provide assurance.
Checking on Tech
Arguably surprising to no one, cybersecurity and data governance rank the highest in terms of importance to internal audit to provide assurance today. Emerging technologies such as artificial intelligence, robotic process automation and machine learning are among the top risks to be addressed in the next five years. So, we conclude that audit leaders are aware of the tech-related challenges they face and are restructuring their organizations accordingly.
The 2018 survey data also shows that 85 percent of organizations have a dedicated IT audit function in 2018, up from 71 percent in 2016. Moreover, 59 percent of respondents have dedicated data analytics audit teams, up from 46 percent in 2016. The size of the dedicated IT audit team has increased slightly, from four FTEs in 2016 to five in 2018.
Those data points are encouraging, but also a cause for concern. The median data analytics audit team size remains small, at two FTEs, and 4 percent of large companies with revenue of over $20 billion did not have a dedicated IT audit function.
2019 Priorities
Looking at the top challenges for 2019, Figure 1 below shows the multitude of varying issues competing for audit leaders’ attention and resources.
Figure 1: Audit 2019 Priorities Ranked by Urgency
(Percentage of Organizations Including Among Their Top Five)
Concerns regarding the pace of business change and technology and skill shortages are clearly prevalent in Figure 1. It’s also illuminating that audit is still working on coordinating with other assurance functions and shifting the business’s perception of audit.
There is a strong theme here that the practical realities of digital risk mean it cannot be sufficiently mitigated by the audit function alone, nor any single assurance function. A big challenge will be to convince the wider business that risk is not just something for someone else in the organization to worry about, but rather something the business must take ownership of.
Budgets, Staffing and Development
With so many new challenges and a shortage of skills, audit leadership is also investing more in training and development opportunities. Despite slowing budget growth overall, the budget for training and development increased from 0.91 percent of the department’s overall budget in 2017 to 1.38 percent in 2018.
While this is a big increase in percentage terms, it’s unlikely to stop the skills gap from widening as digital transformation picks up pace. To put this into perspective, the average audit team in 2018 spent more than double on travel and expenses what it spent on training and development, and the budget spent on wages and compensation in 2018 was on average 60 times more than on training and development.
Given the rising premium on advanced digital skills and the clear concerns about coping with the manifold challenges audit leaders face, it is time for audit to think creatively about how it can start to operate differently to better use these scarce skills.
Read Gartner’s take on the current state of the ERM function here.
Malcolm Murray is Research VP and Fellow at Gartner. He works with heads of Audit at Fortune 500 companies to better leverage data analytics, automation and other assurance functions to drive actionable change within their organizations. A Chartered Financial Analyst, originally from Stockholm, Sweden, Malcolm holds an M.Sc. in Business and Economics from the Stockholm School of Economics, an MBA from INSEAD and a Master of International Management from HEC in Paris. 
