The growing audit control gaps can result in higher organisational risk, said Gartner recently when releasing results of its survey of 200 audit business partners in February.
Survey highlights
- 56% of respondents said they were facing more changes in the last two years and a large majority agreed these changes were both bigger (81%) and faster (74%)
- The pace of change is set to continue with 65% of executives expecting significant transformation in their industry over the next two years.
“For audit leaders, the real problem is not the change itself,” said Ian Beale vice president, advisory at Gartner. “The problem, according to 95% of 135 chief audit executive (CAEs) is that implementing a project or process change regularly leads to control gaps.”
High levels of change are creating control gaps that in turn are creating significant organisational risks, said Beale.
“Audit leaders must firstly improve their visibility into changes happening in their organisation and secondly develop the capability to deploy audit resources faster when changes arise,” he advised.
Improve visibility into change
Most internal audit functions are already on a journey to improve visibility into areas undergoing changes, according to Beale.
Three years ago, many functions pursued real-time assurance and sought to better leverage data to get a more comprehensive and real-time view of risk, he added.
A year ago, audit leaders were focused on attracting more information from business partners about changes to enable foresight and also by equipping their auditors to better articulate how audit can help management avoid problems and when to ask, Gartner noted.
Today, audit leaders are being more proactive, actively seeking more conversation with other assurance functions, better access to senior management, the board, executive and steering committees, by liaising with other assurance teams, the advisory firm added.
This is all about getting earlier knowledge of changes, so that there is more time to make necessary audit resource adjustments and avoid control gaps, said Beale.
“However, visibility alone doesn’t solve challenges that arise from resource allocation problems,” Beale pointed out. “Improving the speed of audit deployment is also an important part of mitigating control gaps.”
Enable faster audit resource deployment
There are several reasons why visibility doesn’t lead to faster audit deployment, according to Gartner.
Often audit’s resources are already full allocated, requiring auditors to stop or hold one thing to take on another, the firm observed.
Audit engagements are designed for end-to-end execution, and this tends to limit the movement of auditors until their current engagement is complete, the firm added.
The audit plan—rigorously developed and agreed with stakeholders—can have a lot of inertia that is hard to stop or change once it is in motion, and therefore it can hamper audit’s response in the face of change, Beale said.
“To respond more effectively to the levels of change that organizations are experiencing, audit leaders must look beyond improving visibility into changes and aim for what Gartner calls ‘real-time resourcing’ of their engagements,” Beale advised.
Real-time resourcing
There are some simple steps that many CAEs don’t take which can significantly improve audit’s ability to deploy faster and therefore close control gaps arising from process or project changes, he pointed out.
For example, just 30% of the 135 CAEs surveyed this year said they broke audit engagements into individual tasks that can be executed separately while 6% said they brought staff into audit engagements as needed rather than a full engagement on each occasion, he observed.
“Audit leaders have traditionally focused on getting earlier visibility into control gaps arising from process or project changes,” said Beale. “But in doing so they have tended to overlook small adjustments to how audit resources are deployed that will also have a significant impact on audit getting to control gaps on time.”
