In control

Views of audit committee chairmen on the effectiveness of internal audit

January 2006

We conducted a series of detailed interviews with audit committee chairmen, representing 49 companies predominantly from the FTSE 100. In this report we present some of their views on internal audit.

Recent changes in UK corporate governance have raised internal audit's role into that of business imperative. This rise is increasing the demands placed upon internal audit and is revealing in stark relief the evolving requirements of the audit committee. Unsurprisingly, each group has been casting around for views as to where best practice might lie. Unfortunately there is no simple answer.

At one extreme, US corporations have allocated extensive internal audit resource to detailed financial controls in response to the requirements of Sarbanes-Oxley. This effort has identified some significant weaknesses which could support a “back to basics” approach in deploying internal audit resource.

An alternative approach argues that focus should be on control over the biggest risks to the organisation. Since in most businesses these risks are strategic and operational, not financial, the end result for internal audit is very different.

This disparity was mirrored in the comments of the chairmen that we interviewed. “It's the head of internal audit's responsibility to make the audit committee chairman aware of everything that he needs to know,” was the view of one.

Another noted that he felt that his internal audit team “lacked the qualifications to do anything outside of the financial controls arena and looking at the disaster recovery plan”.

The responses from audit committee chairmen show that in many companies there are some major challenges to obtaining an effective internal audit function:

• The audit committee are not fully clear about their own expectations and as a result are not clearly driving the assurance agenda,
• They question the skills that their internal audit functions have to fulfil expanding expectations,
• They question the independence of functions that either report directly into, or are substantially controlled, by the finance director,
• They believe that internal audit's role is being shaped by its capabilities and not by the business's need.

There are a number of ways of breaking this impasse, all involving the active participation of the audit committee chairman:

• They should be constantly challenging their head of internal audit to increase the relevance of the work that internal audit does to critical issues on the audit committee's agenda,
• They should periodically ensure that the annual obligatory review of the effectiveness of internal audit is independent, and that its coverage is appropriate,
• When the head of internal audit changes they must be actively engaged in recruiting the replacement.

Please contact Antony Ruddenklau on +44 (0) 20 7213 1194 for a copy of the report.