Blogs Harold Silverman, CIA, CRMA, QIAL, CPA Mar 16, 2022
Harold Silverman discusses the North American Pulse of Internal Audit, past and present. He also explains why the type of metrics found in the Pulse are so valuable, especially to CAEs seeking to add more value to the organization or take on greater roles and responsibilities.
HAROLD SILVERMAN, CIA, CRMA, QIAL, CPA
In the fall of 2008, I got my first opportunity to become a CAE. I had the added challenge of being tasked with building an internal audit function from scratch. My experiences leading up to that moment, along with great mentors and an active network of peers that I had developed as a global volunteer for The IIA, gave me confidence that I had the skills to be an effective CAE.
That being said, I wasn't properly prepared for the first executive session I had with my new audit committee. They asked a question that I expect all audit leaders have faced, namely, "How does our audit function compare with others?"
That same year, The IIA did its first survey of audit leaders across North America for what would eventually become the North American Pulse of Internal Audit. During my years as an active CAE, I looked forward to the annual survey and the ensuing report. The Pulse provided me with a plethora of metrics that allowed me to benchmark my perspectives on risk, how my audit plan was divided across risks, where I reported in my organization, and whether budgets were increasing or decreasing. The Pulse sneak peek during the Sunday executive forum preceding the GAM conference was always a highlight of my year.
The 2022 North American Pulse of Internal Audit, released again this year at GAM, is as valuable as ever. Like the early editions of the Pulse, which were released in the shadow of a global recession, this year's responses from more than 500 CAEs gives us a flavor of how the profession is rebounding from the global pandemic. The results are mixed. The percentage of internal audit functions reducing their budgets (18%) and staffing (12%) have come back to more normal pre-pandemic levels. However, the percentage increasing their budget (24%) is the second lowest in the history of the Pulse, only a bit higher than last year. Of course, organizations in different sectors and industries are affected differently, so the report breaks down many of the metrics, including these, by organization type for more useful benchmarking.
Not surprisingly, cybersecurity, other IT risks, and third-party related risks continue to be the highest-rated risks according to CAEs. Interestingly, given the accelerated emphasis around ESG topics, the percentage of CAEs who consider sustainability a very high or high risk — while still much lower than cybersecurity — tripled from the prior year. This was particularly noteworthy amongst CAEs serving publicly traded organizations, of which 22% consider it a very high or high risk, up from only 6% in 2021.
In addition to benchmarking how the profession is responding to the ongoing effects of the global pandemic, this year's Pulse also explores other interesting facets of leading an internal audit function, particularly the roles that internal audit leaders play in their organizations. For example, the report compares the audit plan focus of functions that are responsible for SOX versus those that are not. Further, for the first time, the Pulse measures the frequency of CAEs having responsibility for adjacent roles in their organizations, including those managing the enterprise risk management program, conducting fraud investigations, and overseeing the ethics/whistleblower programs. About 80% of respondents note that they have some other responsibility. Of course, the frequency of having these additional responsibilities varies heavily across organization types. To a CAE, particularly in a less regulated or mature organization, these types of metrics are invaluable, especially when seeking to add more value to the organization or being asked to take on greater roles and responsibilities.
In my opinion, the most interesting chart in the report involves the question posed to CAEs on the impact of COVID-19 on their respective organizations. As one might expect, more than three times as many respondents note that the impact was negative (46%) as note it was positive (14%). However, among the 11% of respondents who would be classified as Millennials, the numbers are quite different. Only 26% of Millennials note that the impact was negative, with 33% believing that the impact was ultimately positive. I have a number of theories as to what drives this different impression of the impact on organizations, including the potential perception that a shift to remote working environments and investments in technology — topics also covered in this year's Pulse — are seen as net positive outcomes.
Just as it did for me a little more than a decade ago, the Pulse continues to provide value to CAES, helping them to answer those comparison questions posed by their stakeholders. Now as the director of executive membership at the IIA, I love that it can also drive discussions. I encourage my peers in the profession to download the Pulse and let me know what stands out to you.
In an era where disruptive change has become the norm, the need for accurate and reliable benchmarking is paramount.
Member and Non-Member Access