Decrease of Internal Audit Staff During Recession
A recent article in WebCPA, Internal Audit Staff Hit Hard by Recession, discussed a survey performed by the Institute of Internal Auditors indicating that internal audit department staffing levels had been significantly decreased in 2008 and 2009. Although auditors, and financial personnel in general, should in no way be exempt from the pain of budget and resource cuts, the reduction of internal audit personnel raises some concerns and highlights the need for internal audit departments to not lose focus of being a value-added business partner.
In times of economic crisis, the inherent risk of employee fraud increases significantly. As the commodity of jobs becomes more scarce, and the supply of qualified employees increases, an individual’s concern regarding the safety of his/her continued employment at a company increases. This stress worsens with the knowledge that companies are having to shed costs and resources in order to remain solvent and that the job market is too lean to be guaranteed finding similar employment before severance runs out. Coupled together, these facts can result in employees that would never stray from the ethical path beginning to minimizing, or even falsify, negative results in management reports. The role of an internal auditor to identify fraudulent activities before a company makes decisions using falsified data becomes even more important due to this increased risk. The reduction of already thinly-staffed internal audit departments, however, reduces the ability of audit departments to perform more than a minimum assurance service, resulting in no mitigation of the increased risk. Therefore, the reduction of internal audit staff during poor economic periods may result in increased risk going unchecked and could threaten the solvency of a company that would otherwise have weathered the troubled waters unscathed.
Internal audit departments should not, however, believe themselves to be too great a savior against corporate risk to lose sight of their role as a value-added business partner. It is too easy for an internal audit department to focus on the Audit Plan at the exclusion of all other opportunities. It must be remembered that an Audit Plan is simply a plan; it should not be viewed as a map through a minefield – strictly adhered to without deviation. Rather, the Audit Plan is like the North Star when navigating the ocean – use it as your guiding light, but deviate when new opportunities present themselves. As soon as an audit department stops responding to business-unit requests and only follows the audit plan, the stagnancy quickly results in decreased perceived benefits to a corporation, which will rightly result in decisions to decrease staff. No communication from an internal audit department should ever read, “Due to competing priorities that our auditors have, as well as an aggressive audit schedule, we will not be able to review your request.” With one letter, an internal audit department can quickly cease to be an internal, value-added, business partner.
Responsiveness to business-unit requests, however, does present the valid concern of maintaining independence of a process. Attribute Standard 1100 of the Professional Practices Framework (PPF) issued by the Institute of Internal Auditors states that “[t]he internal audit activity must be independent, and internal auditors must be objective in performing their work.” The standards go on to state that this means that the audit organization must report to the appropriate level of an organization for corporate management to have undue influence. Additionally, an individual auditor’s independence, or perceived independence, may be impaired if (s)he audits an area over which (s)he previously had responsibilities (within a period specified in the PPF). As one of the very first attribute standards, it is obvious to note the importance of independence and objectivity in performing an audit. Independence, however, should not become an excuse that prevents an auditor from rendering assistance to departments in need. Internal audit department management should not prevent auditors from providing value-added recommendations because “development of the detailed plan is Management’s responsibility, not the Auditor’s” or because of a false notion that the recommendation would impair independence. To remain useful to an organization, and truly be a partner in the business, internal auditors must be allowed to render any value-added assistance to management. The internal auditor cannot take control or ownership of a process, but they can still render an opinion, provide a recommendation of how to analyze an issue, or even just give the benefit of a second set of eyes on a document. Sometimes the simplest task can provide the most value, even if it is not a specific task noted in the audit charter. Providing that service, however, reinforces to individual employees and business units that the internal audit department is a partner in the business.
Internal audit departments are a necessary part of managing a business, but should not be perceived as simply that. They must leverage themselves to show their ever-increasing importance during economic troubles resulting in increased corporate risk. They must also prove themselves to be a partner in the business, willing to lend a helping hand when needed. The audit plan is an important in navigating annual audit priorities, but it should not be viewed as the only path to travel. Independence is one of the most important qualities for an auditor to maintain, but it should not become shackles that prevent aid from being provided to an employee requesting assistance. Therefore, a properly leveraged and executed internal audit department should never have its resources reduced during a recession. When this occurs, it should raise concerns as to the internal-control monitoring at a company, but it should also become an opportunity for an internal audit department to evaluate the value that it adds and make the necessary change to not become a corporate function, but truly be a partner in the operations of the organization.
