‘Relentless Change’ Creates More Audit Control Gaps and Risks
A 2021 Gartner survey of 200 audit business partners revealed that over half (56%) of respondents said they were facing more changes in the last two years, and a large majority agreed these changes were both bigger (81%) and faster (74%). the pace of change is set to continue with 65% of executives expecting significant transformation in their industry over the next two years.
“For audit leaders, the real problem is not the change itself,” said Ian Beale, vice president, advisory at Gartner. “The problem, according to 95% of 135 chief audit executives (CAEs) we polled last year, is that implementing a project or process change regularly leads to control gaps.”
Many audit business partners agree that such changes can result in significant or even extremely negative outcomes (see Figure 1).
“High levels of change are creating control gaps that in turn are creating significant organizational risks,” said Beale. “Audit leaders must firstly improve their visibility into changes happening in their organization and secondly develop the capability to deploy audit resources faster when changes arise.”
Improve Visibility into Change
Most internal audit functions are already on a journey to improve visibility into areas undergoing changes, according to Beale. Three years ago, many functions pursued real-time assurance and sought to better leverage data to get a more comprehensive and real-time view of risk.
A year ago, audit leaders were focused on attracting more information from business partners about changes to enable foresight and also by equipping their auditors to better articulate how audit can help management avoid problems and when to ask.
Today, audit leaders are more proactive, actively seeking more conversation with other assurance functions, better access to senior management, the board, executive and steering committees, and by liaising with other assurance teams.
“This is all about getting earlier knowledge of changes, so that there is more time to make necessary audit resource adjustments and avoid control gaps,” said Beale. “However, visibility alone doesn’t solve challenges that arise from resource allocation problems. Improving the speed of audit deployment is also an important part of mitigating control gaps.”
Enable Faster Audit Resource Deployment
There are several reasons why visibility does not lead to faster audit deployment. Often, the audit resources are already fully allocated, requiring auditors to stop or hold one thing to take on another. Audit engagements are designed for end-to-end execution, and this tends to limit the movement of auditors until their current engagement is complete.
The audit plan - rigorously developed and agreed upon by stakeholders - can have a lot of inertia that is hard to stop or change once it is in motion, and therefore can hamper an audit’s response in the face of change.
“To respond more effectively to the levels of change that organizations are experiencing, audit leaders must look beyond improving visibility into changes and aim for what Gartner calls ‘real-time resourcing’ of their engagements,” said Beale.
Real-Time Resourcing
There are some simple steps that many CAEs don’t take which can significantly improve the audit’s ability to deploy faster, thereby closing control gaps arising from the process or project changes. For example, just 30% of the 135 CAEs surveyed this year said they broke audit engagements into individual tasks that could be executed separately. Just 16% said they brought staff into audit engagements as needed versus a full engagement on each occasion.
“Audit leaders have traditionally focused on getting earlier visibility into control gaps arising from process or project changes,” said Beale. “But in doing so they have tended to overlook small adjustments to how audit resources are deployed that will also have a significant impact on audit getting to control gaps on time.”
Additional information is available at gartner.com/en/audit-risk.