While the bar has been raised for internal auditors’ purview, the profession is still crying out for more people. In a recent E&Y study of 138 internal audit executives, 38 percent reported they are using less than 90 percent of their budgeted headcount. But they do expect to do more hiring; nearly two-thirds of PwC’s survey respondents said the number of internal auditors will increase in the next five years, particularly in the technology area.
In the meantime, companies are supplementing their lack of internal-audit bodies with outside help. Companies that do not pull in these subject-matter experts are in the minority, according to the IIA, as most companies cannot afford or don’t find it efficient to pay someone with a specialty year-round who is needed only for a short period of time.
Another way to make up for the lack of internal-audit resources is to train your staff to do more strategic and operational auditing, suggests Singer. Companies are also bringing in “guest auditors” from other departments, although that’s harder to do at a small organization.
The higher expectations put on internal auditors will be a boon for the profession, according to Singer. “The fact that we are asking internal audit to have a different focus going forward, beyond compliance, to a more strategic and operational focus on the surface looks like a challenge. But I think it’s a tremendous opportunity for the industry,” he says. It could further elevate the role as companies are looking at the internal audit department to be an “incubator for talent,” opening up the possibilities for an internal auditor’s next career move.
To be sure, it’s up to the internal auditors themselves to prove their worth, observers suggest. After all, “internal auditors by nature have not been good salesmen,” notes Richards.
Now that they should have direct connection to audit committees and senior managers, they should also be able to better market themselves than they could have pre-Sarbox. They can do that by documenting changes they made that resolved a problem found during an audit, for example. In addition, they could more closely align themselves with other organizations within their company — while still maintaining their independence — to understand those organizations’ issues and problems so that a final audit opinion will not end up sounding like a one-sided judgment call.