Latest GRC Survey Shows Disconnect on Risk

By Tammy Whitehouse, Compliance Week

New evidence is emerging from yet another survey to show chief audit executives and audit committees are not on the same page in their view of the highest priority areas for internal audit attention.

That’s the finding of Grant Thornton’s annual GRC survey, which polled nearly 550 chief audit executives and audit committee members across a variety of sectors and organization types, not exclusively public companies. According to the findings, audit committees say financial risk is the most important priority area for internal audit, followed by compliance, operational, and strategic risks. CAEs, however, give compliance risk top billing, followed by operational, financial, and then strategic risks. An earlier survey from Protiviti and North Carolina State University shows a similar disconnect in terms of where board members see the greatest risk compared with executives and operational leaders in the business.

In the latest Grant Thornton poll, audit committees and CAEs ranked the top three areas where they believed internal audit could deliver value. In the eyes of audit committees, the top value-add opportunity for internal audit is “mitigating risk,” followed by “stronger financial controls compliance” and “identifying improvement opportunities." CAEs, on the other hand, saw their biggest value adds in identifying improvement opportunities, then mitigating risk, then providing stronger financial controls compliance.

Warren Stippich, partner and GRC practice leader for Grant Thornton, says he sees the disconnect in his work with audit executives and audit committees. “Internal auditors often think they add the greatest value through operational auditing,” he says. “I hear this time and time again: the number one goal for audit committees is to make sure the financial statements, financial reporting, and internal controls are operating effectively. Internal audit is the number one group to make sure that happens.”

The findings suggest audit executives should make it a point to touch base with the audit committee to assure they have similar views. “Get a dialogue going, early and often, with the audit committee about what they’re looking for and what’s important to them,” says Stippich. “Incorporate that feedback into the overall planning and look for ways to optimize internal audit.”

The survey also suggests chief audit executives may be facing flat budgets, as 62 percent said they expect their in-house resources to stay the same in 2015, and 32 percent say their budget has not risen despite increased regulatory compliance efforts. Only 22 percent of audit executives in the survey said their budget would increase, down from 26 percent the year before.