needs will force different criteria to be used. ‘Internal audit should produce probability ratings for the audit committee’, said Nelson, ‘and then prioritise and give the audit committee a greater say on how much resource is needed to look at whichever level of risk is appropriate’. Blackburn can also see internal audit expanding back to its old heartland. Again the question is of resources and where they can best be applied. ‘People are saying that internal audit should go back in part to substantive testing and detailed work’, she said. ‘But there have to be the resources to do these things’. For audit committees to understand these pressures better communication must be applied. ‘Greater dialogue with the audit committee about the level of assurance that they require will be needed’, said Nelson, ‘and there will be pressure on the head of audit to say how effective the risk management controls are’. It has become a much more demanding and pressured world. ‘Audit committees’, said Blackburn, ‘have become much more demanding. They are keeping chief executive officers and internal auditors on their toes. It is all part of the equilibrium needed’. This in turn could lead to a change in emphasis. ‘It could lead to an audit committee which specialises in internal auditing affairs’, said Blackburn. But resources and who provides them is at the heart of this reform. ‘At the moment audit committees only get the resources that line management says they can have’, she said. And there are other issues appearing all the time. The extension of the provisions of the American SarbanesOxley legislation on corporate responsibility to leading companies around the globe has, for example, made people more nervous. In particular, they worry about criminal sanctions being attached to directors signing off the figures. ‘Chief executive officers and chief financial officers are being asked to sign in blood’, said Nelson. ‘There will be a much greater call for auditors to do work in these areas and review the financial statements further. In many companies these things are only looked at by the external auditors. Now there will be an internal process as well. It gives the board’, he said, ‘pause for thought’. All this has expanded the role of internal audit. ‘From the internal audit perspective’, said Nelson, ‘internal auditors are seen as the experts on internal controls. Now they are being looked upon as the experts in risk management as well’. And that means a greater challenge. ‘Internal audit’, he said, ‘needs to meet these additional demands’.
Expanding responsibilities for internal audit Blackburn would point to an even greater extension of the role and responsibilities of the internal auditor. ‘The broadening of the approach expands the role of different experts’, she said. ‘Internal auditors are already expert in financial controls. Now they need to become experts in the softer controls’. By this she means the way that an internal control and risk management culture can provide assistance in areas undreamed of by the traditional internal audit department. ‘We should be looking at ways of changing the company for the better’, she said. ‘It is management’s responsibility to do this but internal audit could help. It could provide the role of coach. It could provide feedback and encouragement and help management to reflect on events. ‘It is’, she admitted, ‘an ocean away from the training you get as a young accountant. But it can work’. She also saw a world where risk managers could provide assurance beyond the narrow remit of the company. ‘The assurance we provide at the moment is internal’, she said, ‘and the external auditors only owe responsibility to the shareholders. But society demands accountability. Who reports on that ? As a citizen I want to know more. I want to know, for example, that the company cares about the sustainability of the economy’.
45