Audit Magazine spoke with Naohiro Mouri, Chairman of IIA Global about his vision on the internal audit profession. His theme is: ‘Emphasize the Basics. Elevate the Standards.’ In a quote he said: “Because I truly love the profession, I wanted to stress the importance of going back to the very basics. That means understanding how important the Standards are to become the trusted advisors we aspire to be.”
What ‘Emphasize the Basics. Elevate the Standards’ means to you and is the key take away for being a trusted advisor?
“I would like to start with trusted Advisor (TA), because that’s easier to explain. Being a TA means that an internal auditor really helps senior management and the line management to do what they are supposed to do, in a better, faster and cheaper way. The way we do this is by giving assurance to the business. My belief is that if you do not give assurance, you do not really understand the business well enough. So as the TA you must really understand the business and the agenda of senior management. In addition the knowledge of control is essential, which brings me to the basics: the standards, as a guidance for the internal auditor. It’s like a visit to the doctor. For a reliable judgment, the doctor must examine your body first to give the right diagnosis, or advice. Having a set of standards is important for professionals in order for people to understand what, how and why they do things.”
Changes in today’s and tomorrow’s business environment, the associated risks are accelerating. How does that affect ‘the basics and standards’ and is internal audit still needed?
“So that’s a really good question on ‘how we do things’. Why we do thing, or what we do probably does not change. Going back to the year 1941 when internal auditing started, internal auditors used pen and paper. The way we do things now have changed with computer, but the purpose of why back then and now are much the same. The demand for assurance on the effectiveness of controls, or advice and insight on senior management to perform their controls better, cheaper etc. has not changed. And I don’t think that the purpose of internal audit is going to change for another 50-100 years as long as organizations exists. How we do things is going to change, due to Artificial Intelligence, using robots and blockchain. When the businesses changes and become digitalized, the way we audit changes. I think that how we will do things will possibly radically change over the next 50 years.”
And will internal audit still be needed in the future?
“Yes internal audit will still be needed. However, the way we add value will change. Everything that is quantifiable or tangible can be used to test controls. I think that in 10-20 years machines can help us make decisions based on results of machine-testing activities. Maybe in the future internal audit will be responsible for the maintenance of the machines that test. For other things that are not tangible or quantifiable such as culture, behavior and conduct, only humans can audit. Humans would still be needed to connect the dots and to analyze the results of machine tested decisons. The skillset of the auditor is also going to change. Testing skills would be less important. The use of cognitive power would increase, the power to think, power to construct and to create things are becoming more important. My view is that this is what the future internal auditors will be doing. Analyzing, reporting, communicating and facilitating. As testing time becomes smaller, the cognitive activities can be expanded, where our value creation comes in and that is where our future is. For me it is an exciting new world. But I can image for some auditors, it is threatening because testing activities will become insignificant for human auditors and will probably be taken over by bots.”
Which key characteristics would best describe the optimal Internal Auditor, and what developments do you see?
“I see some critical characteristics, like analytical ability, communication and also facilitation of the conversation with the business. Things we really need to put effort into enhancing our skills. Combined with machine learning and use of robotics, I expect the third line will become closer to the second line of defense, because there is instant insight with real time full population testing with the business, and the auditor’s time could be spent on the cognitive power. Once you harness real time full population testing, the next step is to predict behavior and minimalize the audit risk if we have enough data. At the end of the day it comes with the acceptance of the board to be open in discovering what data means and invest in further developments. Internal audit must put this topic as their priority. Internal audit must step up and come forward to push this agenda.”
“My belief is that if you do not give assurance, you do not really understand the business well enough”
Given today’s changing business environment, requirements of regulators and – customers’ demands: Do you see internal audit adding value primarily as an assurance provider or as a trusted advisor?
“I am not sure why we make the distinction between two as I see both of them inter-related. As I said, my view of internal audit is primarily as the assurance provider. As we provide assurance (including automated testing) to the business, that would lead to insight and advise, which leads to being their trusted advisor. If the CEO, or audit committee trust me, they will ask for my opinion. Key is stating my opinion with honesty and integrity, and building and earning trust is the key. It’s important to provide information to stakeholder about what is aligned with their needs and worries, not what you want to tell them. And having the courage to say things they don’t want to hear and bring the truth in front of them. I call that occupational hazard.”
The new IPPF show resemblance and overlap with other professional standards, such as the external auditor’s professional standards. Has IIA sought alignment with other professional standards? And to what extend are the standards differ?
“I do not think we have deliberately sought alignment with other professional standards. As this is the 52nd revision of the Standards, we have a deep understanding and knowledge of what Internal Audit is. The last update was in 2017, so we continue to update the standards. Is there a similar way of thinking between us and accountants? Maybe. Many internal auditors have an accounting back ground including myself. Even though accounting, external auditing and internal auditing are completely different professions, I can see there are many similarities. This also makes sense when considering that internal audit started by looking at operations and finance. Internal audit from the finance perspective is very similar to external auditing.”
Years from now: how do you want your Global Chairmanship to be remembered, what legacy will you have left behind?
“I love Internal Audit. It is my passion, my commitment, my life. I have been in this profession for 26 years and will probably continue to engage myself in this profession until the day I stop working, which will probably be the day that I die. It is my passion, because internal auditing gives me the opportunity to learn things. By having a conversation with you, I am also learning, by speaking at conferences, I learn, and by being involves in audit engagements I learn quite a bit. Every audit engagement is different, which is really fascinating to me. I am passionate about learning and then sharing that knowledge with others to help the organization deal with problems.”
The various countries around the world may perceive internal audit differently. To what extent are differences allowed or would IIA global always aim for harmonization?
“Let’s look at the accounting profession. Even though basics of accounting is the same in every country, each country regulates with different accounting standards. As a result, even though we have a single international financial reporting framework, it is applied differently from country to country. That creates issues with multinational companies when you operate worldwide and adjustments are required for local reporting. Unlike accounting profession, the internal audit profession currently is not regulated. The IIA holds a single set of global Standards. I know some countries in Africa that regulate the internal audit profession, but they always refer to the IPPF as the Standards. We are happy to work with local legislators to adapt the standards, but do not want them to create local sets of standards and create differences with the global IPPF. Most regulators are happy to refer to the IPPF as the professional standard.”
The final question: what does The IIA do well and what could The IIA do better?
“I am happy to report that we have just passed the 200,000 members mark, which is a significant effort in all parts of the IIA global organization including the IIA Nederland. The IIA is a membership service organization. We help our members to do their job right every day. So, do I think we have done all we can to help our members? Perhaps yes, perhaps no. We have very good Standards and very good certification programs. Perhaps the Standards can continue to improve. In my opinion, not every member understands, respects and then conforms to the standards. If you look at the Common Body of Knowledge study that is done every 5 years the complete conformance is still less than 60%, partial conformance is another 30%, which makes up about 90% in total. I fully understand there are some difficulties to conform for the smaller audit shops, so IIA is now contemplating how to deal with that issue. But, we really have to come to a consensus as to what it is that we expect the conformance level to be. So that is something we are working on.”
“We are happy to work with local legislators to adapt the standards, but do not want them to create local sets of standards and create differences with the global IPPF”
“How we service our members is also something that we are discussing. Currently each institute has its members, and each institute is a member of the global IIA. The question is whether this is the right model to service our members with the best possible way? While each institute understands the needs of the local members, some of the members work at global companies, which may trigger different, global needs. These needs could be served better by the IIA headquarters or other institutes, where their company headquarter is situated. We are currently contemplating how to best service our members. For instance, what is the content they need, what are the seminars that they need, what topics do they need researched. I think we have some work to do on this. From the member service, we need to strive for our service to be the best in class. We need to elevate that. But I am happy to say we are doing everything we can and with the growing number of members world-wide, we will be better able to improve. IIA Global is currently undergoing a large technological change with the membership database and the examination systems as well as its internet portal. We are really re-bumping the technology platform. Stay tuned for some better service coming through.”
That was the final question. Is there anything you would like to add?
“One thing I would like to say is that our future is bright as long as you are willing to change. Because change is the only constant thing in this world. If you cannot change, they will change you. If we can successfully transform ourselves to leverage technology to help us help our stakeholders then we are in a great place. I am actually very excited about the future.”
Naohiro Mouri is chairman of The Institute of Internal Auditors Global (IIA) and executive Vice president and chief internal auditor of American International Group (AIG).
Lees meer over dit onderwerp:
Digitalisering en de daarmee samenhangende opkomst van de datagedreven economie hebben een grote invloed op de internal auditfunctie (IAF). Dit artikel biedt inzicht in de kansen en uitdagingen van technologie, maar ook in de mate waarin IAF’s worstelen met de adoptie van technologie, data en innovatie. Een opgenomen casusbeschrijving biedt inspiratie en praktische handvatten. Digitalisering […]Lees meer