Internal Audit for Risk Mitigation & Compliance: Building Organizational Resilience

French journalist Jean Baptiste Alphonse Karr famously coined the phrase “Plus ça change, plus c’est la même chose⎯the more things change, the more they stay the same.” For many decades, traditional approaches to risk management have largely lived up to that edict. Threats have admittedly evolved over time, from geopolitical instability to the rise of sophisticated cyber threats and global pandemics, but traditional lenses of risk, likelihood, and impact have, and continue to be, the primary barometer to allocate defensive measures to combat and manage risk. The responsibility often fell to legal, compliance, and audit functions that sit on the periphery of day-to-day activities and are largely reactive to issues as they arise. This approach, while necessary, often resembles looking in the rearview mirror, focusing on what has happened rather than anticipating what lies ahead.

Embracing a Proactive and Adaptive Approach

An alternative and more effective approach shifts the focus from reactive to proactive, embracing a mindset of continuous adaptation and improvement. This evolution recognizes that in a rapidly changing environment, characterized by technological disruption, economic volatility, and increasing regulatory complexity, the ability to bounce back and adapt – organizational resilience – is as critical as preventing risks in the first place. It’s about building an inherent capacity to not only withstand shocks but also to learn and grow from them, transforming potential setbacks into opportunities for advancement.

The Challenge of Fragmented Risk Management

In many, if not most organizations, risk management functions have been built over time, very often in silos, resulting in a patchwork of documented processes, risks, controls, tolerances, correlations, thresholds, and benchmarks. Each department or business unit may have its own way of identifying, assessing, and managing risks, often leading to duplication of effort, inconsistencies in approach, and blind spots across the enterprise. Aggregating that information into a coherent message for senior leadership, providing a unified view of the organization’s risk profile, has been an ongoing challenge for as long as the exercise has existed. This fragmented approach often obscures the interconnectedness of risks and hinders the development of a unified and effective resilience strategy, leaving the organization vulnerable to cascading failures and unforeseen consequences.

Internal Audit as a Catalyst for Holistic Risk Management

Internal audit (IA) can be a powerful catalyst in encouraging organizational maturity by advocating for a holistic, enterprise-wide view of risk that incorporates every significant function’s “voice” into an integrated framework. By breaking down silos and fostering collaboration, IA can help the organization develop a more comprehensive and dynamic understanding of the current and emerging risk landscape. At a minimum, this integrated framework should include perspectives from Operations, Finance, Accounting, IT, and HR, recognizing that risk and resilience are not confined to specific departments but permeate the entire organization. This also means that IA needs to evolve, moving beyond traditional financial auditing to encompass operational, technological, and strategic risks, and have people with the proper skill sets in areas like data analytics, cybersecurity, and change management.

The Imperative of Organizational Resilience

Beyond Prevention: The Power of Bouncing Back

Trying to plan and predict risk events is a healthy and regular exercise for any organization. It can influence strategic decision-making, pricing models, entry into emerging markets, the development of new products, investment strategies, and divestment decisions. However, traditional methods of risk management tend to focus on establishing defensive footings, primarily aiming to prevent negative outcomes and minimize losses after an event has occurred. Resilience, on the other hand, puts the team on offense, focusing on the ability to not only withstand shocks and disruptions but also to learn and grow from them. It’s about developing the agility and adaptability to navigate uncertainty and emerge stronger in the face of adversity.

Key Pillars of a Resilient Organization

Key elements of organizational resilience are its ability to anticipate potential disruptions, react swiftly and effectively when they occur, recover rapidly and efficiently to normal operations, and evolve by learning from past experiences and adapting to future challenges. This proactive stance allows organizations to not just survive disruptions – whether they are economic downturns, technological failures, supply chain disruptions, or unexpected competitive pressures – but to potentially emerge stronger, more innovative, and more competitive in the long run. A resilient organization views challenges not just as threats to be avoided, but also as opportunities for learning, improvement, and strategic realignment.

Internal Audit’s Role

In this evolving landscape, IA plays a crucial and increasingly strategic role in fostering organizational resilience. By moving beyond its traditional focus on financial controls and compliance, IA can contribute significantly by:

• Evaluating management’s change agility: IA can assess the organization’s capacity to adapt and respond effectively to unexpected events and evolving market conditions. This includes evaluating the flexibility of processes, the adaptability of the workforce, and the leadership’s ability to navigate uncertainty and drive change.
• Encouraging making risk management and change agility everyone’s shared responsibility: IA can advocate for a culture of risk awareness and embed resilience considerations across all levels and functions of the organization. This involves promoting risk education, fostering open communication about potential threats, and ensuring that risk ownership is clearly defined and integrated into day-to-day operations.
• Stress testing existing processes and strategies: IA can simulate various disruptive scenarios – such as cyberattacks, supply chain failures, or economic downturns – to identify vulnerabilities and potential points of failure under pressure. This proactive testing helps the organization understand its weaknesses and develop more robust contingency plans.
• Promoting the use of real-time monitoring and data analytics: IA can champion the adoption of technologies and processes that provide continuous insights into emerging risks and the effectiveness of resilience measures. This allows for more agile adjustments to audit plans, resource allocation, and risk mitigation strategies, moving away from periodic assessments to continuous assurance.
• Advising on the development of robust business continuity and disaster recovery plans: IA can provide independent analysis over the comprehensiveness and effectiveness of plans designed to minimize disruption and recover quickly from adverse events. This includes evaluating the adequacy of backup systems, communication protocols, and recovery procedures.
• Assessing the organization’s cyber resilience: Given the increasing reliance on technology and the growing threat of cyberattacks, IA plays a vital role in evaluating the effectiveness of cybersecurity controls, data protection measures, and the organization’s ability to prevent, detect, respond to, and recover from cyber incidents.
• Facilitating communication and collaboration: IA can act as an independent and objective bridge between different departments, promoting the sharing of information, best practices, and lessons learned related to risk management and resilience initiatives. This helps to break down silos and foster a more unified approach to managing uncertainty.
• Monitoring Key Risk Indicators (KRIs): IA can help the organization identify, track, and report on KRIs that provide early warning signals of potential disruptions. By proactively monitoring these indicators, the organization can anticipate and respond to emerging threats before they escalate into significant problems.

By embracing these opportunities and evolving its own skillsets and methodologies, internal audit can move beyond its traditional role of detection and become a proactive and strategic partner in building a truly resilient organization – one that is not only prepared for the inevitable challenges of a dynamic environment but is also positioned to thrive in the face of uncertainty.