Although they may sound as if they’re better suited to a dystopian sci-fi flick, in the corporate world “control owners” are the managers and subject specialists that internal audit teams rely on to understand whether the processes and controls the company uses to protect itself from risk are working, and then to fix any that aren’t.
This relationship has worked well for a number of decades but, in more recent years, continuous changes to companies, industries, and economies – at an increasing pace – has left these control owners more distracted, less likely to do their job well, and less responsive to the audit team’s work.
Hundreds of heads of audit in the CEB Audit network have said they’re concerned about the effect of this constantly shifting landscape on their ability to assure the board and senior team that critical risks are well-controlled.
And there is any number of trends that can be used to show how that landscape is shifting: in the S&P 500, Compustat data show that M&A activity has more than doubled each of the past three years; cross-border trade continues unabated at firms around the world; and many managers are experimenting with all kinds of new org structures and business models in a bid to bring in more money.
Control Owners’ Concerns
Indeed, the average control owner has experienced four changes – such as a restructuring or a substantial difference in his or her role – in the past 12 months, and expects four more by the end of this summer. And crucially, the people who manage and maintain policies and procedures in operations and support functions (HR, Finance, IT etc), which is an incredibly important place for Audit to be able to provide its assurance, see 29% more changes than the general employee population.
These data come from a survey of nearly 4,000 control owners about what is changing in their work environment and how they think these changes will affect them and their work (see chart 1). The data show how the control owners in areas such as Finance, IT, HR and Legal are more likely to fail in their core duties when they wrestle with business change.
Chart 1: Control owner survey results n=6,206 Source: CEB 2016 Control Owner Survey
Audit’s New Role
This sets-up an important new responsibility for Internal Audit. It must measure – and improve – control owners’ ability at managing these processes and in responding to Audit’s questions and worries, but auditors must get better at doing this without adding an undue burden.
The big and relentless changes that large companies are imposing on themselves in a bid get one-up on the competition generate more risks for many of them at just the time their managers are less able to prevent and control those risks. Time for Audit to step into the breach.