Rachel Bowden
Founder & Director
ThinkingAudit Ltd
Annual Opinions Survey
Annual internal audit opinions
Results from our survey of heads of internal audit
5 minutes reading time
Background
The Chartered Institute of Internal Auditors published its Internal Audit Code of Practice in January 2020, aimed at internal audit in the private and third sectors. One of the recommendations (within recommendation 13) is that internal audit’s reporting to the board and / or audit committee should include:
“at least annually, an assessment of the overall effectiveness of the governance, and risk and control framework of the organisation, and its conclusions on whether the organisation’s risk appetite is being adhered to, together with an analysis of themes and trends emerging from internal audit work and their impact on the organisation’s risk profile.”
ThinkingAudit surveyed UK heads of internal audit in March 2020 to gauge views and experiences of providing an annual opinion or assessment.
Our survey sought to understand:
- How many heads of audit are providing an annual assessment or opinion to their Board or Audit Committee?
- Where such opinions are provided, are these linked to the organisation's risk appetite?
- What other factors are included in, or inform, the annual report or opinion?
- What are views on barriers that prevent heads of audit preparing an annual assessment or opinion?
Providing an annual opinion or assessment
All respondents from financial services and the public sector reported that they do provide an annual report containing an annual opinion or assessment.
We also noted that all respondents who work in social housing provide such reports and opinions, where this is a sector norm.
Audit functions not providing an opinion were split across charities, listed companies and privately owned companies, although several reported that they are currently considering or discussing how they may provide an annual opinion or assessment in the future.
Scope of the annual assessment
All respondents who do provide an annual opinion or assessment reference both internal control and risk management. Slightly fewer reference governance, which the Chartered IIA recommends for inclusion within the annual conclusion.
Other areas referenced include regulatory requirements or findings, organisational change and performance against agreed business plans.
It is notable that risk appetite is not currently a common theme for inclusion in internal audit annual assessments or opinions, something which the Internal Audit Code of Practice is seeking to change.
Risk appetite
In fact, of the heads of audit who do provide an annual opinion, only 12% conclude with reference to the organisation's risk appetite. Two thirds of respondents are considering this for the future, although comments provided also reflected that this would not necessarily be achieved soon and could be a difficult task.
Barriers to providing an annual assessment
Lastly we sought to understand why heads of audit are not providing an annual opinion or assessment. Most respondents who answered this question listed a number of factors.
We may expect the level of 'not required in my sector' responses to change in the future if the Internal Audit Code of Practice has the same impact in the private and third sectors as in financial services. However, the practicalities of providing a meaningful assessment remain, with comments and responses reflecting the challenges of different risk appetites across group structures, and that heads of audit did not yet think that their organisations were sufficiently risk mature.
Conclusions
The responses to this survey reflect that even where there are heads of internal audit who are providing an annual opinion or assessment, the scope does vary. Some are planning on enhancing their assessments to include risk appetite, and recognise the challenges in doing this. Others are not yet providing an annual opinion, although most are discussing this with the audit committee for future consideration.
There is a possibility that some will see annual opinions as 'too difficult' however it should also provide an opportunity for internal audit to engage with the board. What is clear is that heads of audit consider that risk maturity and a clear view of risk appetite need to improve in their organisations; two themes that go hand in hand. Surely heads of audit must also have a role to play in encouraging discussions regarding risk maturity and risk appetite with the board, audit committee and senior management, and can bring their skills to bear in assisting the business.
This article last updated 18 May 2020
