see all


Audit-2-582880-edited.jpgInternal audit (IA) is more often than not viewed as a ‘check the box’ exercise on a compliance to-do list. While it’s true that banks do have to perform set IA tasks, limiting your work to what’s required not only could leave your institution vulnerable, it could diminish the value of an otherwise highly valuable effort.

Like so many other areas of your bank operations, it’s important to recognize that compliance guidelines represent the lowest bar. If the leadership team and employees all understand not only what to test, but why they are performing those tests, IA can become a lasting asset for the institution. That message has become ever more challenging as the financial services industry, markets, global economies, and technology resources have reshaped how banks and banking professionals need to operate. Change has accelerated, and the impacts are so connected, that every decision or disruption has a domino effect. Keeping up is challenging—keeping a sense of the future is even more so.

With this environment in mind, it’s not all that surprising to learn that less than half (44%) of internal stakeholders say they see value in IA. The rate is the lowest in recorded history, and it’s likely due to two main factors, related to the pace and breadth of change.

  • Rising compliance burdens and declining budgets have added to the already persistent ‘do more with less’ challenge, making it seem logical to eliminate any tasks that qualify as ‘above and beyond.’
  • The markets, economy, regulatory environment and even operational innovations have generated such turbulence that the traditional approaches to IA seem like a mismatch for what banks need to accomplish.

Real World IA Challenges

With such little confidence in the value of IA, it doesn’t surprise our team when banks say they’re finding it difficult to communicate and institute new controls. Recently, I took a call from a client who was uncertain about how to get their board to buy into stronger corporate governance efforts. The board members didn’t see the value in the proposed changes. To them, it was just another item on their list of tasks for the day—they did not understand the higher level “what” and “why” of the controls.

We asked the IA group if they had worked with their bank board members and employees to help them comprehend the controls they were performing. Was the procedure more than just a check-the-box exercise? Were they aware of the consequences if the control was to fail? Did they know how much the failure of this particular control would cost the bank? Sometimes the answers to these simple questions can reveal the bigger picture.

How to (Re) Validate the Importance of the IA Function in Your Bank

Even in this unsteady market environment, you can do a few things to implement and explain an IA function that bank leadership and employees will understand and find valuable.

  • Identify risks that are most important to your bank
  • Determine the process owners of those risks
  • Explain the “what” and “why” behind those risks
  • Engage process owners to share their understanding with others on their team to share in the responsibility

Remember that the goal of the IA function is to help the bank to anticipate and remain prepared for changes and disruption. IA doesn’t become less relevant in a volatile environment—it becomes more so. It enables your bank to take a windshield view of emerging impacts, to prioritize them based on specific risks and opportunities for the bank, and prepare the institution to navigate to a position of strength.

The benefits are real both as your bank looks toward the marketplace, as well as internally at your processes. Leaders who remain informed are better positioned to make and justify bigger decisions and lead the team through more dramatic business changes. They can work proactively with others in the institution to pre-determine how the bank will respond to likely disruptions and unexpected challenges or opportunities.

Benefits of an Objective IA Function

While IA itself is complicated, its value is relatively straightforward. We know that change and disruptions are inevitable in this environment and that regulations will only continue to change. And we know that IA represents a powerful resource for understanding how to keep a position of strength and proactive approach. Where your bank may be facing a challenge is assessing and maintaining an effective internal control program.

The HORNE team recognizes that a lingering shortage of IA talent has plagued the banking industry for the past few years. Our team will work with your IA department to produce an objective, data-driven assessment of your assets, processes, and controls, so you are equipped with a clear, long-term sense of how your company can thrive.


Join the conversation and receive updates of new posts:

Subscribe to the Banking Blog


Sarah is a Financial Institutions manager specialized in Sarbanes-Oxley compliance testing, regulatory compliance, and financial statement audits. She works with clients across numerous sectors, overseeing the day-to-day activities of the compliance audit, ensuring that procedural quality and audit plans are met, and delivering excellent client service.

Find me on: