Internal audit code is driving changes in the financial services sector

6 July 2015

A survey of Heads of Internal Audit (HIAs) and interviews with audit committee chairs reveals that there have been significant changes how the financial services sector deals with governance and risk since the IIA Financial Services Code (The Code) was introduced in July 2013, says the Chartered Institute of Internal Auditors (IIA).

The Code, welcomed by the Financial Conduct Authority (FCA) and Prudential Regulatory Authority (PRA), has driven these changes by setting out consistent expectations of internal audit functions for boards, audit committees and regulators alike. The Code was launched to help all firms improve their management of risk as they respond to intense public, investor and regulatory pressure to improve corporate governance.

Survey results in relation to key elements of the Code, reveal:

• Access to the board: the Code recommends that the primary reporting line of internal audit departments should be to the board. Our survey found that 72% of Heads of Internal Audit are line-managed by their Audit Committee chair, compared to 56% in July 2013.
• Position and status: the Code has had a marked impact on the position and status of the HIA. 84% now attend executive committee meetings, compared to just 48% in 2013. 100% have full access to audit committee papers (89% in 2013), 90% to board papers (69% in 2013) and 84% to executive committee papers (69% in 2013).
• Audit of key areas: the Code recommended that internal audit’s scope should include a number of areas, including risk and control culture and the setting of risk appetite. 93% now carry out audit work on risk culture (54% in 2013). 90% now carry out work on the setting of risk appetite (59% in 2013).

Ian Peters, Chief Executive of the Chartered Institute of Internal Auditors said: “Two years since the Code was introduced, we can see real change in how the financial services sector views internal audit. The results reveal the extent to which financial services institutions are embracing the Code’s recommendations, the opportunities the Code presents, and the challenges it poses.

'The Code has driven change in the area of corporate culture. Our report Culture and the role of internal audit – looking below the surface released last year found that the audit of corporate culture and tone at the top are now priorities for financial services firms.'

Lindsay Dart, Managing Director of Protiviti Limited said: “The results of this comprehensive survey clearly demonstrate the increasing prominence and responsibility of internal audit functions within financial services organisations, since the Code was introduced in 2013.

'Seniority levels and levels of training, access to key board documents, the size of budgets and staff numbers have all increased considerably over the past two years – as well as the scope of internal audit’s remit, now increasingly looking across company culture, key corporate events, risk appetite and customer treatment.

'The Code has evidently stimulated internal audit functions to raise their game and demonstrate their increasing value to their organisation. As a result, we can see that internal audit is increasingly regarded by the financial services sector as being essential to sound corporate governance and risk management.'