Interview

Deloitte: How do you perceive the latest challenges and opportunities in the area of risk and controls?

Gopinath: Business risks and challenges are bigger than ever, but so too are the opportunities in the risk and controls space. I would say a key challenge for internal auditors is to gain the trust of the business management, by continually engaging with them and providing meaningful and timely assurance and advice. This challenge gets harder with the rapid and continuing emergence of new risks and chronic talent shortage, which creates a natural need and opportunity for us to put together innovative solutions.
 

Deloitte: Can you share an example of innovation in risk and controls and how it adds value for the business?

Gopinath: It is often a challenge to keep up with risks and engage with the business in depth, especially for teams with constant capacity constraints. Certain key activities such as periodic risk assessments, recertification of controls, communication of issues and insights from various automated tests of controls, could be launched digitally and integrated into the business through various collaboration tools and platforms. Obviously, such a set-up would require a lot of ground work in defining risks and the lifecycle of controls and workflows, making business data available for continuous testing, writing testing software, issuing risk response templates and, more importantly, investing time with the business in familiarising them with this digitalised approach. Such continuous assurance has resulted in the realisation of significant value through improvements in risk controls for our business.
 

Deloitte: In your opinion, how important is the alignment of internal controls with business priorities when driving transformation in controls?

Gopinath: Alignment with business priorities is crucial and quite fundamental for us. Misalignment between controls and the business could easily lead to lack of interest from the business, and could be disastrous for us if left unaddressed. It takes continuous effort to hit that resonant frequency of communicating and collaborating with business, and planned efforts should be an integral part of the engagement approach.

Deloitte: How do you convince leadership of the impact of innovation in control initiatives and get their buy-in?

Gopinath: There is always a proof of concept stage when embarking on innovation in an internal controls journey. Whether the concept is novel and has originated in-house or whether it has been proved already elsewhere in the industry, convincing business leaders about the value of such innovative concepts and winning buy-in from management on the potential impact of transformation initiatives is part of the innovation journey.
 

Deloitte: What is your view on innovation in internal audit? What advice would you offer to fellow risk and control professionals who are at the start of their innovation journey?

Gopinath: While there is pressure to implement emerging technologies in practice, the use of innovation must have a clear purpose, and should be very specific to your business operating model. It works better when you agree with the business upfront, and work together with business managers on identifying and solving problems that matter to them. For solving complex and bigger problems, it may help to start with a minimum viable approach, starting small and building up gradually, in order to realise positive results more quickly and build up trust with the business over time.