Internal audit leaders: Is HR in your audit plan?

By Lisa Donoho, Protiviti

For most companies, the answer to this article’s lead in question is “no.” The next question then is, “Should it be?” Let us take a closer look.

Think about your company. If you listed the top three major expenditures, what would they be? Chances are that Human Resources (HR) expense is in your top three expenditures and is probably number one. Notice that I said HR expense, not payroll expense. There is a big difference. HR expense not only includes salaries, but also employee incentives and benefits, vacation accrual, taxes, training, workers’ compensation, equipment and supplies, and more. All of which needs to be considered when measuring the true HR cost to the organization. Knowing that, HR (not payroll) is now probably on your top three major expenditures list.

Why is HR not in your audit plan?
Here is one tell-tale reason. HR risk typically has not been a focal point for internal audit leaders or audit plans. In a 2003 global auditing survey conducted by The Institute of Internal Auditors (IIA), internal audit professionals were asked to rate the importance of HR audit projects in the overall audit plan: 36 percent of respondents said HR audits were a low priority, 43 percent said they were moderately important, and only 21 percent rated them very important.

What are some of the other reasons for not including HR in the audit plan? Many companies completely overlook the total, true cost of each employee when developing their audit plan. They may conduct payroll audits, but they often do not look at HR costs from a comprehensive perspective, which is essential to truly understand and favorably impact employee costs. This is true for about 90 percent of the people reading this article. If this does not apply to you, I want to congratulate you because you are in a very small group.

Another common reason for not addressing HR in the audit plan lies with executives and HR professionals themselves. They do not understand or appreciate the manner or measure to which HR decisions impact the organization’s bottom line. Alternatively, they do not see internal audit’s involvement as constructive or meaningful. Now, those of us living out the definition of internal audit in The IIA’s International Standards for the Professional Practice of Internal Auditing know how to bring relevancy and value to an HR audit, but they may not perceive internal audit the same way that we do.

One additional reason could be the internal audit director or audit committee does not see this as a high risk to the organization. That may be true. But with major restatements and accounting scandals surrounding the backdating of stock options and regulations that require executive compensation disclosures, family medical leave, leave with pay, paid holidays and more, organizations must think of HR in its totality to gain an accurate understanding of the risks and business performance opportunities linked to those costs.

However, before anyone agrees to include HR in the audit plan, there must be benefits associated with this addition. What are these benefits? A properly planned and executed HR audit should achieve the following:

Creates an understanding of the true HR cost drivers and associated basket of inherent risks
Leads to more secure employee data
Increases the accuracy and reliability of financial reports and disclosures
Increases the rate of legal and regulatory compliance
Improves business performance
How does this improve business performance?
It is not uncommon for the corporate mission to include “to attract, train and retain top talent” as a key aspect. According to the CFO.com article “What Keeps CFO’s Up at Night?”, a recent survey conducted by Duke University concluded that the number one “internal” concern on the minds of CFOs is attracting and retaining qualified employees, with the cost of health benefits coming in third on their top 10 list of internal concerns. Knowing this, consider these questions:
What if HR is not aligned with the mission and is not hiring, training or paying for performance? You could be hiring the wrong people.
What if HR processes are not geared toward retention or do not proactively detect and effectively manage or mitigate employee turnover? Intellectual capital is walking out the door, and hiring and training costs are higher than necessary.
What if large streams of retiring baby boomers are depleting the organization faster than they can be replaced? Do you have an HR function that is at the leading edge of recognizing cultural changes in work environments? Do they understand and can they relate to the new crop of workers coming up who expect and demand flexible work schedules, telecommuting opportunities and more? HR should be positioned to have an effective voice and a seat at the table to convince senior leadership that the paradigm is shifting and the organization must keep pace by being competitive with its peers. Your organization is then able to adapt and achieve the goals and objectives.
Here is another interesting fact to consider. The typical employee today stays with their employer for three to four years rather than 10 years – which means that turnover is high and the return on investment for each employee may not be fully realized. How can organizations defend themselves against this trend? They must establish consistent and well-communicated policies to retain the best talent by engendering trust and loyalty among employees. The creation and maintenance of those policies should be regularly reviewed in the audit plan.

How do you include HR in the audit plan?
You can start by opening dialogue on the subject with HR executives and members of the compensation committee. Another suggested step is to facilitate a risk assessment to prioritize the risks and opportunities for improving business operations. Here are a few questions to ask during this risk assessment process:
Is the company facing potential system changes or significant business transactions, such acquisitions, divestiture, IPOs or layoffs? If so, HR could seek internal audit assistance to design effective processes and controls for data migration, severance packages or layoff strategies to mitigate the risk of compliance violations, litigation and class action suits.
Is the HR department decentralized? A decentralized department may have inconsistent policies and procedures. Decentralized HR teams could be audited to share best practices across the company and ensure that employee data is secure, policies are met, and contract compliance is in order.
Does HR have controls and processes in place that impact the financial statements? This includes processes and controls for salaries, bonuses, accruals and garnishments of wages, among other things, that, if not properly managed could pose regulatory compliance risks.
Lastly, you can leverage the knowledge and experience of a professional HR risk consultant the first time through this process to accelerate and enhance your success. Until you have the right skill set in-house, it can be the smart thing to do.
http://www.knowledgeleader.com/KnowledgeLeader/Content.nsf/Web+Content/HIIAleadersIsHRinyourauditplan!OpenDocument&Home