TFL Vsebine / TFLGlasnik

1. INTRODUCTION

The internal audit function is developing in parallel with the growth and development of a company, its business operations, and environmental changes. In addition to the financial statement audits and state audits, the internal audit represents a significant segment of the overall audit activity. Internal auditing is evolving into a function whose scope is intensively developing and expanding – from the assessment of financial information to the verification and evaluation of the effectiveness and efficiency of internal control systems to the new paradigm of internal audit – focusing on giving assurance about organization’s governance, risk management, and control processes.

In today’s business and economic conditions, internal audit becomes an indispensable internal supervisory mechanism for corporate governance. The internal audit function must permanently develop new approaches to internal auditing and design new internal audit products and services in parallel with the increasingly complex requirements and challenges of corporate governance in modern business conditions. Therefore, it is expected that the internal audit function will increasingly focus on risk anticipation in specific business areas and on advising the management board on risk management options, primarily shaping and supervising the relevant internal control system as an instrument of risk reduction strategy. The object of the internal auditor’s examination becomes the entire business facing the future.

The role and responsibilities of internal audit function as an internal supervisory corporate governance mechanism, the scope of work and engagement types, imposed requirements, and approach to performing audit activities have significantly changed from the beginning of the internal audit profession development until nowadays.

Numerous researchers, regulators, professional associations and institutions, but also the users of internal audit services, especially managerial structures, are preoccupied with expectations from internal audit function and changes needed in its development to be able to respond to the increasingly complex new demands in accelerated, digital and unstable business conditions. Just like the management structures, which are responsible for permanently achieving sustainable competitive ability and advantages as a prerequisite for the long-term financial performance of the company, their partners, internal auditors, are increasingly burdened by the speed of entering a new phase of its activity in which they must respond to the impacts of global economic and social changes and accelerated development of the information and communication technologies.

However, those changes are not reflexive, but they are a complex process of rapid adaption of existing professional internal auditors' engagements to new conditions and circumstances that eliminate the previous frameworks within which internal audit has operated. Over the last several years, matters of digitalization and sustainability, i.e. environmental, social, and governance matters, have been the focus of interest of numerous organizations, regulators, and stakeholders as a result of increased awareness and expectations that efforts in fields of digitalization and sustainability can result in countless explicit benefits and positive impacts on organizations, markets, but also on society and our planet.

The contemporary era is characterised by intensive development, digital technology adoption, different disruptive trends, and related risks in almost all areas of human activity and business operations in all industrial branches and sectors. Disruptive trends strongly characterize the operation of the internal audit function and lead to the transformation of traditional management, methodological and technological aspects of internal audit. Those disruptive trends include the use of digital technologies and the application of data analysis methods, as well as new roles, tasks, and challenges in integrating ESG requirements and initiatives in corporate management. Thus, in those business conditions, the trend of integrating ESG requirements into corporate governance is omnipresent and dominant and represents recent and global matters. Countless recent global ESG initiatives, before all related to the development of appropriate regulations, framework, and single ESG reporting standards, measuring of ESG rating and indicators, ESG risk management, and others, simultaneously complement each other and impose expectations, challenges, opportunities and the necessary transformational role of traditional supervisory corporate governance mechanisms. Related to this, this paper addresses new roles, challenges, and opportunities for the internal audit function in the era of the digital economy and in establishing a corporate governance structure that can effectively implement ESG initiatives and strategies.

2. DIGITAL TRANSfORMATION Of BUSINESS OPERATIONS

Digitalization and digital transformation are widely used in everyday life and speech. Depending on the area of human activity and the context in which they are used, those terms can encompass a wide area of content and themes. Nowadays, all or almost all is digitised. Globally, people and institutions use digitization, digital economy, digital transformation, digital technologies, industrial revolution 4.0, and information and communication technologies as synonyms. This, regardless of possible difficulties in determining the differences between them, does not contribute to clarity; on the contrary, it can create unnecessary confusion. However, regardless of that, it is undeniable that digitization has irreversibly and radically changed numerous aspects of the activities of individuals, business entities and society as a whole. At the same time, there are still questions that are the focus of interest of society about in which direction, with what scope and intensity, with what advantages and disadvantages, costs and benefits can we expect further changes in the future development of information and communication technologies.

»Intensive application of digital technology will bring numerous changes in a business environment, with a special accent on necessary changes in business models and their adoption to the digital era.” (Spremić, 2017a, p. 18) »Digital transformation occurs when the company simultaneously and in a very short period implements radical changes in their most crucial business activity such as strategy, structure, business processes, business model, and organisational culture.« (Spremić, 2017a, p. 53) »The term digital economy is an umbrella term to denote new business models, products, services, markets, and fast-growing economy sectors, especially those based on digital technologies as the primary business infrastructure. The digital economy is often equated with the terms industrial revolution 4.0, the new economy or the internet economy, and refers to the knowledge economy, the innovation economy, and the information economy. (...) The digital economy is based on the intensive application of digital technologies (mainly information and communication technologies) in a continuous process of innovation, creativity, and the creation of new value.« (Spremić, 2017a, p. 20) Digital business transformation refers to the »intensive application of digital technology and resources to create new revenue sources, business models, and, generally, new business methods«. (Spremić, 2017a, p. 38) »Doing business digitally means intensively using information and communication technologies, mainly digital technologies, when performing essential business functions. In doing so, business processes are most often innovated, and new business models are created to generate new values within the company.« (Jaković, 2017, p. 33)

Thus, digital technologies are a »critical infrastructure factor of the digital economy, and they refer to the use of digital resources (technology, tools, applications, and algorithms) which effectively find, analyse, create, forward and use digital goods in a computer environment. Digital technologies represent a kind of upgrade but are still a sub-term related to information and communication technologies. (...) There are five primary digital technologies:

• Mobile technologies - which create technological and infrastructure digital platforms social networks - which create digital platforms for communications and entertainment
• Cloud computing - technological and infrastructure digital platforms
• Big data, i.e., advanced analytics and quick discovery of knowledge from a vast amount of diverse data (big data) - analytical digital platform
• Sensors and the internet of Things - relating numerous devices equipped with computer chips that make technological and infrastructure digital platforms.« (spremić, 2017a, p. 52)

»The concept of digital economy and digital transformation of business operations relies on the following fundamental principles:

• Integration and simultaneous application of independently developed technologies and the possibilities those technologies provide
• Integration of progressive business concepts The use of digital business platforms
• Successful and irresistible digital business models
• Leadership based on an entrepreneurial organizational culture, innovation, and new value creation.« (spremić, 2017a, p. 54)

»Successful implementation of digital business operations starts with leaders within companies considering that companies' strategic orientation towards new innovative technologies that companies will implement represents the first step of a successful digital transformation of business activities.« (Alos-simo, verdu-Jover, & Gomez-Gras, 2017, as cited in Tušek, Ježovita, & Halar, 2018, p. 268) »The benefits of digital business transformation can only be achieved with the right blend of people, skills and organizational structure. (...) going digital is as much about transforming the knowledge and information-based culture of a company as it is about using new digital technologies.« (Marchand & Wade, 2014, p. 2, as cited in Tušek, Ježovita, & Halar, 2018, p. 268)

»Technology advancement is fuelling innovation in every industry: Machine learning is leading to self-driving cars and smart medical devices. The internet of Things—paired with predictive analytics—is advancing the preventive maintenance of energy grids and industrial equipment. Blockchain is reinventing financial transactions and consumer product traceability. Drones are taking on roles from delivering packages to performing physical inventories, to saving lives. And the cloud, big data, analytics, and bots are making business processes more efficient, more agile, and more insight driven.« (PricewaterhouseCoopers (2018, as cited in Tušek, Ježovita, & Halar, 2018, p. 268.)

»Computer and computer chips (‘internet of Things’ environment) will be equipped with increasingly sophisticated algorithms, such as big data and data mining, which will ensure the ability to quickly learn and process a large amount of different data, and such and similar digital technologies will change all activities and services, from trade and retail, payment transactions (blockchain technology), then the production of food and non-food products, healthcare, the financial industry, and up to the accounting and auditing profession.« (Tušek, Ježovita, & Halar, 2018, p. 268)

In its research, Pricewaterhouse Coopers (2018, as cited in Tušek, Ježovita, & Halar, 2018) found that companies in the modern era reach a technological 'inflection point' where growing, new, and innovative information and communication technologies enable companies to increase productivity and market share significantly and, at the same time, creating new products, services, and markets (p. 268-269). »Some of those new technologies, such as Blockchain, Machine learning and Artificial intelligence, are starting to support or replace certain decisions rather than just replace human effort the way earlier automation has. That factor introduces a new realm of opportunity—but also risks—and the need for different controls.«

»Combining digital technologies with the organizational and people changes required to build a digital information-oriented culture allows organizations to significantly improve business performance.« (Marchand & Wade, 2014, p. 2, as cited in Tušek, Ježovita, & Halar, 2018, p. 269)

»There are six specific areas of performance improvement related to the digital transformation of business operations: capturing and using real-time data about customer experiences for smarter sales interactions, monitoring and tracking information about product, service and solutions support for continuous improvement, sharing knowledge and information more effectively to act across functions and organization boundaries, applying deeper and more targeted analytics that enable better decision-making, deploying more efficient and agile processes and systems to react to rapid business change, adopting more innovative and resilient business models to create disruptive change and innovation in a particular industry.« (Marchand & Wade, 2014, p. 2, as cited in Tušek, Ježovita, & Halar, 2018, p. 269)

Companies that »successfully digitally transform their business operations have adapted their business model and way of acting to the digital economy, which ensures them a leading position, competitive ability and advantage in the market.« (Spremić, 2017a, p. 53) such companies »are simply doing things that others cannot do, or they do them in a way that creates an advantage over the competition«. (Spremić, 2017a, p. 53) »Digital technology and contemporary information systems directly affect the competitiveness of business operations in two fundamental ways: positively affect the operational efficiency of the company (they support the strategy of low costs or the strategy of cost leadership) and/or, in certain circumstances, becoming drivers of innovation and business changes (they support the differentiation strategy).« (Spremić, 2017a, p. 95)

Next to all the advantages of digitization and digital transformation of business operations mentioned so far, new and innovative information and communication technologies and digital technologies expose companies to new risks. Namely, »intensive application of information and digital technology brings numerous business benefits to companies but also exposes them to entirely new dangers and unwanted consequences and numerous new risks (IT risks, especially cyber risks)«. (Spremić, 2017a, p. 132)

»Information risks are risks of intensive application of information technology in performing business activities. (...) Companies should never consider information system application risks (information risks) just as technological risks, i.e., problems which are not of great importance for the financial performance of business operations.

Management's incorrect assessments of the nature of these risks can expose the company to a large direct financial loss and indirect subsequent damage.« (Spremić, 2017b, p. 62) information risks to which a company is exposed include risks of unprofitable investments in informatics, risks of unsuccessful implementation of informatics projects, risks of interruption or difficulty in the operation of the information system, risks of information system security. Informatics risks »have two key features; firstly, they are always present, regardless of whether the company has discovered them through its IT corporate governance mechanisms, accepted them or not, and mastering these risks represents considerable challenges for companies in achieving their strategic business goals, and they have a dual nature. Another feature of iT risks, in addition to their omnipresence described above, the dual nature, which implies that, on the one side, well- managed iT initiatives create new value, new business possibilities and opportunities, and ensure sustainable competitive ability and advantage; however, on the other side, poorly managed initiatives affect the destruction of business operations, i.e. the absence of new value creation, i.e. reducing the existing value of the company, wasting resources, creating damages, business losses, employee dissatisfaction and like.« (spremić, 2017b, p. 62)

»The factors that enable the business growth of companies and increase the efficiency of their operations also represent a potential basis for cyberattacks, that is, forces that strengthen the cyber vulnerability of companies, whereby the four most significant factors stand out.« (Deloitte, 2017, as cited in Tušek & Halar, 2017, p. 47)

The biggest transformation traps are no »burning platform« – no sense of urgency, not enough funding, limitations of iT systems, unclear roles and responsibilities, lack of vision, unclear business case, business units implementing independently in silos, culture not amenable to change, lack of leadership skills, regulatory concerns (Fitzgerald, 2013, p.7, as cited in Tušek, Ježovita, & Halar, 2018, 271).

In the context of relevant factors of digital transformation of business operations, it is significant to emphasize that the company's management must systematically plan and control the process. The company can achieve this by designing an appropriate digital strategy for business operations that all employees will support.

»The digital strategy of business operations assumes a strategic plan of digital technology application in business operations. The digital strategy of business operations refers to the design of those activities that enable the development of information systems based on digital technology that effectively supports the strategic goals of the business operations and enables their realization in the following three ways:

1. efficient support of digital technology to the existing business model (run the business)
2. using digital technologies when changing existing business processes (change the business)
3. creating entirely new 'disruptive' business models with intensive digital technology applications (reinventing the business).« (spremić, 2017a, p. 100)

Celoten članek je dostopen za naročnike!