Senior risk and internal audit leaders globally believe the major focus on internal controls in recent years is now paying off, with several major business benefits emerging.

According to an international study from Ernst & Young (EY), better processes and underlying controls (89 per cent), better understanding of major risk areas (86 per cent) and improved compliance (80 per cent) were the top three benefits of current investments in internal controls.

While respondents – primarily chief risk officers, directors of internal audit and CFOs from outside the financial services industry – reported headway on business benefits of internal control, the EY study revealed divergent approaches to risk assessment. For example, while 65 per cent of respondents said the performed annual risk assessments an annual enterprise risk management (ERM) assessment covering major internal and external risks, 24 per cent perform the assessment twice or more often per year.

However, 21 per cent perform no ERM risk assessment at all, making it all but impossible to direct internal controls investment efficiently as they are not aligned with risk.

EY also found that IT and fraud were clear pain points in terms of internal controls. For example, in the areas of user system access and IT security, nearly 40 per cent of respondents said their controls were less than effective. This demonstrated a pressing need to invest in the effectiveness of IT controls and increase risk assessment capabilities.

In terms of fraud, meanwhile, more than two-thirds of respondents have no formal fraud prevention program in place, a worrying statistic given that other research showed that 20 per cent of surveyed companies have experienced significant fraudulent activity in the past two years.

Looking ahead, the major areas of investment in internal controls will be driven by better understanding of major risks, with more effective controls and more efficient compliance rounding out the top three. Other drivers included more reliable financial reporting, a positive influence on investor confidence, better use of IT investments and improved integration of acquisitions.