If a company has a governance structure and processes in place, are they working the way they're supposed to be working? Are the key elements of the governance process being followed? Are inconsistencies in governance structure from one region to the next creating problems for the company? (Or, is it necessary to have a certain degree of structural variation and does this maximize efficiency and productivity?) Are approvals coming through as expected? What are the trouble spots and what needs work?
The audit, then, is just one of numerous tools for measurement and assessment of data and practices within a company. The larger question is whether a company has business controls in place that are effective in determining whether what is supposed to be happening is actually happening.
Nevertheless, for most members, in terms of business controls, the audit is what they are most familiar with. So that has been the focus; and specifically audits that are related to compliance (meeting Sarbanes-Oxley and other legal/regulatory requirements), and to high-visibility areas such as data privacy and security. But that isn't the only reason many companies find them essential. Sometimes an audit intended to provide scrutiny in one area inadvertently uncovers problems in another area, such as benefits practices that may be costing the company excessive amounts of money.
Audits also shed light on the financial milestones a company has or has not achieved, what areas need particular focus and how a company can remain market-competitive and financially healthy. And for a multinational company, what makes its operations in one region competitive may not be the same for operations in another region.
As it stands, the evidence suggests a lot of variation among GBGH members in terms of audits. But perhaps the key finding in the survey of members was that almost three quarters of those polled said they had never done a benefits governance audit per se. That is, they had never audited the company's structure and processes, taken a look at the larger benefits picture, in a sense. But, again, a more useful way to frame this might be to go outside the issue of the audit or even alter the semantics of the conversation. It would seem that many members understand audits as specific measurements of defined functions. As suggested earlier, when looking at the large-umbrella question of governance, then, it might be more useful to focus on whether the various business controls that monitor governance processes are in place and whether they are doing the job they were meant to do.
Many members do undertake audits of one kind or another, or they contract to have them undertaken by someone else. Retirement is the key area for many members, given the high financial stakes attached to it. As one member company puts it in regard to the use of audits, "We target the largest plans that have the greatest financial risk exposure." It isn't surprising, then, that retirement is sometimes the largest or even sole focus of a company's involvement with auditing.
Who conducts an audit is another variable for Global Business Group members. Some rely solely on internal audits by staff they trust because, as the thinking goes, company personnel will understand the unique aspects of the business more fully than outside consultants. Of course, audits that might jeopardize the security of company data may have to be undertaken internally. Nevertheless, for many kinds of audits, some members favor outside vendors, presumably valuing the objectivity offered by someone without a stake in the company. Finally, there are those who prefer a combination, that is, audits in some areas that are done by internal staff and other areas in which audits are conducted by independent professionals.
A challenge for many companies that bring in auditors is managing the scope of the audit. While it is important to note any possible malfeasance or other problems discovered during the auditing process, even in areas outside the initial scope, it is equally important that a company make sure the audit remains focused on aspects defined up front and that are of the most interest and yield the most useful insights to the company at that particular time.
Outside auditing vendors may be internationally established firms or they may be smaller and lesser known regional firms. For some, the frequency of an audit may be annual, while for others it may be every few years or whenever a corporate issue necessitates the need for the analysis and clarity that auditing can provide.