How To Understand The Role Of An Internal Audit

Transcription

1 Top Ten Issues facing Internal Auditing in the Future The IIA Dallas Chapter April 6, 2006 Presented by: David A. Richards, CIA, CPA President The Institute of Internal Auditors 1

2 Agenda What should Internal Auditors do? Top Ten areas for internal auditors to focus on for the future How can The IIA help? 2

3 Definition of Internal Auditing: Internal Auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization s operations. It helps an organization accomplish its objectives by bringing a systematic and disciplined approach to evaluate and improve the effectiveness of the risk management, control and governance processes. (Approved by the Board of Directors 6/26/99) 3

4 What do Internal Auditors Do? Help solve problems Confirm accuracy of information Ensure assets are properly safeguarded Confirm compliance to laws & regulations Help improve the effectiveness and efficiency of processes Investigate fraud situations Provide a resource for skills 4

5 What are our Constituents saying about us? Communication needs improvement (AC, Mgt, EA) Focus needs better alignment Resources/skills need assessment Top areas for attention: control, risk, fraud, IT Assessment of results presentation 5

6 Where are we now??? What Image do we have? What type of Outputs do we produce? What Process do we follow? What ability do we have to control the future? What indicators do we have of how we are doing? 6

7 Where are we now??? Image Corporate cop Compliance focused Partner Source of value creation Involved in corporate initiatives Customer focused 7

8 Where are we now??? Outputs Findings / causes Recommendations Implementation help Post implementation verification / confirmation of results that resolve issues Anticipate customer needs 8

9 Where are we now??? Cycle Process Risk based Customer input Customer focused / driven Competitive (Bid) Proactive vs. reactive 9

10 Agenda What should Internal Auditors do? Top Ten areas for internal auditors to focus on for the future How can The IIA help? 10

11 #1:Fraud Audit Techniques 11

12 Fraud Responsibilities Internal Auditing Fraud risk identification & response Investigating Fraud cases Fraud consideration in each audit Support Hot Line Support Education & Training Help Ethics Officer Fraud Program Help establish Corporate Compliance Program 12

13 Fraud Aspects Awareness Training Identification Investigation 13

14 #2:Technology Expertise 14

15 Assessing IT Controls Understanding IT Controls Governance, Management, Technical General / Application Preventive, Detective, Corrective Information Security Importance of IT Controls Roles & Responsibilities for IT Controls Based on Risk Monitoring techniques Assessment Process 15

16 GAIT Scoping Example For financial reporting, the scope of IT control testing has three primary axes: What business processes are in scope? Which business processes are relevant to financial reporting (e.g., materiality)? How significant is the business process to the financial reporting objective? What other transactional controls exist that may create assurance of the business process integrity (e.g., manual settlement and balancing)? Example: 10 revenue generating systems; external auditors won t look at all 10, but will concentrate on the 3 that compose 85%. For those business processes in scope, what IT assets are considered relevant to financial reporting (e.g., distance and percentage of controls embedded in IT)? Example: 10 revenue generating systems; external auditors won t look at all 10, but will concentrate on the 3 that compose 85% of the overall revenues. What level of controls evaluation and testing is required to create sufficient assurance for management to make the assertions related to IT change and IT entitlements transactions (e.g., completeness, accuracy, etc.)? What are the types of controls in place? The level of assurance goes from highest to lowest, in the following order: automated and preventive automated and detective: manual and preventive manual and detective 16

17 #3:Governance Auditing 17

18 Governance Key Words Expectations What is needed for Success: Policies, procedures, guidance, organization, assignment of responsibilities Communications Informing & Training Accountability holding people accountable for meeting expectations 18

19 IIA Standards-Governance 2130-Governance The internal audit activity should contribute to the organization's governance process by evaluating and improving the process through which (1) values and goals are established and communicated, (2) the accomplishment of goals is monitored, (3) accountability is ensured, and (4) values are preserved 19

20 Allocation of IA Effort Best Practice reviews Perform audits of design & effectiveness of specific governance processes Audit Effort Provide advice with focus on Establishing Governance Structure Less Structured More Structured Governance Model 20

21 What Should IA Do? Setting Expectations: IA should: -- Help drafting of policies, procedures, processes, guidance to utilize their - knowledge -expertise -- Ensuring Controls are build into processes not added on 21

22 What Should IA Do? Communicate: IA should: -- Assist in training programs on - Ethics - Risk identification - Control options - Fraud awareness -- Design programs -- Participation in training sessions 22

23 What Should IA Do? Accountability: IA should: -- Perform objective assessments using systematic, disciplined approach that incorporates an evaluation of evidence -- Ensure compliance to management directives by comparison of actual to criteria -- Assist in evaluation of processes to ensure efficient operations and effective accomplishment of objectives 23

24 #4:Internal Control Assessment & Opinion 24

25 Control Defining Key Controls Assessing Control Effectiveness Opinion 25

26 Control A Process Effected by an Entity s Board of Directors, Management and Other Personnel, Designed to Provide Reasonable Assurance regarding the Achievement of Objectives in the following categories: --Effectiveness & Efficiency of Operations --Reliability of Financial Reporting --Compliance with Applicable Laws & Regulations --Safeguarding of Assets COSO Definition 26

27 Opinion on IC Evaluation criteria & structure Scope Who has responsibility for IC Type of opinion Positive assurance Binary Graded Directional Negative assurance Qualified 27

28 Issues Estimates Closing Process Journal Entries Reconciliations Assignment of Responsibilities Accountability Ethics Risk Assessment Governance (Principles) IT Controls Analysis & Monitoring 28

29 #5:Risk Assessment Approach 29

30 5. Risk Assessment Knowledge Use Reporting Audit Committee & Risk ERM & IA 30

31 Definition IIA Research Report A rigorous and coordinated approach to assessing and responding to all risks that affect the achievement of an organization s strategic and financial objectives. This includes both upside and downside risks. 31

32 Key Concepts Premises ERM enables management to effectively deal with uncertainty and associated risk and opportunity, enhancing the capacity to build value 32

33 Core Roles for IA on ERM Giving assurance on risk management processes. Giving assurance that risks are correctly evaluated. Evaluating risk management processes. Evaluating the reporting of key risks. Reviewing the management of key risks. 33

34 Roles IA Can Do Facilitating identification and evaluation of risks. Coaching management in responding to risks. Coordinating ERM activities. Consolidating the reporting on risks. Maintaining and developing the ERM framework. Championing establishment of ERM. Developing risk management strategy for board approval 34

35 Roles IA should NOT do Setting the risk appetite. Imposing risk management processes. Management assurance on risks. Taking decisions on risk responses. Implementing risk responses on management's behalf. Accountability for risk management. 35

36 ERM Framework What s New? STRATEGIC OPERATIONS REPORTING Internal Environment COMPLIANCE SUBSIDIARY Objective Setting BUSINESS UNIT Event Identification DIVISION ENTITY - LEVEL Risk Assessment Risk Response Control Activities Information and Communication Monitoring 36

37 M A R K E T / E X T E R N A L R I S K Competitor Sensitivity Investor Capital Availability Sovereign/Political Legal Regulatory Industry Financial Markets Business Interruption Collateral Catastrophic Loss Sourcing Interest Rate Currency Commodity Equity BUSINESS PROCESS RISK Cash Flow Concentration (Liquidity) Concentration (Credit) Efficiency Customer Satisfaction Performance Gap Cycle Time Dispatch Pension Fund Compliance Planning Product/Service Failure Opportunity Costs Environmental Scan Pricing Product Development Regulatory Reporting (Operating) Regulatory Reporting (Financial) Resource Allocation Taxation Collective Bargaining SYSTEM & TOOLS RISK Integrity Access Availability Infrastructure MANAGEMENT REPORTING O P E R A RISK T I O N A L R I S K Accounting Information Contract Commitment Financial Reporting Evaluation Relevance Treasury Reporting FACILITIES & EQUIPMENT RISK Capacity Environmental Health & Safety Obsolescence/Shrinkage MODEL & ASSUMPTION RISK Budget & Planning Financial Instrument Investment Evaluation Performance Measurement (Process) Valuation COUNTERPARTY RISK Default Outsourcing Settlement ORGANIZATION, MANAGEMENT & STRUCTURE RISK Authority/Limit Change Readiness Communications Employee Fraud Human Resources Illegal Acts Leadership Management Fraud Organization Structure Performance Incentives Unauthorized Use BUSINESS STRATEGY AND POLICY RISK Alignment Business Portfolio Credit Policy Life Cycle Performance Measurement 37 Reputation Trademark/Brand Name Erosion

38 Essential Process OBJECTIVES EVENTS INHERENT RISK RESPONSES RESIDUAL RISK 38

39 Essential The Big Picture High Impact/ Low Likelihood High Impact/ High Likelihood Low Impact/ Low Likelihood Low Impact/ High Likelihood 39

40 #6:Time Management 40

41 #7:Willingness to step up to the plate & be counted 41

42 #8:Observation Skills Application 42

43 #9:Consultancy / Process Analysis Skills 43

44 #10:Communication Skills 44

45 Agenda What should Internal Auditors do? Top Ten areas for internal auditors to focus on for the future How can The IIA help? 45

46 The IIA Vision The global voice of the internal auditing profession: advocating its value, promoting best practice, and providing exceptional service to its members. 46

47 The IIA Mission Statement The mission of The Institute of Internal Auditors is to provide dynamic leadership for the global profession of internal auditing. Activities in support of this mission will include but will not be limited to: 1. Advocating and promoting the value that internal audit professionals add to their organizations; 2. Providing comprehensive professional growth opportunities; standards and other professional practice guidance; and certification programs; 47

48 The IIA Mission Statement (Continued) 3. Researching, disseminating, and promoting to practitioners and stakeholders knowledge concerning internal auditing and its appropriate role in control, risk management, and governance; 4. Educating practitioners and other relevant audiences on best practices in internal auditing; and 5. Bringing together internal auditors from all countries to share information and experiences. 48

49 IIA Mission is to provide: Guidance & Standards Certification Program Research Promotion of the Profession Forum for interchange Training 49

50 IIA Top Needs Advocacy Globalization Service to Members 50

51 Advocacy Position papers Key Constituent Groups Link to IIA Advocate Advocacy Specific Plan for each Group Objective Approach Measures of success 51

52 Global Initiatives Guidance Planning Academic Relations Government Auditors SOA / Control Assessment Technology Based Learning Service Providers Knowledge Management Customer Service 52

53 Global Initiatives Branding Certification (CBT) Translations on Website Webcasts Bill Bishop Memorial Fund Project Global Seminars IT GTAG & GAIT 53

54 Global Initiatives International Conference Model GAIN Flash Surveys Capacity Development Website Redesign CIA Training Course Career Board 54

55 Operations - Service Website Information Affiliate Relations (restructure) Membership (growth & retention) New Computer Systems (Cust Serv) Bookstore global reach CIA (exam training, CAE testing, Support) Quality Assessment (SAWIV, tools, QA Manual) Publications On line delivery 55

56 The Internal Auditing Activity is a key element in an On-going Monitoring and Oversight Program within an Organization. It demonstrates Management & Board commitment to ensuring accuracy, efficiency, and effectiveness of operations & reporting. 56