1. Internal Audit Support of Audit Committees What Works Best The Institute of Internal Auditors Webcast Series on Sarbanes-Oxley Session #5 September 9, 2003

2. The IIA Webcast Moderator Jim Key, CIA Managing Partner Shenandoah Group, L.L.P 3. Disclaimer

The views expressed in this webcastare solely those of the panelists and moderators and do not necessarily reflect the views or policies of The Institute of Internal Auditors or its directors, officers, employees, and members.

4. Series 2:Emerging Trends and Best Practices in Implementing SOA

• May 21 -Section 404 Readiness Review: How to document your system of internal control . (Archived)

• June 10 -Helping your audit committee implement complaint handling.(Archived)

• July 8 -Leveraging the COSO framework to meet Section 404 requirements (Archived)

• August 12 -Project Administration Setting and revising priorities in the wake of the Final 404 Rules (Archived)

• September 9 -Internal Audit support of Audit Committees What works best

• September 30 -The Road Ahead Meeting the challenges in complying with The Sarbanes-Oxley Act

5. Webcast Series on SOA

Fostering Compliance with SOA:Internal Auditors Role

• Four sessions archived on IIAs website and available on CD

• Originally aired January 28 April 15, 2003

6. Agenda

1:00Introductions and Overview

1:10Managing the Auditors Janice Wilkins

1:20Managing the Audit Committee Schedule -Norman Marks

1:30Educating the Audit Committee Jerry Ferenczy

1:40Break

1:45Questions and Answers - Panel

2:25Wrap up - Jim Key

7. Managing the Auditors - How Internal Audit Supports the Audit CommitteeJanice Wilkins Vice President Director, Internal Audit Intel Corporation 8. Supporting the Audit Committee Board of Directors Audit Committee Compliance with Applicable Laws & Regs Internal Audit External Audit Management Reliability of Financial Reporting Effectiveness & Efficiency of Operations Oversight of Financial Reporting Process & Internal Control

Competency Assessment

Services & Fees

Audits & Reporting

AC Operations

Regulatory Compliance

9. Competency Assessment

Independence and objectivity

Client and industry knowledge

GAAP and GAAS expertise

Proactive communications/responsiveness

Domestic and international staff quality

Internal quality control

Litigation

Negative press

10. Services and Fees

Regulatory compliance verification

Non-financial audit pre-approvals

Audit scope review

EA budget coordination and reporting

IA budget and staffing reviews

Benchmarking

EA contract re-bid

EA partner rotations

EA engagement team employment

11. Audits and Reporting

Enterprise, business unit and financial reporting risk assessments

Controls evaluation and opinion

EA and IA audit coordination

Management Letter Comments coordination

Focus topic discussions

Anonymous reporting administration

Fraud investigations

12. Audit Committee Operations

AC charter development and review

Meeting agenda setting

Facilitate pre-earnings calls

Meeting minutes review

Annual planner

Annual AC self-assessment

Financial expert & independence assessments

D&O questionnaires review

Annual EA and IA assessments

13. Regulatory Compliance

Regulatory and emerging issues updates

Ethics and compliance oversight and evaluation

14. Agenda

1:00Introductions and Overview

1:10Managing the Auditors Janice Wilkins

1:20Managing the Audit Committee Schedule -Norman Marks

1:30Educating the Audit Committee Jerry Ferenczy

1:40Break

1:45Questions and Answers - Panel

2:25Wrap up - Jim Key

15. Managing the Audit Committee Schedule Norman Marks Vice President, Internal Audit Solectron Corporation 16. Outline

Demands on the Audit Committees time

Demands on managements time

The role of the CAE

Tips and techniques

Conclusions

17. Demands on the A/C time

Expectations = Detail

Per Korn-Ferry, A/C time doubled

Sarbanes-Oxley, SEC, Listing Standards

Courts expect best practices

Greater liability (?)

18. Demands on the A/C time

Oversight of:

• Financial Reporting

• EA and IA (Internal Controls)

• Whistleblower Process

• Ethics Program

• Risk Management

Member training

19. Demands on Management

Preparation before & presentations at every meeting

Actions after/between meetings

Board focus on governance vs. management

20. The Role of the CAE

Advisor to Audit Committee

Advisor to Management

Help identify Best Practices

Often manage Audit Committee agenda

Often prepare Audit Committee materials

21. Tips and Techniques

Delete unnecessary charter tasks

Audit Committee checklist from charter

Lay out agendas for full year

Pre-reading materials and expectations

Reviews, etc. through e-mail

Information between meetings

22. Delete Tasks

Are all Committee activities necessary?

Eliminate historic tasks

Focus on governance vs. management

Prioritize activities

23. Committee Checklist March January Charter Step Review and reassess the adequacy of [the Committees] charter at least annually. X Review the Companys annual audited financial statements [i.e., those included on Form 10-K] prior to filing or distribution.Review should include discussion with management and independent auditors of significant issues regarding accounting principles, estimates, practices, and judgments. X 24. Lay out year

Meetings with a theme (e.g., year-end)

Move meetings to avoid calls (e.g., to coincide with 10-Q review)

Long meetings once a year (e.g., for training)

25. Pre-reading materials

Provide hard and soft copy well in advance

Members expected to read before meeting

Questions to CAE, etc. by e-mail before meeting

26. Reviews prior to meeting

Draft 10-Q, proxy, etc. sent to members early

Questions posed and answered via e-mail

At meeting, limit to confirmation that questions answered

27. Between meetings

Dont wait to share important information and handle through e-mail (e.g., audit reports)

Stay in touch and talk to members

28. Conclusions

The Audit Committees load considerably increased

Members do not want to limit their activities and spend double the time

They, management, and CAE can make meetings efficient with discipline and imagination

29. Agenda

1:00Introductions and Overview

1:10Managing the Auditors Janice Wilkins

1:20Managing the Audit Committee Schedule -Norman Marks

1:30Educating the Audit Committee Jerry Ferenczy

1:40Break

1:45Questions and Answers - Panel

2:25Wrap up - Jim Key

30. Educating theAudit Committee Jerry Ferenczy, CPA, CISA, CPCU 31. Audit Committees the Past

Met 3.3 times a year for less than 1 hour

1/3 did not regularly meet with IAD; 10% never met with them

Had no required pre-existing skill sets; most committee members had no formal training or education plan

32. Audit Committees the Present

Meet average of 6 times a year; some as many as 16

Are required to review IAD and risk management; must perform self evaluations

Must have some degree of financial literacy

33. The Effect

Boards must look at more stuff in more detail than ever before

Boards typically have two different types of members

Each type has different perspectives and needs

CAE must be prepared for both types

34. Suggestion # 1

Know Your Committee Members

WHERE WEVE BEEN HAS A LOT TO DO WITH WHERE WE ARE GOING.

35. Suggestion # 2

Know Whats Important

These facts, if true, suggest that the directorsconsciously and intentionally disregarded their responsibilities . . .

They simply did not care if they were making a material decision with adequate information.

- the Disney decision

36. Suggestion #3

Share What You Know

"You got to be careful if you don't know where you're going, because you might not get there."

• Yogi Berra

37. Conclusion

Those who fail to learn from the past are doomed to repeat it.

38. Webcast Summary

Internal Audit must support the Audit Committee in its new role as manager of the external auditors

Assisting the Audit Committee in managing its schedule is now critical with impact of Sarbanes Oxley

Educating the Audit Committee to serve its broadened role is essential

39. Thank you for your participation! Dont miss our next Webcast series beginning September 30, 2003