internal auditing the path forward · • 74% of stakeholders believe ia needs improvement • 96%...
TRANSCRIPT
www.theiia.org
Internal Auditing 2011:It’s Time to “Fill the Glass”
Richard Chambers, CIA, CGAP, CCSA
President and CEO
The Institute of Internal Auditors
www.theiia.org
www.theiia.org
Presentation Overview
• Dynamic change continues
• Emerging gaps in stakeholder expectations
• Key imperatives for 2011– Assess and align with key stakeholder expectations
– “Step up to the plate” in risk management
– Enhance Internal Auditing’s knowledge of the business
– Streamline internal audit processes and operations
– Coordinate and align with other risk, control and compliance
functions
www.theiia.org
Dynamic Change is Continuing
Shifting
• Resources
• Focus
• Priorities
www.theiia.org
Where Do We Find Ourselves in 2011:
Impacts On Internal Audit Budgets
Increased Stable Decrease
2008 36% 50% 14%
2009 27% 44% 29%
2010 32% 40% 28%
The Past Three Years
Source: The Institute of Internal Auditors, Audit Executive Network
Increased Stable Decrease
Overall 33% 48% 19%
F500 41% 43% 16%
The Situation Today
www.theiia.org
Where Do We Find Ourselves in 2011:
Impacts On Internal Audit Staffing
Increased Stable Decrease
2008 22% 70% 8%
2009 20% 61% 19%
2010 17% 67% 17%
On Internal Audit Staffing
Source: The Institute of Internal Auditors, Audit Executive Network
Increased Stable Decrease
Overall 20% 68% 12%
F500 23% 59% 18%
The Outlook for 2011
www.theiia.org
The Global Economic Crisis:
Impact on Internal Audit Since 2007
Increased Stable Decrease
Overall 37% 26% 37%
Fortune 500 31% 18% 51%
Internal Audit Budgets
Internal Audit Staffing
Source: The IIA Audit Executive Center – August 30, 2010
Increased Stable Decrease
Overall 30% 42% 28%
Fortune 500 25% 34% 41%
www.theiia.org
Realigning Internal Audit Coverage
2011 Audit Plan Increased
Operational risks 56%
Compliance risks 55%
Fraud risks 44%
Effectiveness of risk management 43%
Financial risks 29%
Cost/expense reduction or containment 28%
Reputational risks 24%
Source: Emerging Trends and Leading Practices Spring 2011, The Institute of Internal Auditors – Audit Executive Network
www.theiia.org
• We have weathered the storm well
• Our stature remains strong
• Ample resources remain
• We are recognized, trusted and valued
in many organizations
• The glass is at least “half full”
There is Reason
to Be Proud!
www.theiia.orgwww.theiia.org
Maybe – it is time to
stop celebrating
and
Fill the Glass!
www.theiia.org
Five Key Imperatives for 2011
1. Assess - and align with - key stakeholder
expectations
2. “Step up to the plate” in risk management
3. Deploy a strategy for internal audit business
knowledge acquisition
4. Streamline internal audit processes and operations
to enhance value
5. Coordinate and align with other risk, control and
compliance functions
www.theiia.org
Assess and Align With Key Stakeholder
Expectations
www.theiia.org
Management
Third Parties
Board
Internal Auditing’s Stakeholders
• Dynamic
• Cyclical
• Rarely aligned
www.theiia.org
Meeting Stakeholder Expectations:
Are we Being Honest With Ourselves?
Audit Committee Executive Mgt
Unacceptable 0.0% 0.4%
Poor 0.4% 1.9%
Acceptable 16.1% 25.9%
Good 57.6% 57.8%
Outstanding 25.9% 14.0%
“If surveyed today on how well internal auditing is meeting its needs and expectations, my audit committee/executive management would probably rate their overall satisfaction…”
Source: Emerging Trends and Leading Practices Spring 2011, The Institute of Internal Auditors – Audit Executive Network
www.theiia.org
Source: Ernst and Young global internal audit stakeholder survey, November 2010
• 74% of stakeholders believe IA needs improvement
• 96% within the next 24 months
• Only 44% believe IA helps achieve business objectives
• Only 37% involve IA in key business decisions and strategy
• Only 32% believe IA attracts future leaders and high potential
talent from within the business
The View from the Other Side:
www.theiia.org
“Over the past year, how much have the needs and expectations of
management and the audit committee driven change in the focus or
coverage of your internal audit function?”
2% 6% 8%
31%53%
No influence
Minimal
Extensive
More than usual
Some influence, butno more than usual
Stakeholder ExpectationsReality Check
www.theiia.org
Assess and Align with Stakeholder
Expectations
Strategies for Assessing Stakeholder Needs
Ongoing informal discussions with AC chair to assess expectations 69%
Regular formal meetings with key stakeholders to assess expectations 59%
Discussions with full audit committee to assess collective expectations 57%
Formal surveys of stakeholders to assess expectations/performance 40%
Discussions with the full executive leadership/management team in the same room to assess collective expectations/performance 26%
Source: Emerging Trends and Leading Practices Spring 2011, The Institute of Internal Auditors – Audit Executive Network
www.theiia.org
Director Concerns
17
AREA OF CONCERN
Executive compensation 41%
Governance and compliance 38%
Mergers and acquisitions 34%
Investor relations 33%
Operational risk 33%
Liquidity 31%
Internal controls 29%
Media relations/business reputation 28%
Outside legal fees 23%
Proxy and director election issues 22%
Source: Corporate Board Member magazine, August 2010
www.theiia.org
Assessing and Aligning with Stakeholder
Expectations:
1. Define/revalidate your stakeholders – not the
same in every organization
2. Gain a clear understanding of their current
expectations
– Communicate, communicate, communicate
– Create awareness of internal audit’s potential
– Identify and reconcile stakeholder alignment
challenges
3. Assess internal audit’s current capabilities
and identify “gaps”
4. Formulate a strategic plan to address gaps
and achieve continuous alignment
5. Continuously recalibrate
www.theiia.org
Step Up to The Plate
in Risk Management
www.theiia.org
Risk Management
• Risk management failures were key factors in the financial crisis
• Growing pressure on management to strengthen risk management
• Growing pressure on boards to demonstrate RM oversight
• Internal auditing should play a critical role:
– Natural experts on risk management
– Champion or facilitate ERM
– Maintain a continuous focus on risks
– Be capable of addressing the full “portfolio of risks” in audit coverage
– Provide assurance on the effectiveness of risk management
www.theiia.org
Focusing on the “Real Risks”
Strategic & Business 60% Operational 20%
Financial 15% Compliance 5%
Key Imperatives for the Coming Decade: Fully
Embrace a Risk-Centric Strategy
www.theiia.org
Deploy a Strategy
for Acquiring and Cultivating Knowledge
of the Business
www.theiia.org
Internal Auditing’s Role in Risk
Management is on The SEC’s Radar:
The SEC will generally want to understand how risk
management is embedded in key business processes and
decision-making:
“How does the internal audit process independently verify
and provide the board and senior management with
assurance regarding the operating effectiveness of risk
management, compliance and control functions?”
Carlo di Florio, Director of the Office of Compliance Inspections and Examinations at the
U.S. Securities and Exchange Commission - 2/8/2011
www.theiia.org
The Emerging “Knowledge Gap”
• Collective knowledge must be capable of addressing the
full portfolio of risks
• The 2000’s were the decade of “financial auditing
expertise”
• Diversification of internal auditing’s focus has exposed
knowledge gaps:
– Knowledge of the business/industry
– Fraud investigation/audit capabilities
– Understanding how to audit operating,
strategic and business risks
www.theiia.org
Acquire and Cultivate Knowledge
Strategies to Acquire/Maintain Business Knowledge All F500
Internal development of existing personnel 87% 94%
Active recruitment of experienced professionals with industry experience or knowledge 43% 51%
Co-sourcing relationship with a third-party provider to leverage industry experience 32% 41%
Rotational program in which experienced professionals from the business rotate into internal auditing on an ongoing basis 16% 36%
I do not consider acquisition of business/industry knowledge to be a priority 1% 0%
Source: Emerging Trends and Leading Practices Spring 2011, The Institute of Internal Auditors – Audit Executive Network
www.theiia.org
Acquire and Cultivate Knowledge
Strategies to Enhance/Maintain Business Knowledge All F500
Staff subscribe to industry periodicals or other literature 75% 76%
Staff receive training focused on industry risks or issues 69% 71%
Partnering inexperienced staff with more experienced staff 67% 96%
CAE participation in industry focused CAE groups or events 55% 78%
CAE frequently, but informally, benchmarks/networks with peers 49% 69%
Hosting regular all-staff training events 32% 69%
Extensive knowledge management framework used to acquire/enhance/maintain knowledge of the business
21% 24%
Source: Emerging Trends and Leading Practices Spring 2011, The Institute of Internal Auditors – Audit Executive Network
www.theiia.org
Skill Sets Being Recruited in 2011
All F500
IT (general) 45% 57%
Business and industry-specific knowledge 44% 60%
Data mining and analytics 38% 61%
Risk management 20% 19%
Risk assessment activities 20% 17%
Report writing 20% 20%
Source: Emerging Trends and Leading Practices Spring 2011, The Institute of Internal Auditors – Audit Executive Network
www.theiia.org
Streamline Internal Audit Processes And
Operations
To Enhance Value
www.theiia.org
Enhance Capacity Through Innovation
• Sourcing solutions that are:
– Strategic
– Innovative
– Efficient
• Reengineer processes
– Risk assessment
– Engagement planning
– Reporting
• Leverage technology
www.theiia.org
Coordinate and Align
With Other Risk, Control
and Compliance Functions
www.theiia.org
Key Imperatives for the Coming Decade:
Enhance Coordination Internally
• Internal audit co-exists with:
– Compliance
– Risk management
– Corporate investigations
– Internal controls
– Environmental or other audit functions
• Gaps or redundancy present risks
• Formal and informal communication
• Cooperate in developing and
communicating risk assessments, plans, etc
www.theiia.org
Value Proposition for Key Stakeholders
Internal Auditing:
• Assurance
• Insight
• Objectivity
Governing bodies and senior management rely on Internal Auditing for objective assurance and insight on the effectiveness and efficiency
of governance, risk management and internal control processes.
www.theiia.org
Questions?For more information, contact:Richard F. ChambersPresident and Chief Executive OfficerThe Institute of Internal Auditors
Follow me on Twitter: @IIACEO