Contemporary Internal Auditing: a fine balance… Allen Amyotte, Director, Internal Audit March 9th, 2017 3:30 pm – 5:00 pm

Allen Amyotte, CGA CIA CRMA Internal Audit Allen Amyotte is the Director, Internal Audit at the University of Calgary, overseeing a team of six. Allen is a Chartered Professional Accountant and a Certified Internal Auditor and holds a Certification in Risk Management Assessment through the Institute of Internal Auditors in Florida. The fine balance: keeping a Board perspective while thinking like a VP.

Internal Audit Mandate Internal Audit: Why we exist Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations.  It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes. What does that mean!!!

Internal versus External? The difference between internal and external audit? While sharing some methodologies, internal and external audit have different objectives, scope, audiences and accountabilities.

Differences: Mandate External Audit Internal Audit Objectives Add credibility and reliability to financial reports. If SOx or Bill 198 (MI 52-109), also financial controls Evaluate and improve the effectiveness of governance, risk management and control processes. 

Difference: Scope External Audit Internal Audit Coverage Financial reports, financial reporting risks. If SOx or Bill 198 (MI 52-109), also financial controls All categories of risk, their management, and risk reporting

Differences: Audience External Audit Internal Audit Reports to The Office of the Auditor General (The Public) who is outside the governance structure. The Audit Committee of the Board of Governors and senior management (VPFS) who are within the governance structure.  

Internal Audit Reporting Board of Governors (BOG) Functional Reporting BOG Subcommittee: Audit Committee Internal Audit VP Finance & Services AdministrativeReporting

Differences: Accountabilities External Audit Internal Audit Responsibility for improvement None, however there is a duty to report problems. Improvement is fundamental to the purpose of internal auditing. But it is done by advising, coaching and facilitating.

Risk-based Internal Auditing For IA, risk is viewed through the lens of: Financial Compliance Fraud Reputational Operational

For Procurement (Purchasing) at U of C: Example For Procurement (Purchasing) at U of C: Financial: existence/occurrence, rights and obligations, etc. Compliance: NWPTA Public Sector legislation Fraud: scenarios, controls Reputational: “rabbit day” at CSM: U of C objectives Operational: how long to get something?

How Engagements Chosen (risk-based) Audit Planning How Engagements Chosen (risk-based) Annual Planning Process ERM Legislative Compliance Process Fraud Risk Assessment Annual Audit Plan Continuous Auditing / Data Analytics Compliance Assurance Follow-up Audits and Facilitations Advisory and Investigative Audit Administration and Training

How engagements performed Audit Execution How engagements performed Scoping: Audit Engagement Memo Fieldwork: RACM, Audit Programme Reporting: Audit Reports Approach Collaborative Agreement on Scope Agreement on Criteria Agreement on risks and issues

Internal Audit Approaches Internal Audit Relevance! “those who show up after the war to bayonet the wounded” OR “trusted advisor”

Auditor Viewpoint Criteria Think like a VP: for perspective Line of Sight: to goals, strategies and objectives Risk Lens: commonly defined risks and tolerances Expertise: process and governance mindset

Auditor Behavioral Criteria Understand the business and the sector Develop relationships Facilitate outcomes Change versus report: close outstanding issues

Questions