Voice of the Customer: Stakeholders Messages from the CBOK Global Internal Audit Study Dick Anderson, De Paul University Brad Rachmiel, Protiviti April 3, 2017

Objectives of Session 1 Provide insights and observations on key issues related to stakeholders of internal audit identified during the CBOK Stakeholder Study 2 Provide actionable ideas and recommendations for you to consider for both you and your key stakeholders Identify one topic or item to take back and improve on! Join Us: @IIAChicago ● #IIAChi ©Institute of Internal Auditors 2017

Background on CBOK Stakeholders Study Seek direct feedback from stakeholders on a global basis Protiviti chosen to execute in partnership with The IIA Seeking leading, actionable practices and advice Join Us: @IIAChicago ● #IIAChi ©Institute of Internal Auditors 2017

Study Demographics Join Us: @IIAChicago ● #IIAChi STAKEHOLDER STUDY FACTS Survey participants 1,124 Interview participants 100+ IIA institute partners 23 Languages 13 STAKEHOLDER POSITIONS REPRESENTED Board/audit committee chair Board/audit committee member Chief executive officer (CEO) Chief financial officer (CFO) Chief information officer (CIO) Chief risk officer (CRO) Chief compliance officer (CCO) Chief operating officer (COO) Chief legal officer (CLO) Canada Netherlands Belgium United Kingdom France Spain Russia Poland Germany Italy United States Turkey Japan Mexico United Arab Emirates India Taiwan Malaysia Singapore Brazil South Africa Australia Join Us: @IIAChicago ● #IIAChi ©Institute of Internal Auditors 2017

Five Reports from the Stakeholder Study Reports are free on the IIA’s CBOK Resource website Join Us: @IIAChicago ● #IIAChi ©Institute of Internal Auditors 2017

Overall Conclusions Join Us: @IIAChicago ● #IIAChi ©Institute of Internal Auditors 2017

Stakeholders Give Internal Audit High Marks on Foundational Elements Agree that internal audit focused on areas and topics that are significant 1 Internal audit keeps up to date with changes in the business 2 Sufficiently communicates audit plans 3 Join Us: @IIAChicago ● #IIAChi ©Institute of Internal Auditors 2017

Stakeholders Give Internal Audit High Marks on Foundational Elements “Know your organization’s mission, strategy, objectives and risks. Effectiveness of internal audit continually comes back around to this foundation.” This overall positive view provides a good foundation for internal auditors to leverage their reputation for quality into other areas in which they can add value Join Us: @IIAChicago ● #IIAChi ©Institute of Internal Auditors 2017

Assurance is Highly Valued Join Us: @IIAChicago ● #IIAChi ©Institute of Internal Auditors 2017

Assurance is Assumed Stakeholders expect internal audit to provide assurance – and do it with excellence Join Us: @IIAChicago ● #IIAChi ©Institute of Internal Auditors 2017

Stakeholders View Assurance as Essential Balance your work to reflect this “Assurance is essential and consulting is nice to have, but should be secondary in priority.” Board Member, United States Join Us: @IIAChicago ● #IIAChi ©Institute of Internal Auditors 2017

Best Practices in Providing Assurance 1 Ensure the audit work is aligned to the strategic risks of the organization 2 Avenues to improve the role Avenues for Internal Audit to Improve Its Role in Responding to Strategic Risks Join Us: @IIAChicago ● #IIAChi ©Institute of Internal Auditors 2017

Best Practices in Providing Assurance 3 Strategic risks Incorporate a focus on strategic risks during assurance work Ensure that the assurance work is closely aligned to the strategic risks of the organization “Internal auditors need to be able to structure their annual plan to link the corporate strategy to their efforts/accomplishments. It is important to identify weaknesses and link them to the key strategy.” Compliance Executive , Spain Join Us: @IIAChicago ● #IIAChi ©Institute of Internal Auditors 2017

Best Practices in Providing Assurance 3 Strategic risks However, there are differences of opinion of stakeholders about internal audit’s role related to strategic risks May point to a need to educate stakeholders Should Internal Audit Have a More Active Role in an Organization’s Strategic Risks? Join Us: @IIAChicago ● #IIAChi ©Institute of Internal Auditors 2017

Moving Beyond Assurance Join Us: @IIAChicago ● #IIAChi ©Institute of Internal Auditors 2017

Building on Assurance Stakeholders want internal audit to provide advisory work where it does not interfere with their assurance work Join Us: @IIAChicago ● #IIAChi ©Institute of Internal Auditors 2017

Areas to Address Beyond Assurance Areas for Internal Audit to Address Beyond Assurance Join Us: @IIAChicago ● #IIAChi ©Institute of Internal Auditors 2017

Level of Advisory Work Varies Maturity of the organization and its location 01 Competence of the internal audit function 02 Stakeholders do not see this as an either/or situation 03 Some stakeholders concerned that being overly focused on advisory work will detract from assurance work 04 Join Us: @IIAChicago ● #IIAChi ©Institute of Internal Auditors 2017

The Assurance/Advisory Balance Pursue advisory or consulting work where you have the Competency Capacity Support from your stakeholders Join Us: @IIAChicago ● #IIAChi ©Institute of Internal Auditors 2017

Other Stakeholders Expectations Voiced Join Us: @IIAChicago ● #IIAChi ©Institute of Internal Auditors 2017

Align with Expectations Not all stakeholders see things the same way or want the same value from internal audit The CAE bears the brunt of the responsibility of addressing this challenge Develop, socialize, validate a written set of expectations for value Measure and report on progress with a balanced scorecard Join Us: @IIAChicago ● #IIAChi ©Institute of Internal Auditors 2017

Know Your Business To be effective, internal audit must view itself as a part of the business of the organization, understanding its industry, strategy and tactics 1 Business acumen is necessary for this more active role 2 Business acumen is not taught in classrooms, but gained through engaging with management and front-line personnel as they run the organization 3 Some stakeholders believe internal auditors should have business experience 4 “ I would expect CAE’s to have hands-on experience in business before taking up the internal audit function.” - CFO, India Join Us: @IIAChicago ● #IIAChi ©Institute of Internal Auditors 2017

Know Your Business Action Items for CAE’s Identify the essentials to their success of your organization – its industry, the external environment, the chosen strategies and businesses and the risks related to those strategies and businesses Assess your level of business acumen and , if necessary, develop a plan to spend time and effort with those in your organization who can help you think more like a business leader Engage your stakeholders as a business leader not a technical auditor Join Us: @IIAChicago ● #IIAChi ©Institute of Internal Auditors 2017

Think Beyond Scope CAE’s need to challenge their teams to “connect the dots” by thinking about the implications of audit findings across the organization What is the real meaning of these findings? Is there a broader message? How are we driving value out of our compliance and assurance activities? As leaders of the organization, what are we missing? Are there potential crisis events that we have not thought about and for which we are unprepared to respond? Join Us: @IIAChicago ● #IIAChi ©Institute of Internal Auditors 2017

Think Beyond Scope A final comment regarding scope: CAE’s need to communicate what is not being audited or cannot be audited. Audit Committees need clarity on this point. In the CBOK Stakeholder Study, 21% of respondents indicate that internal audit does not communicate which of the organization’s risks or activities are not covered by the internal audit plan. Join Us: @IIAChicago ● #IIAChi ©Institute of Internal Auditors 2017

Coordinate with the Second Line of Defense Stakeholders expect internal audit to work closely with the second lines of defense 1 Internal audit is expected to communicate extensively with these functions and coordinate where possible 2 Coordinate as much as possible, rely as much as possible but only do so based on evidence the functions in the second line of defense earn that reliance 3 Join Us: @IIAChicago ● #IIAChi ©Institute of Internal Auditors 2017

Coordinate with the Second Line of Defense Action items for CAE’s Understand clearly the work down by functions in the second line of defense Coordinate as much as possible with these functions, working toward common views of risks and compliance where possible Rely on assurance work done by these functions only when the objectivity and rigor of their work has been tested and verified. Join Us: @IIAChicago ● #IIAChi ©Institute of Internal Auditors 2017

Manage Competing Demands The CAE must be effective in balancing competing priorities, a necessary and delicate task Best Strategies to Address Competing Demands Requires planning, corroboration and strong relationships Join Us: @IIAChicago ● #IIAChi ©Institute of Internal Auditors 2017

Manage Competing Demands Action Items for CAE’s Develop strong relationships with stakeholders of all types and levels Do not hesitate to take positions when they are needed Stay grounded in your professional obligations Build excellent interpersonal skills to be ready to use when they are critical Join Us: @IIAChicago ● #IIAChi ©Institute of Internal Auditors 2017

Importance of Relationships and Communications Relationships are critical in understanding the business and keeping up with strategies One critical aspect of relationships is communications Needs to be in person, not just through documents and written messages “To think in a strategic fashion, the head of internal audit must be in constant contact with the business, able to grasp the strategic changes by creating ongoing professional relationships with all key members of the company, not just the CEO.” Stakeholder in Italy Join Us: @IIAChicago ● #IIAChi ©Institute of Internal Auditors 2017

Importance of Relationships and Communications Action Items for CAE’s Perform a self-assessment of your relationships and communications. Be candid with yourself! Solicit input from stakeholders; ask them to identify areas for you to improve Seek out a mentor (internal or external) who is in a senior leadership position Join Us: @IIAChicago ● #IIAChi ©Institute of Internal Auditors 2017

Perform the Work with Excellence Internal Audit Performance Factors This is a problem, only 36% use these as performance factors Join Us: @IIAChicago ● #IIAChi ©Institute of Internal Auditors 2017

Perform the Work with Excellence Value of Conformance with Standards “Conformance to Standards is expected and must occur” CBOK Practitioner Study found that only 54% of respondents indicated that they conform to all Standards This is another real problem Join Us: @IIAChicago ● #IIAChi ©Institute of Internal Auditors 2017

Organizational Culture – Promoting Change CAE’s are in a unique position and in a unique role; that unique role brings opportunities to influence the culture of an organization “Internal audit can definitely have a big impact on the culture of the organization and can make it more process driven, efficiency focused, and risk focused. They can also bring in a lot of transparency as matters highlighted by the internal auditor are dealt with at the highest levels.” - Chief Financial Officer, India Stakeholders see internal audit as a valuable change agent 85% of respondents stated that internal audit brings value in this role Join Us: @IIAChicago ● #IIAChi ©Institute of Internal Auditors 2017

Conclusion Go to The IIA’s CBOK Resource Center for more information 1 Use this to identify and focus on at least one major area for improvement 2 Join Us: @IIAChicago ● #IIAChi ©Institute of Internal Auditors 2017

Thank You! Join Us: @IIAChicago ● #IIAChi ©Institute of Internal Auditors 2017