Available free of charge: Delivering on the Promise: Measuring Internal Audit Value and Performance Jane Seago The IIARF encourages those who are presenting this slideshow to download the full report from The IIA Research Foundation and make it available to their audience. Available free of charge: www.theiia.org/goto/CBOK

CBOK 2015 Practitioner Study CBOK is the Global Internal Audit Common Body of Knowledge: The global practitioner survey is the largest ongoing study of internal audit professionals in the world. More than 25 free reports about practitioners and the profession will be released beginning July 2015. Download free reports from the CBOK Resource Exchange at The IIA website at any time (www.theiia.org/goto/CBOK).

CBOK 2015 Practitioner Survey Practitioner Survey Results Survey completed April 1, 2015 14,518 usable survey responses Participation Levels 100% representation from IIA institutes Responses from 166 countries 23 languages

CBOK 2015 Practitioner Study Global Regions are based on World Bank Categories. Percentages are the percentage of total survey responses from that region compared to all survey responses. North America: 19% Latin America & Caribbean: 14% Middle East & North Africa: 8% Sub-Saharan Africa: 6% Europe & Central Asia: 23% South Asia: 5% East Asia & Pacific: 25%

CBOK 2015 Practitioner Study The speaker does not necessarily need to say this, but it’s important to remember that each pie chart is based only on those who answered that particular question (in other words, not all 14,518 survey respondents provided an answer to every question.) Below are the specific number of responses for each question shown on the slide. Age was obtained from 12,780 respondents; Organization Type was obtained from 13,032 respondents; Gender was obtained from 14,357 respondents; Staff Level was obtained from 12,716 respondents. Age was obtained from 12,780 respondents; Organization Type was obtained from 13,032 respondents; Gender was obtained from 14,357 respondents; Staff Level was obtained from 12,716 respondents.

Delivering on the Promise Looks at the value proposition for internal audit from the perspective of the internal auditor and the organization. Focuses on: The activities internal auditors undertake that they believe provide most value. The measures the organization uses to evaluate internal audit performance. The methodologies and tools internal auditors use to gather and organize the information that supports their quality and performance processes. High-level summary of the purpose of the book Most important question: Are there disconnects among the three items of focus?

Value Proposition for Internal Auditing In 2010, The IIA recognized a need to capture a simple, memorable, and straightforward way to help internal auditors convey their value to stakeholders. The Value Proposition for Internal Auditing characterizes internal audit’s value as a blend of three elements: assurance, insight, and objectivity. The key is understanding what these concepts look like in the workplace.

Value-Adding Activities CBOK asked: What activities does internal audit undertake that deliver the most value?   CAEs (all respondents were CAEs) responses: The activities they believe bring value to the organization are consistent with the three elements of the value proposition. The top nine activities identified by the CAEs as being most value-adding can be mapped directly to the three elements.

A Closer Look at Value-Adding Activities The survey listed 14 distinct internal audit activities; CAEs were invited to select up to five they believe bring the most value to their organization. Nine of those 14 are used by at least one-quarter of the respondents. (Note: Value drivers can vary from one organization to the next for many reasons: industry sector, organization type, management preferences, geographic region, and regulatory requirements, to name a few.) “Assuring the adequacy and effectiveness of the internal control system” is the most commonly selected activity by a wide margin, more than 30 percentage points higher than the second most often indicated option. More than one-third of the CAEs selected “identifying emerging risks,” which aligns with the current focus on risk-based auditing.

Organizational Measures of Internal Audit Nine response options, select all that apply. All three of the top measures are heavily weighted toward internal audit’s assurance activities.   Difference between inward-facing and outward-facing measures. Inward-facing measures = how work is done internally, incline toward administrative efficiency. Outward-facing measures = customer, effectiveness. The top three metrics focus on completion of tasks, thus inward-facing — focusing more on internal audit’s “to-do list” and less on the perception of those activities by others. Outward-facing measures also have support: client satisfaction goals selected by 38%, 32% chose “the fulfillment of specific expectations set and agreed to with key stakeholders.” This means that many CAEs are connecting their value with their stakeholder needs. A cause for concern: 15% say no formal measures of value have been established. Especially surprising since respondents are all CAEs. They may wish to consider the ramifications of the absence of measures: possible non-conformity with the Standards and they risk not knowing how the organization perceives the quality of their efforts.

Methodologies and Tools Used by Internal Audit Top choices: “surveys of audit clients” and “internal quality assessments initiated by internal audit,” chosen by about half of those surveyed. The selection of “surveys of audit clients,” by half of the respondents represents a significant and positive trend from previous CBOK (2010) – when only 9% indicated that they used customer surveys to gather information about how internal audit activities were perceived.     Another considerable change from 2010 is use of the balanced scorecard (BSC), increasing from 4% (in 2010) to 26%. Aligns with the expectations of the 2010 respondents, who selected balanced scorecard as the approach they most anticipated would have greater usage “five years from now.” The use of a BSC in support of internal audit’s quality and value efforts is on the rise and this increased focus may help support internal audit’s efforts to be responsive to key stakeholder needs – due to BSC’s recognition that an organization’s success hinges on more than financial outcomes, but also includes customer, internal business processes, and learning and growth perspectives. For BSC to be successful in an internal audit environment, must link internal audit strategy to enterprise strategy, then translate the strategy of the internal audit function into appropriate BSC performance measures. Inward focus noted earlier relative to measures. Here, the sources of feedback with the least amount of use were external facing (peer review, external assessments, reviews from external regulators, and reviews from the organization’s quality assurance function).

Imperfect Alignment Between Measures and Value Per respondents, value-adding activities focus on providing assurance, offering insights and advice, and helping the organization assess its risk and risk management practices.

Improving Alignment Learn the customer’s expectations. Validate your understanding. Develop outward-facing and inward-facing performance measures. Start measuring. Report back. Repeat the cycle. Successful application of these steps requires use of one of the most important skills internal auditors must possess: communication. Listening to stakeholders and reporting back.

In Summary Operational expertise (e.g., completing audits on time and closing audit issues on schedule) is valuable and therefore thoroughly measured. Other activities (e.g., advising and recommending) are also acknowledged as among internal audit’s contribution to the organization, but they are not measured as directly and effectively by the organization. Methodologies used by internal audit to organize and confer meaning and context to performance information are not as robust and holistic as they might be.   Re final bullet – move to BSC may address this.

CBOK 2015 Releases Jul. 2015 Aug. 2015 Sept. 2015 Oct. 2015 Nov. 2015 IIA International Conference Governance, Risk, and Control Conference South Africa Conference IIA Financial Services Exchange ECIIA Conference All Star Conference Southern Regional Conference ACIIA Conference IIA Midyear Committee Meetings Jul. 2015 Aug. 2015 Sept. 2015 Oct. 2015 Nov. 2015 Dec. 2015 Driving Success in a Changing World: 10 Imperatives for Internal Audit Navigating Technology’s Top 10 Risks: Internal Audit’s Role Staying a Step Ahead: Internal Audit’s Use of Technology A Global View of Financial Services Audits: Challenges, Opportunities, and the Future Who Owns Risk? A Look at Internal Audit’s Changing Role Combined Assurance: One Language, One Voice, One View Responding to Fraud: Exploring Where Internal Auditing Stands Auditing the Public Sector: Managing Expectations, Delivering Results Delivering on the Promise: Measuring Internal Audit Value and Performance Mapping Your Career: Competencies Necessary for Internal Audit Excellence Please share information about the publication of upcoming CBOK reports and where to go for the free download.

CBOK 2016 Releases GAM Conference Leadership Conference SoPac Conference Leadership Conference IIA International Conference Additional reports that will be available for a free download..

YOUR DONATION DOLLARS AT WORK FREE thanks to generous contributions from individuals, organizations, IIA chapters, and IIA institutes around the world. Download your FREE copy today at the CBOK Resource Exchange. www.theiia.org/goto/CBOK This report was generously sponsored by: The IIARF encourages those who are presenting this slideshow to download the full report from The IIA Research Foundation and make it available to their audience.

About The IIA Research Foundation CBOK is administered through The IIA Research Foundation (IIARF), which has provided groundbreaking research for the internal audit profession for nearly four decades. Through initiatives that explore current issues, emerging trends, and future needs, The IIARF has been a driving force behind the evolution and advancement of the profession. For more information, visit: www.theiia.org/Research

Copyright and Disclaimer The IIARF publishes this document for information and educational purposes only. IIARF does not provide legal or accounting advice and makes no warranty as to any legal or accounting results through its publication of this document. When legal or accounting issues arise, professional assistance should be sought and retained. Copyright © 2015 by The Institute of Internal Auditors Research Foundation (IIARF). All rights reserved. For permission to reproduce or quote, please contact research@theiia.org.