Internal Auditing 2012: Trends and Outlook for the Global Profession Richard Chambers, President and CEO CIA, CCSA, CGAP, CRMA The Institute of Internal Auditors

Presentation Agenda Five Key Challenges Facing Internal Auditors in 2012 –Identify and align with stakeholder expectations –Step up to the plate in risk management –Become more efficient with limited resources –Strive to demonstrate quality –Enhance our ability to provide insight The Path Forward – Whats Next for Internal Audit?

Identify and Align With Stakeholder Expectations

Stakeholder Value Expectations BoardAssurance and no surprises / eyes and ears ExecutiveAssurance, value for money / management tool Line Management Help, controls assurance, recommendations / management control Internal Audit Staff Career, development, exposure, making a difference / WIFM External AuditCombined assurance, information sharing / substantive testing RegulatorsObjective opinion, peace of mind / investigators CommunitySocial responsibility, protecting the economy ShareholdersValue protection, whistleblowers The New Order Is Creating New Expectations for Internal Auditing

Meeting Stakeholder Expectations: Are we Being Honest With Ourselves? Audit Committee Executive Management Unacceptable0.0%0.4% Poor0.4%1.9% Acceptable16.1%25.9% Good57.6%57.8% Outstanding25.9%14.0% If surveyed today on how well internal auditing is meeting its needs and expectations, my audit committee/executive management would probably rate their overall satisfaction… Source: Emerging Trends and Leading Practices Spring 2011, The Institute of Internal Auditors – Audit Executive Network

Source: Ernst and Young Global Internal Audit Stakeholder Survey, November % of stakeholders believe IA needs improvement 96% within the next 24 months Only 44% believe IA helps achieve business objectives Only 37% involve IA in key business decisions and strategy Only 32% believe IA attracts future leaders and high potential talent from within the business The View from the Other Side:

Ascending to the Level of A Trusted Advisor Relationships Compliance function Engaged but not strategic Trusted advisor

Step Up to the Plate in Risk management

Risk Management Risk management failures were key factors in the financial crisis Growing pressure on management to strengthen risk management Growing pressure on boards to demonstrate RM oversight Internal auditing should play a critical role: –Natural experts on risk management –Champion or facilitate ERM –Maintain a continuous focus on risks –Be capable of addressing the full portfolio of risks in audit coverage –Provide assurance on the effectiveness of risk management

Internal Auditings Role in Risk Management

Focusing on the Real Risks Strategic & Business 60% Operational 20% Financial 15%Compliance 5% Key Imperatives for the Coming Decade: Fully Embrace a Risk-Centric Strategy

Become More Efficient With Limited resources

Enhance Capacity Through Innovation Sourcing solutions that are: –Strategic –Innovative –Efficient Reengineer processes –Risk assessment –Engagement planning –Reporting Leverage technology

Strive to Demonstrate Quality

A Comprehensive Quality Assurance and Improvement Program Commitment to quality that extends beyond conformance to IIA standards Formal quality assurance and improvement program including: –Continuous quality controls –Periodic formal internal assessments –Periodic external assessments that include extensive benchmarking /insight on how internal audit compares with peers Generally includes dedicated resources to manage the professional practices/quality assurance

No universal enforcement mechanisms for IIA Standards –30% still do not have a formal quality assurance and improvement program –Up to 60% still have not undergone an external quality assessment Compliance with Professional Standards

More than 70% percent believe compliance with the Standards is a key factor in the ability IA to add value to the governance process ……90% of stakeholders indicate that adherence to the Standards increases their confidence in internal audit Compliance with Professional Standards Sources: 2010 Global Internal Audit Survey and 2010 Stakeholder Expectations Survey, The Institute of Internal Auditors

Enhance our Ability to provide Insight

Value Proposition for Key Stakeholders Internal Auditing: Assurance Insight Objectivity Governing bodies and senior management rely on Internal Auditing for objective assurance and insight on the effectiveness and efficiency of governance, risk management and internal control processes.

Insight = Catalyst, Analyses and Assessments Internal audit is a catalyst for improving an organizations effectiveness and efficiency by providing insight and recommendations based on analyses and assessments of data and business processes. Insight is an end product or result from internal audits assurance and consulting work. Insight can involve connecting the dots to deliver value-added results to key internal audit stakeholders. Providing insight may require many IA activities to improve their overall capability, staff competencies, and audit process/practices. Insight Defined

Research Results Should Deliver In General, IA Delivers My IA Delivers Frequently Delivers SA/A A/F Internal Audit 90%72%81%66% Board 86%77%79%61% Executives 89%57%56%38% Overall Result 89%71%76%60% SA/A – Strongly Agree/AgreeA/F – Always/Frequently Survey also provided potential examples of insight delivery to illustrate the concept, and asked CAEs and the stakeholders to evaluate if internal audit should deliver, and if internal audit actually did deliver, with what frequency…

Closing the Gap Key Enabling Factors Strong control environment and tone at the top in the organization 62% Board and management expectations for value delivery from the internal audit function 59% CAE reporting relationship that supports independence of the internal audit function 55% Highly competent CAE50% Internal audit personnel with significant industry and organizational knowledge 46%

Successful Strategies for CAEs Assess stakeholder expectations and, if needed, agree on reasonable timeline and approach to closing the gap Consider reporting relationships and sufficient organizational independence Align internal audit mission and focus with agreed expectations Refocus internal audit approach to agree with mission Critically assess leadership skills and communication styles of the CAE and staff

The Path Forward: Whats Next For Internal Audit

1.Sharpen Your Focus on Risk Management and Governance 6.View Compliance with The IIAs International Standards as Mandatory, Not Optional 2.Conduct a More Responsive and Flexible Risk-based Audit Plan 7.Acquire and Develop Top Talent 3.Develop a Strategic Vision for Internal Auditing 8.Enhance Training for Internal Audit Activities 4.Focus, Monitor, and Report on Internal Auditings Value 9.Take Advantage of Expanding Service Provider Membership 5.Strengthen Audit Committee Communications and Relationships 10.Step up Your Use of Audit Technology and Tools CBOK 2010: Imperatives for Change

Rank Currently Performed Next Five Years 1Operational auditsCorporate governance reviews 2Compliance auditsERM reviews 3Auditing of financial risksStrategic reviews 4Fraud investigationsEthics audits 5Evaluation for internal control Migration to IFRS/Social and Sustainability audits The CBOK Study: Top Five Internal Audit Activities

Questions?

The Institute of Internal Auditors Richard Chambers, CIA, CGAP, CCSA, CRMA President & Chief Executive Officer