Internal Audit Role in Order to Develop an Ethical Corporate Culture as a Competitiveness Factor A.I.I.A. - Internal Auditing body Università degli Studi di Milano DIPARTIMENTO DI STUDI SOCIALI E POLITICI ISTITUTO DI FILOSOFIA E SOCIOLOGIA DEL DIRITTO Centro per la ricerca e la formazione in politica ed etica POLITEIA Fourth Annual Forum on Business Ethics and Corporate Social Responsibility in a Global Economy Milan, 13th September 2007 Roberto Villa Chief Audit Executive - Edipower S.p.A.

Agenda Internal Audit: Role and Definition Internal Control The components of Internal Control System Code of Ethics (IIA) International Standards for the Professional Practice of IA Internal Audit and Ethics Findings R. Villa2

Internal Audit: Role and Definition “Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization's operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.” (source: The Institute of Internal Auditors, ) R. Villa3

Internal Control “Internal control is a process, effected by an entity's board of directors, management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: Effectiveness and efficiency of operations. Reliability of financial reporting. Compliance with applicable laws and regulations”. ( source : COSO, The Committee of Sponsoring Organizations of the Treadway Commission) R. Villa4

The five components of Internal Control System Internal control consists of five interrelated components: A.Control environment B.Risk Assessment C.Control Activities D.Information and Communication E.Monitoring ( source : COSO, The Committee of Sponsoring Organizations of the Treadway Commission) R. Villa5

Code of Ethics (IIA) The purpose of The Institute's Code of Ethics is to promote an ethical culture in the profession of internal auditing. Internal Auditors shall perform their work with: Integrity : The integrity of internal auditors establishes trust and thus provides the basis for reliance on their judgment. Internal Auditors : – Shall perform their work with honesty, diligence, and responsibility. – Shall observe the law and make disclosures expected by the law and the profession. – Shall not knowingly be a party to any illegal activity, or engage in acts that are discreditable to the profession of internal auditing or to the organization. – Shall respect and contribute to the legitimate and ethical objectives of the organization. Objectivity Confidentiality Competency R. Villa6

International Standards for the Professional Practice of I.A – Governance: “The internal audit activity should assess and make appropriate recommendations for improving the governance process in its accomplishment of the following objectives: Promoting appropriate ethics and values within the organization. Ensuring effective organizational performance management and accountability. Effectively communicating risk and control information to appropriate areas of the organization. Effectively coordinating the activities of and communicating information among the board, external and internal auditors and management” A1 – “The internal audit activity should evaluate the design, implementation, and effectiveness of the organization's ethics- related objectives, programs and activities”. R. Villa7

Internal Audit and Ethics All people associated with the organization share some responsibility for the state of its ethical culture. Internal auditors and the internal audit activity should take an active role in support of the organization’s ethical culture. They possess a high level of trust and integrity within the organization and the skills to be effective advocates of ethical conduct. They have the competence and capacity to appeal to the enterprise’s leaders, managers, and other employees to comply with the legal, ethical, and social responsibilities of the organization. The internal audit activity may assume one of several different roles as an ethics advocate. These roles include Chief Ethics Officer (ombudsman, compliance officer, management ethics counselor, or ethics expert), member of an internal ethics council, or assessor of the organization’s ethical climate. At a minimum, the internal audit activity should periodically assess the state of the ethical climate of the organization and the effectiveness of its strategies, tactics, communications, and other processes in achieving the desired level of legal and ethical compliance. R. Villa8

Internal Audit and Ethics The main elements in order to assure the best possible result, are: Organizational positioning of IA in order to guarantee maximum possible independence. IA shall operate according to its code of ethics and International Standards for the Professional Practice. Active involvement and example given by the top management. Still, if the problems: Are related to the system or the market, IA cannot do...miracles! Involve the top management, IA shall report to the organs of Corporate Governance R. Villa9

Findings R. Villa10 Ethics is a strategic asset, as inestimable as it is intangible. Ethics is a pillar of corporate reputation, which is surely one of the most important critical resources for the competitiveness and the success of any entrepreneurial shape. The role of the Internal Audit and the contribution that it can provide is therefore extremely important, and is above all focused on prevention. The benefit of Internal Audit role goes beyond the borders of the company for which it works.