2. WWW. THEIIA. ORG / CAE

3. TRENDS

4. WWW. THEIIA. ORG / CAE

6. BudgetStaffing Remain the Same 55%71% Increase35%25% Decrease8%3% Unsure2%1% Internal Audit Budget & Staffing Projections

7. WWW. THEIIA. ORG / CAE Moving Out of the Comfort Zone

8. WWW. THEIIA. ORG / CAE 55% 71% 52% 58%

9. WWW. THEIIA. ORG / CAE Are We Too Comfortable?

10. WWW. THEIIA. ORG / CAE Culture

11. WWW. THEIIA. ORG / CAE Lack of Support Can Be a Hurdle

12. WWW. THEIIA. ORG / CAE Support Makes a Difference

13. WWW. THEIIA. ORG / CAE What About Reporting Lines? Report Administratively to the CEO Report Administratively to the CFO

14. WWW. THEIIA. ORG / CAE Is Internal Audit Equipped?

15. WWW. THEIIA. ORG / CAE Addressing a Toxic Culture

16. WWW. THEIIA. ORG / CAE Culture Develop an approach to assess the critical elements Gather objective and subjective information about the organization’s culture o use professional judgment to evaluate information that cannot be easily measured Build and use relationships

17. WWW. THEIIA. ORG / CAE Use of Data

18. WWW. THEIIA. ORG / CAE Use of Data – Some Risks Ethical or barely legal? Responsive or convenient? Complete or available? Causation or correlation? Comprehensive or cherry-picked?

19. WWW. THEIIA. ORG / CAE Internal Audit Involvement in Evaluating Data Quality Very or Extreme ModerateSlight or Not at All

20. WWW. THEIIA. ORG / CAE Confidence in Strategic Decisions Made Using Data Slight or Not at All Moderate Very or Extreme

21. WWW. THEIIA. ORG / CAE Use of Data Know what is collected, how it is analyzed, and which decisions it supports Assess the risks Consider these risks in audit planning Make sure you have requisite skills

22. WWW. THEIIA. ORG / CAE From Cybersecurity to Cyber Resiliency

23. WWW. THEIIA. ORG / CAE Addressing Cyberattacks – What is Effective?

24. WWW. THEIIA. ORG / CAE Cybersecurity Cyber Resiliency

25. WWW. THEIIA. ORG / CAE Addressing Cyberattacks in Business Continuity Plans Provide general procedures in response Provide clear, specific procedures in response Do not specify procedures in response

26. WWW. THEIIA. ORG / CAE Internal Audit Effort Falls Short of Ideal

27. WWW. THEIIA. ORG / CAE Why We Fall Short

28. WWW. THEIIA. ORG / CAE Cyber Resiliency Understand cybersecurity risk Consider all aspects of cyber resiliency in your organization: protection, monitoring, response and recovery Ensure internal audit has the skills to be engaged in these areas Discuss cyber resiliency preparedness with management and the audit committee

29. WWW. THEIIA. ORG / CAE Valuing Interpersonal Skills

30. WWW. THEIIA. ORG / CAE Interpersonal Skills are Critical

31. WWW. THEIIA. ORG / CAE How Do We Ensure Internal Audit Has the Requisite Skills?

32. WWW. THEIIA. ORG / CAE What Kind of Training?

33. WWW. THEIIA. ORG / CAE How Effective is Our Training?

34. WWW. THEIIA. ORG / CAE The Result  Mediocrity

35. WWW. THEIIA. ORG / CAE Is Something Askew? Rely on Training On-the-Job & Mentoring Training is Pretty Effective Less Than Half of Staff are Very Proficient

36. WWW. THEIIA. ORG / CAE Interpersonal Skills Recruit for needed soft skills – don’t assume that accountants, engineers or IT professionals can easily learn these. Take a more disciplined/formal approach to training/mentoring. Consider branching out from informal training methods and seek new options for improving the effectiveness of training. Evaluate current job description and job postings to ensure they reflect the skills you truly need. Invest in yourself and your team

37. WWW. THEIIA. ORG / CAE Parting Thoughts Source: CBOK Stakeholder Report: Relationships and Risk, Insights from Stakeholders in North America

38. WWW. THEIIA. ORG / CAE Questions