1. Contemporary Internal Auditing: a fine balance…
Allen Amyotte, Director, Internal Audit
March 9th, 2017
3:30 pm – 5:00 pm

2. Allen Amyotte, CGA CIA CRMA Internal Audit
Allen Amyotte is the Director, Internal Audit at the University of Calgary, overseeing a team of six.
Allen is a Chartered Professional Accountant and a Certified Internal Auditor and holds a Certification in Risk Management Assessment through the Institute of Internal Auditors in Florida.
The fine balance: keeping a Board perspective while thinking like a VP.

3. Internal Audit Mandate
Internal Audit: Why we exist
Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. 
It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.
What does that mean!!!

4. Internal versus External?
The difference between internal and external audit?
While sharing some methodologies, internal and external audit have different objectives, scope, audiences and accountabilities.

5. Differences: Mandate External Audit Internal Audit Objectives
Add credibility and reliability to financial reports.
If SOx or Bill 198 (MI ), also financial controls
Evaluate and improve the effectiveness of governance, risk management and control processes. 

6. Difference: Scope External Audit Internal Audit Coverage
Financial reports, financial reporting risks.
If SOx or Bill 198 (MI ), also financial controls
All categories of risk, their management, and risk reporting

7. Differences: Audience
External Audit
Internal Audit
Reports to
The Office of the Auditor General (The Public) who is outside the governance structure.
The Audit Committee of the Board of Governors and senior management (VPFS) who are within the governance structure.

8. Internal Audit Reporting
Board of Governors (BOG)
Functional Reporting
BOG Subcommittee:
Audit Committee
Internal Audit
VP Finance & Services
AdministrativeReporting

9. Differences: Accountabilities
External Audit
Internal Audit
Responsibility for improvement
None, however there is a duty to report problems.
Improvement is fundamental to the purpose of internal auditing. But it is done by advising, coaching and facilitating.

10. Risk-based Internal Auditing
For IA, risk is viewed through the lens of:
Financial
Compliance
Fraud
Reputational
Operational

11. For Procurement (Purchasing) at U of C:
Example
For Procurement (Purchasing) at U of C:
Financial: existence/occurrence, rights and obligations, etc.
Compliance: NWPTA Public Sector legislation
Fraud: scenarios, controls
Reputational: “rabbit day” at CSM: U of C objectives
Operational: how long to get something?

12. How Engagements Chosen (risk-based)
Audit Planning
How Engagements Chosen (risk-based)
Annual Planning Process
ERM
Legislative Compliance Process
Fraud Risk Assessment
Annual Audit Plan
Continuous Auditing / Data Analytics
Compliance
Assurance
Follow-up Audits and Facilitations
Advisory and Investigative
Audit Administration and Training

13. How engagements performed
Audit Execution
How engagements performed
Scoping: Audit Engagement Memo
Fieldwork: RACM, Audit Programme
Reporting: Audit Reports
Approach
Collaborative
Agreement on Scope
Agreement on Criteria
Agreement on risks and issues

14. Internal Audit Approaches
Internal Audit Relevance!
“those who show up after the war to bayonet the wounded” OR
“trusted advisor”

15. Auditor Viewpoint Criteria
Think like a VP: for perspective
Line of Sight: to goals, strategies and objectives
Risk Lens: commonly defined risks and tolerances
Expertise: process and governance mindset

16. Auditor Behavioral Criteria
Understand the business and the sector
Develop relationships
Facilitate outcomes
Change versus report: close outstanding issues

17. Questions