1. Voice of the Customer: Stakeholders Messages from the CBOK Global Internal Audit Study
Dick Anderson, De Paul University
Brad Rachmiel, Protiviti
April 3, 2017

2. Objectives of Session 1
Provide insights and observations on key issues related to stakeholders of internal audit identified during the CBOK Stakeholder Study 2
Provide actionable ideas and recommendations for you to consider for both you and your key stakeholders
Identify one topic or item to take back and improve on!
Join ● #IIAChi
©Institute of Internal Auditors 2017

3. Background on CBOK Stakeholders Study
Seek direct feedback from stakeholders on a global basis
Protiviti chosen to execute in partnership with The IIA
Seeking leading, actionable practices and advice
Join ● #IIAChi
©Institute of Internal Auditors 2017

4. Study Demographics Join Us: @IIAChicago ● #IIAChi
STAKEHOLDER STUDY FACTS Survey participants 1,124 Interview participants 100+ IIA institute partners 23 Languages 13 STAKEHOLDER POSITIONS REPRESENTED Board/audit committee chair Board/audit committee member Chief executive officer (CEO) Chief financial officer (CFO) Chief information officer (CIO) Chief risk officer (CRO) Chief compliance officer (CCO) Chief operating officer (COO) Chief legal officer (CLO)
Canada
Netherlands Belgium
United Kingdom
France
Spain
Russia
Poland Germany Italy
United States
Turkey
Japan
Mexico
United Arab Emirates
India
Taiwan
Malaysia Singapore
Brazil
South Africa
Australia
Join ● #IIAChi
©Institute of Internal Auditors 2017

5. Five Reports from the Stakeholder Study
Reports are free on the IIA’s CBOK Resource website
Join ● #IIAChi
©Institute of Internal Auditors 2017

6. Overall Conclusions Join Us: @IIAChicago ● #IIAChi
©Institute of Internal Auditors 2017

7. Stakeholders Give Internal Audit High Marks on Foundational Elements
Agree that internal audit focused on areas and topics that are significant 1
Internal audit keeps up to date with changes in the business 2
Sufficiently communicates audit plans 3
Join ● #IIAChi
©Institute of Internal Auditors 2017

8. Stakeholders Give Internal Audit High Marks on Foundational Elements
“Know your organization’s mission, strategy, objectives and risks. Effectiveness of internal audit continually comes back around to this foundation.”
This overall positive view provides a good foundation for internal auditors to leverage their reputation for quality into other areas in which they can add value
Join ● #IIAChi
©Institute of Internal Auditors 2017

9. Assurance is Highly Valued
Join ● #IIAChi
©Institute of Internal Auditors 2017

10. Assurance is Assumed
Stakeholders expect internal audit to provide assurance – and do it with excellence
Join ● #IIAChi
©Institute of Internal Auditors 2017

11. Stakeholders View Assurance as Essential
Balance your work to reflect this
“Assurance is essential and consulting is nice to have, but should be secondary in priority.”
Board Member, United States
Join ● #IIAChi
©Institute of Internal Auditors 2017

12. Best Practices in Providing Assurance1
Ensure the audit work is aligned to the strategic risks of the organization 2
Avenues to improve the role
Avenues for Internal Audit to Improve Its Role in Responding to Strategic Risks
Join ● #IIAChi
©Institute of Internal Auditors 2017

13. Best Practices in Providing Assurance3
Strategic risks
Incorporate a focus on strategic risks during assurance work
Ensure that the assurance work is closely aligned to the strategic risks of the organization
“Internal auditors need to be able to structure their annual plan to link the corporate strategy to their efforts/accomplishments. It is important to identify weaknesses and link them to the key strategy.”
Compliance Executive , Spain
Join ● #IIAChi
©Institute of Internal Auditors 2017

14. Best Practices in Providing Assurance3
Strategic risks
However, there are differences of opinion of stakeholders about internal audit’s role related to strategic risks
May point to a need to educate stakeholders
Should Internal Audit Have a More Active Role in an Organization’s Strategic Risks?
Join ● #IIAChi
©Institute of Internal Auditors 2017

15. Moving Beyond Assurance
Join ● #IIAChi
©Institute of Internal Auditors 2017

16. Building on Assurance
Stakeholders want internal audit to provide advisory work where it does not interfere with their assurance work
Join ● #IIAChi
©Institute of Internal Auditors 2017

17. Areas to Address Beyond Assurance
Areas for Internal Audit to Address Beyond Assurance
Join ● #IIAChi
©Institute of Internal Auditors 2017

18. Level of Advisory Work Varies
Maturity of the organization and its location 01
Competence of the internal audit function 02
Stakeholders do not see this as an either/or situation 03
Some stakeholders concerned that being overly focused on advisory work will detract from assurance work 04
Join ● #IIAChi
©Institute of Internal Auditors 2017

19. The Assurance/Advisory Balance
Pursue advisory or consulting work where you have the
Competency
Capacity
Support from your stakeholders
Join ● #IIAChi
©Institute of Internal Auditors 2017

20. Other Stakeholders Expectations Voiced
Join ● #IIAChi
©Institute of Internal Auditors 2017

21. Align with Expectations
Not all stakeholders see things the same way or want the same value from internal audit
The CAE bears the brunt of the responsibility of addressing this challenge
Develop, socialize, validate a written set of expectations for value
Measure and report on progress with a
balanced scorecard
Join ● #IIAChi
©Institute of Internal Auditors 2017

22. Know Your Business
To be effective, internal audit must view itself as a part of the business of the organization, understanding its industry, strategy and tactics 1
Business acumen is necessary for this more active role 2
Business acumen is not taught in classrooms, but gained through engaging with management and front-line personnel as they run the organization 3
Some stakeholders believe internal auditors should have business experience 4
“ I would expect CAE’s to have hands-on experience in business before taking up the internal audit function.”
- CFO, India
Join ● #IIAChi
©Institute of Internal Auditors 2017

23. Know Your Business Action Items for CAE’s
Identify the essentials to their success of your organization – its industry, the external environment, the chosen strategies and businesses and the risks related to those strategies and businesses
Assess your level of business acumen and , if necessary, develop a plan to spend time and effort with those in your organization who can help you think more like a business leader
Engage your stakeholders as a business leader not a technical auditor
Join ● #IIAChi
©Institute of Internal Auditors 2017

24. Think Beyond Scope
CAE’s need to challenge their teams to “connect the dots” by thinking about the implications of audit findings across the organization
What is the real meaning of these findings? Is there a broader message?
How are we driving value out of our compliance and assurance activities?
As leaders of the organization, what are we missing?
Are there potential crisis events that we have not thought about and for which we are unprepared to respond?
Join ● #IIAChi
©Institute of Internal Auditors 2017

25. Think Beyond Scope
A final comment regarding scope: CAE’s need to communicate what is not being audited or cannot be audited. Audit Committees need clarity on this point.
In the CBOK Stakeholder Study, 21% of respondents indicate that internal audit does not communicate which of the organization’s risks or activities are not covered by the internal audit plan.
Join ● #IIAChi
©Institute of Internal Auditors 2017

26. Coordinate with the Second Line of Defense
Stakeholders expect internal audit to work closely with the second lines of defense 1
Internal audit is expected to communicate extensively with these functions and coordinate where possible 2
Coordinate as much as possible, rely as much as possible but only do so based on evidence the functions in the second line of defense earn that reliance 3
Join ● #IIAChi
©Institute of Internal Auditors 2017

27. Coordinate with the Second Line of Defense
Action items for CAE’s
Understand clearly the work down by functions in the second line of defense
Coordinate as much as possible with these functions, working toward common views of risks and compliance where possible
Rely on assurance work done by these functions only when the objectivity and rigor of their work has been tested and verified.
Join ● #IIAChi
©Institute of Internal Auditors 2017

28. Manage Competing Demands
The CAE must be effective in balancing competing priorities, a necessary and delicate task
Best Strategies to Address Competing Demands
Requires planning, corroboration and strong relationships
Join ● #IIAChi
©Institute of Internal Auditors 2017

29. Manage Competing Demands
Action Items for CAE’s
Develop strong relationships with stakeholders of all types and levels
Do not hesitate to take positions when they are needed
Stay grounded in your professional obligations
Build excellent interpersonal skills to be ready to use when they are critical
Join ● #IIAChi
©Institute of Internal Auditors 2017

30. Importance of Relationships and Communications
Relationships are critical in understanding the business and keeping up with strategies
One critical aspect of relationships is communications
Needs to be in person, not just through documents and written messages
“To think in a strategic fashion, the head of internal audit must be in constant contact with the business, able to grasp the strategic changes by creating ongoing professional relationships with all key members of the company, not just the CEO.” Stakeholder in Italy
Join ● #IIAChi
©Institute of Internal Auditors 2017

31. Importance of Relationships and Communications
Action Items for CAE’s
Perform a self-assessment of your relationships and communications. Be candid with yourself!
Solicit input from stakeholders; ask them to identify areas for you to improve
Seek out a mentor (internal or external) who is in a senior leadership position
Join ● #IIAChi
©Institute of Internal Auditors 2017

32. Perform the Work with Excellence
Internal Audit Performance Factors
This is a problem, only 36% use these as performance factors
Join ● #IIAChi
©Institute of Internal Auditors 2017

33. Perform the Work with Excellence
Value of Conformance with Standards
“Conformance to Standards is expected and must occur”
CBOK Practitioner Study found that only 54% of respondents indicated that they conform to all Standards
This is another real problem
Join ● #IIAChi
©Institute of Internal Auditors 2017

34. Organizational Culture – Promoting Change
CAE’s are in a unique position and in a unique role; that unique role brings opportunities to influence the culture of an organization
“Internal audit can definitely have a big impact on the culture of the organization and can make it more process driven, efficiency focused, and risk focused. They can also bring in a lot of transparency as matters highlighted by the internal auditor are dealt with at the highest levels.”
- Chief Financial Officer, India
Stakeholders see internal audit as a valuable change agent
85% of respondents stated that internal audit brings value in this role
Join ● #IIAChi
©Institute of Internal Auditors 2017

35. Conclusion
Go to The IIA’s CBOK Resource Center for more information 1
Use this to identify and focus on at least one major area for improvement 2
Join ● #IIAChi
©Institute of Internal Auditors 2017

36. Thank You! Join Us: @IIAChicago ● #IIAChi
©Institute of Internal Auditors 2017