1. 1 Internal Audit Support of Audit Committees – What Works Best The Institute of Internal Auditors Webcast Series on Sarbanes-Oxley Session #5 – September 9, 2003

2. 2 The IIA Webcast Moderator Jim Key, CIA Managing Partner Shenandoah Group, L.L.P

3. 3 Disclaimer The views expressed in this webcast are solely those of the panelists and moderators and do not necessarily reflect the views or policies of The Institute of Internal Auditors or its directors, officers, employees, and members.

4. 4 Series 2: Emerging Trends and Best Practices in Implementing SOA May 21 - Section 404 Readiness Review: How to document your system of internal control. (Archived) June 10 - Helping your audit committee implement complaint handling. (Archived) July 8 - Leveraging the COSO framework to meet Section 404 requirements (Archived) August 12 - Project Administration – Setting and revising priorities in the wake of the “Final 404 Rules” (Archived) September 9 - Internal Audit support of Audit Committees – What works best September 30 - The Road Ahead – Meeting the challenges in complying with The Sarbanes-Oxley Act

5. 5 Webcast Series on SOA Fostering Compliance with SOA: Internal Auditor’s Role Four sessions archived on IIA’s website and available on CD Originally aired January 28 – April 15, 2003

6. 6 Agenda 1:00 Introductions and Overview 1:10 Managing the Auditors – Janice Wilkins 1:20 Managing the Audit Committee Schedule - Norman Marks 1:30 Educating the Audit Committee – Jerry Ferenczy 1:40 Break 1:45 Questions and Answers - Panel 2:25 Wrap up - Jim Key

7. 7 Managing the Auditors - How Internal Audit Supports the Audit Committee Janice Wilkins Vice President Director, Internal Audit Intel Corporation

8. 8 Supporting the Audit Committee Board of Directors Audit Committee Compliance with Applicable Laws & Regs Internal Audit External Audit Management Reliability of Financial ReportingEffectiveness & Efficiency of Operations Oversight of Financial Reporting Process & Internal Control Competency Assessment Services & Fees Audits & Reporting AC Operations Regulatory Compliance

9. 9 Competency Assessment Independence and objectivity Client and industry knowledge GAAP and GAAS expertise Proactive communications/responsiveness Domestic and international staff quality Internal quality control Litigation Negative press

10. 10 Services and Fees Regulatory compliance verification Non-financial audit pre-approvals Audit scope review EA budget coordination and reporting IA budget and staffing reviews Benchmarking EA contract re-bid EA partner rotations EA engagement team employment

11. 11 Audits and Reporting Enterprise, business unit and financial reporting risk assessments Controls evaluation and opinion EA and IA audit coordination Management Letter Comments coordination Focus topic discussions Anonymous reporting administration Fraud investigations

12. 12 Audit Committee Operations AC charter development and review Meeting agenda setting Facilitate pre-earnings calls Meeting minutes review Annual planner Annual AC self-assessment Financial expert & independence assessments D&O questionnaires review Annual EA and IA assessments

13. 13 Regulatory Compliance Regulatory and emerging issues updates Ethics and compliance oversight and evaluation

14. 14 Agenda 1:00 Introductions and Overview 1:10 Managing the Auditors – Janice Wilkins 1:20 Managing the Audit Committee Schedule - Norman Marks 1:30 Educating the Audit Committee – Jerry Ferenczy 1:40 Break 1:45 Questions and Answers - Panel 2:25 Wrap up - Jim Key

15. 15 Managing the Audit Committee Schedule Norman Marks Vice President, Internal Audit Solectron Corporation

16. 16 Outline Demands on the Audit Committee’s time Demands on management’s time The role of the CAE Tips and techniques Conclusions

17. 17 Demands on the A/C time Expectations  = Detail  Per Korn-Ferry, A/C time doubled Sarbanes-Oxley, SEC, Listing Standards Courts expect best practices Greater liability (?)

18. 18 Demands on the A/C time Oversight of: –Financial Reporting –EA and IA (Internal Controls) –Whistleblower Process –Ethics Program –Risk Management Member training

19. 19 Demands on Management Preparation before & presentations at every meeting Actions after/between meetings Board focus on governance vs. management

20. 20 The Role of the CAE Advisor to Audit Committee Advisor to Management Help identify “Best Practices” Often manage Audit Committee agenda Often prepare Audit Committee materials

21. 21 Tips and Techniques Delete unnecessary charter tasks Audit Committee checklist from charter Lay out agendas for full year Pre-reading materials and expectations Reviews, etc. through e-mail Information between meetings

22. 22 Delete Tasks Are all Committee activities necessary? Eliminate historic tasks Focus on governance vs. management Prioritize activities

23. 23 Committee Checklist Charter Step Review and reassess the adequacy of [the Committee’s] charter at least annually. X Review the Company’s annual audited financial statements [i.e., those included on Form 10-K] prior to filing or distribution. Review should include discussion with management and independent auditors of significant issues regarding accounting principles, estimates, practices, and judgments. X MarchJanuary

24. 24 Lay out year Meetings with a theme (e.g., year-end) Move meetings to avoid calls (e.g., to coincide with 10-Q review) Long meetings once a year (e.g., for training)

25. 25 Pre-reading materials Provide hard and soft copy well in advance Members expected to read before meeting Questions to CAE, etc. by e-mail before meeting

26. 26 Reviews prior to meeting Draft 10-Q, proxy, etc. sent to members early Questions posed and answered via e- mail At meeting, limit to confirmation that questions answered

27. 27 Between meetings Don’t wait to share important information and handle through e-mail (e.g., audit reports) Stay in touch and talk to members

28. 28 Conclusions The Audit Committee’s load considerably increased Members do not want to limit their activities and spend double the time They, management, and CAE can make meetings efficient with discipline and imagination

29. 29 Agenda 1:00 Introductions and Overview 1:10 Managing the Auditors – Janice Wilkins 1:20 Managing the Audit Committee Schedule - Norman Marks 1:30 Educating the Audit Committee – Jerry Ferenczy 1:40 Break 1:45 Questions and Answers - Panel 2:25 Wrap up - Jim Key

30. 30 Educating the Audit Committee Jerry Ferenczy, CPA, CISA, CPCU

31. 31 Audit Committees – the Past Met 3.3 times a year for less than 1 hour 1/3 did not regularly meet with IAD; 10% never met with them Had no required pre-existing skill sets; most committee members had no formal training or education plan

32. 32 Audit Committees – the Present Meet average of 6 times a year; some as many as 16 Are required to review IAD and risk management; must perform self evaluations Must have some degree of financial literacy

33. 33 The Effect Boards must look at more stuff in more detail than ever before Boards typically have two different types of members Each type has different perspectives and needs CAE must be prepared for both types

34. 34 Suggestion # 1 Know Your Committee Members “WHERE WE’VE BEEN HAS A LOT TO DO WITH WHERE WE ARE GOING.”

35. 35 Suggestion # 2 Know What’s Important “ These facts, if true, suggest that the directors consciously and intentionally disregarded their responsibilities... They simply did not care if they were making a material decision with adequate information.” - the Disney decision

36. 36 Suggestion #3 Share What You Know "You got to be careful if you don't know where you're going, because you might not get there." –Yogi Berra

37. 37 Conclusion “ Those who fail to learn from the past are doomed to repeat it.”

38. 38 Webcast Summary Internal Audit must support the Audit Committee in its new role as manager of the external auditors Assisting the Audit Committee in managing its schedule is now critical with impact of Sarbanes Oxley Educating the Audit Committee to serve its broadened role is essential

39. 39 Thank you for your participation! Don’t miss our next Webcast series beginning September 30, 2003