1. e q Is Your Audit Plan Keeping Pace With Your Business? Duncan Edwards Liam McCaul – Partner, Risk Advisory Services E Q Internal Audit — Adding Value To Your Company

2. e q Objectives  Why do we need to demonstrate the value of internal audit?  What do we mean by ‘value’?  What are the key drivers that deliver internal audit value?  How do we measure value? To consider four questions:

3. e q Why do we need to demonstrate the value of internal audit?  Internal audit now higher up the boardroom agenda.  Commercial pressures to derive the maximum benefit from all resources employed.  Greater corporate governance focus.  The objective to ‘add value’ is now explicit in the IIA’s Standards for the Professional Practice of Internal Auditing.

4. e q Definition of Internal Audit “Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes.” Institute of Internal Auditors UK and Ireland

5. e q What do we mean by ‘value’? “Things only have the value that we give them” Molière “Things only have the value that we give them” Molière

6. e q Stakeholder expectations  Who are your principal stakeholders? - Audit Committee - Executive Management - Line Management - Customers - Regulators (including External Auditors)  How do they value internal audit?  Are you sure that is still what they want? “Since events such as Worldcom and Enron, and the subsequent legislative and regulatory changes, key stakeholders in most organisations, such as the Board and the Audit Committee, have different expectations of their internal audit function.” ‘Finding Your Level – Internal Audit Benchmarking Survey’ (Ernst & Young) “Since events such as Worldcom and Enron, and the subsequent legislative and regulatory changes, key stakeholders in most organisations, such as the Board and the Audit Committee, have different expectations of their internal audit function.” ‘Finding Your Level – Internal Audit Benchmarking Survey’ (Ernst & Young)

7. e q What do we mean by ‘value’? “The most valuable thing an internal audit function can provide is independent assurance on the effectiveness of controls over risk” Simon D’Arcy - President of the Institute of Internal Auditors 2007

8. e q The “Pendulum Effect” Has the Pendulum Swung too Far? FINANCIALOPERATIONALSTRATEGICCOMPLIANCE 1990’s RESOURCE FOCUS 2004+ AssuranceConsultative RISK Approach Management Expectations Regulatory Change Corporate Scandals Internal Audit Drivers Skills Technical/ExecutionInnovative/Collaborative

9. e q ‘The Value Agenda’  IIA Survey of Heads of Internal Audit, CEOs, CFOs and Audit Committee Chairs.  Sought responses on a range of issues related to the value generated by internal audit including: - how and where internal audit adds value? - how value is measured and demonstrated?

10. e q The Value Agenda – Sources of Value 1. Assurance that major business risks are being managed appropriately (72%). 2. Assurance that the internal control framework is operating effectively (68%). 3. Identification of new business risks (41%). 4. Detection and prevention of fraud and irregularities (30%). 5. Improving Business performance by sharing knowledge of best practices (29%). 6. Use of Knowledge and experience to tackle urgent issues (24%). “Which aspect of internal audit’s role is of primary importance in terms of value to the business?”

11. e q What are the key drivers that deliver internal audit value? Defines Delivery of promises Right Direction Purpose Value Strategy Skills and skills development Team / organisation structure Relationship management process Right people Facilitates Customer / business interface Facilitates Customer/business interface & right behaviours Right People Relationship Management process Resource And Skills Development Team/ Organisation structure IA methodologies Knowledge management Support and development Tools and technology Operational management Properly equipped Provides Delivery infrastructure Delivery methodology & execution Quality Assurance Supporting tools & technology Operational & performance management Provides Efficient and effective delivery infrastructure Properly Equipped Knowledge Management Leadership/Change Management Value to stakeholder

12. e q How do we measure value? “Everything that can be counted does not necessarily count; everything that counts cannot necessarily be counted” Albert Einstein “Everything that can be counted does not necessarily count; everything that counts cannot necessarily be counted” Albert Einstein

13. e q How do we measure value? The IIA Survey identified that:  75% of Heads of Audit are not required to formally demonstrate the value they deliver.  Quantitative measures were focused on inputs and process efficiency rather than outputs and value.  Qualitative measures were “woolly, subjective and difficult to pin down.” BADLY!!!

14. e q Demonstrating Value – a personal view  A balanced scorecard process is in place for IA.  The measures and KPIs used to measure performance focus on what is created, not what is input.  A formal monitoring process is in place with the key stakeholders to validate the scorecard and plan for improvements.  IA management and staff believe intrinsically in the value scorecard approach and continually strive to improve performance beyond agreed targets.

15. e q Demonstrating Value – a personal view  Communication – get the message out and make sure the ‘perception of value’ is in your favour.  There is an effective stakeholder and customer feedback process. Leading functions will adopt a combination of post audit survey forms and one to one meetings with key business management/stakeholders.  The value measures, targets and feedback processes used will directly focus upon the agreed roles and responsibilities and, therefore will change as the roles and responsibilities evolve and change.  Leading functions will open themselves up to independent quality assurance process. The Institute of Internal Auditors recommend that this is undertaken at least once every 5 years.

16. e q A Framework for demonstrating value Value Charter Stakeholders Agenda Value measurements Detail agreed means to measure value delivered. Where measures are softer, commitment from your stakeholders to help measure the value delivered is critical Value Attributes Detail the specific attributes that are required to be demonstrated Value scorecard The Scorecard should contain actual examples of how the value attributes were delivered Value Drivers Understand who your key stakeholders are and what they value

17. e q Demonstrating Value – ‘hard measures’ Hard measures of the value delivered by internal audit may include: DescriptionUnit of measure Client satisfaction survey resultsAve. scores Cost savings or incremental revenue attributable to internal audit recommendations €€€ Degree of completion of the internal audit plan% completed Requests for internal audit input into business projectsNo. of requests Best practice opportunities highlighted/recommendedNo. highlighted Business sponsorship of IA recommendations% accepted Time taken to issue final reports Implemention of IA recommendations No of days % Complete

18. e q Adding value to your company Summary  This is now a requirement of our profession – it is not just ‘nice to have’.  Be clear who your stakeholders are and what they value.  Critique your function – has it the “right direction, right people and is it properly equipped” to deliver value.  Reporting should be formal, contain qualitative and quantitative measures and be aligned to your stakeholders’ value drivers. If there was no formal requirement to have an IA function, would your organisation still have one? If there was no formal requirement to have an IA function, would your organisation still have one?

19. e q A final thought… “Strive not to be a success, but rather to be of value” Albert Einstein “Strive not to be a success, but rather to be of value” Albert Einstein

20. e q Is Your Audit Plan Keeping Pace With Your Business? Duncan Edwards Ernst & Young www.ey.com/ie/risk Ernst & Young, Ernst & Young Building, Harcourt Centre, Harcourt Street, Dublin 2. © 2007 Ernst & Young. All Rights Reserved. Ernst & Young is a registered trademark.