1. Top 10 Global Impacts of SOX on Internal Auditing

2. Back to Basics: Risk, Controls, Governance Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization's operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes. Re-engaging Internal Controls Fostering Enterprise Risk Management Facilitating more effective corporate governance

3. Should internal auditing and more specifically, the chief audit executive (CAE), participate in incentive compensation award systems, based on performance of the organization’s bottom line? #10: Incentive Compensation

4. #9: Access to Information Is the CAE positioned within the organizational structure to have access to and involvement in emerging decisions by senior executives; and to have a “seat at the table” when key business strategies are being developed?

5. #8: Reporting Relationships Does the internal audit activity properly report within the organization directly to the audit committee for oversight and to the CEO for organizational interface?

6. #7: Are MD&A Disclosures Accurate? Does the internal audit department perform tests to ensure the accuracy, completeness, and appropriateness of the information contained in the management discussions and analysis (MD&A) portion of the annual report?

7. #6: Quality Assessment International Standards for the Professional Practice of Internal Auditing require an external quality assessment every five years, plus an ongoing quality program to ensure the outputs of the internal audit department are in accordance with expectations.

8. #5: Control Assessment Entity-wide assessment of key controls in business processes that feed the general ledger and hence the overall financial statementsEntity-wide assessment of key controls in business processes that feed the general ledger and hence the overall financial statements Process ownershipProcess ownership Certification of internal control over financial reportingCertification of internal control over financial reporting Linkage to COSO’s Internal Control Framework, including entity-wide control component assessmentLinkage to COSO’s Internal Control Framework, including entity-wide control component assessment

9. #4: Fraud Awareness of potential fraud risks and appropriate responsesAwareness of potential fraud risks and appropriate responses Fraud prevention and detection programFraud prevention and detection program Forensic auditing during financial auditsForensic auditing during financial audits Increased fraud consideration in the internal audit department’s auditsIncreased fraud consideration in the internal audit department’s audits

10. #3: Governance Audit committee changes to charter and scope of workAudit committee changes to charter and scope of work Audit committee financial expertAudit committee financial expert Audit committee member independence and financial competencyAudit committee member independence and financial competency Oversight of fraud, risk, internal auditing, and external auditingOversight of fraud, risk, internal auditing, and external auditing Self-assessmentSelf-assessment

11. EffectiveGovernance

12. #2: Ethics Hotline operationsHotline operations Compliance programsCompliance programs TrainingTraining Culture – encourage disclosuresCulture – encourage disclosures Investigative process coordinationInvestigative process coordination Handling complaints and documentationHandling complaints and documentation Whistleblower protectionWhistleblower protection

13. #1: Risk ERMERM Risk modelRisk model Risk event identificationRisk event identification Risk assessment techniquesRisk assessment techniques –Probability –Impact Risk responseRisk response Risk-based audit approachesRisk-based audit approaches

14. COSO’s ERM-Integrated Framework  Entity objectives: four categories  Strategic  Operations  Reporting  Compliance  ERM considers activities at all levels of the organization  Enterprise-level  Division or subsidiary  Business unit processes Source: COSO Enterprise Risk Management Framework

15. Today’s Top 10 RiskRisk EthicsEthics GovernanceGovernance FraudFraud Control AssessmentControl Assessment QualityQuality Management Discussion & AnalysisManagement Discussion & Analysis Reporting RelationshipsReporting Relationships Access to InformationAccess to Information Incentive CompensationIncentive Compensation

16. For more information Visit www.theiia.orgVisit www.theiia.orgwww.theiia.org Call +1-407-937-1111Call +1-407-937-1111 E-mail custserv@theiia.orgE-mail custserv@theiia.org