1. AUDITING FOR IMPACT – INTERNAL AUDIT ADDING VALUE TO ORGANISATIONS TGM HOOLEY 29 September 2005

2. INTERNAL AUDIT Internal auditing is an independent, objective, assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve effectiveness of risk management, control, and governance processes. Internal auditing is an independent, objective, assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve effectiveness of risk management, control, and governance processes. The Institute of Internal Auditors Guidance Task Force

3. DELIVERY In House In House Outsource Outsource Partial Outsource Partial Outsource

4. FEATURES Independence Independence Objectivity Objectivity Consulting Consulting

5. APPROACH Risk Assessment Risk Assessment BusinessBusiness ControlsControls Testing Plan Testing Plan Other Duties Other Duties Loss Control / InvestigationLoss Control / Investigation SecretarialSecretarial

6. ADD VALUE Delivery that features: Delivery that features: Quality Quality Timely Timely Cost Effective Cost Effective

7. DELIVERY IMPROVEMENT AREAS Methodology / Approach Not kept up with or understand business changes Not kept up with or understand business changes Not always risk based Not always risk based Scope limitation by management Scope limitation by management Narrow objectives / superficial / lack of focus Narrow objectives / superficial / lack of focus Compliance auditors Compliance auditors Used for non – internal audit purposes such as loss control Used for non – internal audit purposes such as loss control No focus on corporate governance No focus on corporate governance Not time focused Not time focused Value for money not emphasised Value for money not emphasised

8. DELIVERY IMPROVEMENT AREAS Knowledge / Communication Passive / Not prepared to speak out Passive / Not prepared to speak out Conflict avoidance Conflict avoidance Not reporting to right level Not reporting to right level Low quality of reporting Low quality of reporting Lack of interaction with audit committee Chairman Lack of interaction with audit committee Chairman

9. DELIVERY IMPROVEMENT AREAS People / Skills Personnel low level / ‘deemed failures’ Personnel low level / ‘deemed failures’ Lacking skills Lacking skills AnalyticalAnalytical General accounting / businessGeneral accounting / business ITIT Not part of management development Not part of management development

10. DELIVERY IMPROVEMENT AREAS Other Other Dependency on employers / part of management team Dependency on employers / part of management team Good Internal Audit Charters but…… Good Internal Audit Charters but……

11. ADDING VALUE TO Management Management Non Executive Directors Non Executive Directors Minority Shareholders Minority Shareholders Third Parties Third Parties External Auditors External Auditors

12. TECHNOLOGY/ KNOWLEDGE METHODOLOGY MISSION ELEMENTSTRADITIONALINNOVATIVE World-Class Audit Function  Right Direction  Right People  Right Tools PEOPLE STAKEHOLDER NEEDS Departmental Mission StatementCo-Developed Relationship RISK ANALYSIS Financial RiskBusiness and Financial Risk PROCESS ANALYSIS Transaction-BasedBusiness Process Based TOOLS Personal ProductivityKnowledge Management DATA ANALYSIS Data RetrievalContinuous Intelligence REPORTING Findings and RecommendationsBusiness Insight ANALYTICS Financial RatiosKey Performance Indicators COMPLIANCE Test-BasedControl Self Assessment IT CAPABILITIES Stand-Alone IT AuditsIntegrated IT Audit Approach RISK MANAGEMENT Reactionary Risk AnalysisComprehensive Framework SKILLS AuditorBusiness Advisor ACQUIRE Campus RecruitsExperienced Hires DEVELOP Internal Audit Career PathRotational/Prerequisite for Leadership DEPLOY Reactive Task ManagementVirtual Project Teaming MANAGE Input-Oriented (Hours)Results-Oriented (Value) EXPERTISE Audit GeneralistSubject Matter Expert ACQUIRE Data, InformationSynthesized Information and Experience SHARE Event-DrivenContinuous COMMUNICATE Remote Access (Give)Virtual (Share) TECHNOLOGY Independent ToolsInteractive Knowledge Sharing Characteristics of a World-Class Internal Audit Function

13. Final Thoughts “Quality in a service or product is not what you put into it, but what the customer gets out of it.” “Quality in a service or product is not what you put into it, but what the customer gets out of it.” Peter Drucker