Working with Internal Audit
Internal audit is not the same as external audit and operates within defined constraints while aiming for efficient and productive relationships. It collaborates with external audit, yet has distinct responsibilities and must comply with company policies. Misconceptions about internal auditors are debunked to shed light on their crucial functions and adherence to standards.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.
E N D
Presentation Transcript
Working with Internal Audit it can t be that bad, can it? IMA Northeast Regional Council Conference September 2018 Brian Tremblay, CIA, CISA Director, Internal Audit Acacia Communications
What I hope you take away from this That Internal Audit: Is NOT the same as external audit Is a function that (generally) has to play by the same rules as everyone else Faces the same cost/resource constraints as you all do Has a recurrent business cycle it strives to meet both in terms of audits we execute and how we execute them Has a life/family/hobbies outside of work we re people too! And, we re just really, really not that bad With a better understanding of these areas, we can set the stage for a more efficient, productive working relationship Disclaimer 2
Fact or Fiction: All auditors are the same. We all want to waste our auditees valuable time and deliver questionable value at audits end All auditors, their roles, and their functions, are not created equal We share some similar, but also different, stakeholders with External Audit The street/investor bases rely on the work we both do, BUT Internal Audit has significant internal responsibilities that differ from the External Auditors AND External and Internal Audit typically partner together to leverage one another's work should reduce your work if done well We have two bosses (generally, but always if public) And they often times want different things 3
Fact or Fiction: Internal Audit is above the law. We do what we want, when we want to, and lay waste to all who stand in our way. We have to comply with the same policies and procedures everyone else does in fact we should be held to a higher standard since we live in a glass house We sign and are expected to comply with all company policies this is not frequently the case with external audit While independent (via reporting to the board), we are employed by the company, and employees at will If we fail to deliver on our objectives, or our conduct is deemed inappropriate, we risk our employment 4
Fact or Fiction: Internal Audit has all the resources it needs, and whenever we ask for resources, we get them The IIA s 2018 Pulse of the Profession Study (based on 2017 data) highlights that: 70% of resourcing remained flat or decreased 64% expect the same this year Our scope of work is ever increasing (see next slide) 72% of CAE s have talent gaps they need filled On 9/17/18 there were exactly 100 Senior Auditor Job Postings on LinkedIn in Greater Boston We are always juggling multiple projects (sound familiar?) 5
Our Scope of Work* Anticipated Allocation Risk Areas Operational (not included elsewhere) Compliance/regulatory (not related to financial reporting) Financial reporting (including Sarbanes-Oxley testing) IT (not covered in other choices) Financial areas other than financial reporting Cyber (prevention and/or recovery) Enterprise risk management programs and related processes Fraud identification and investigation (not covered in other audits) 5% Governance and culture Support for external audit Management of third-party relationships Cost/expense reduction or containment Sustainability or other nonfinancial reporting Other risk category not listed 17% 16% 14% 8% 9% 7% 6% 4% 4% 4% 3% 1% 2% *sourced from the IIA s 2018 Pulse of the Profession 6
Fact or Fiction: We choose our audits, based on the way the wind blows, based on how much we like you or how we are feeling that day Our audits are selected based on a month long (or longer) risk assessment process, which the senior leadership and audit committee ultimately approve a generally annual plan They also direct us to execute special projects as well that are not part of the plan Changes to the plan must be approved by the Audit Committee Updates are typically quarterly to stakeholders 7
Internal Audit Project Cycle Phase 1: Select Project -Typically off audit plan -Initial reach out to stakeholder -Begin pre-planning Phase 4: Reporting -Finalize observations -Draft and issue report -Identify lessons learned Audit Life Cycle Phase 3: Conduct Fieldwork -Conduct process walkthroughs -Execute testing -Discuss preliminary observations Phase 2: Begin Planning -Perform risk assessment -Map risks to expected controls, design tests -Collect process documentation
Fact or fiction Internal Auditors live to audit. There is nothing more important in life than an audit report full of observations and recommendations 9
How to leverage all this 1) There s generally a plan out there get your hands on it! 2) Get to know us, in advance, it ll pay dividends during the audit 3) Understanding our audit cycle benefits us both you can know what to expect and can also push us along the way 4) Planning is where audits are won be honest, don t hide things AND 5) Reporting is where they are lost don t lose sight of the outcome due to verbiage 6) Leverage our reporting lines we can influence decision makers with the audit report 7) Don t be afraid we re employees, like you, with the best interests of the organization at heart (and we make a great blocker and tackler with external audit as well!) 10
