IIA Today March 2011

TodayA M E S S A G E F R O M T H E I N S T I T U T E O F I N T E R N A L A U D I T O R S

Understanding internal aUditing

aroUnd the World

6IIA Releases Results From Its Most Comprehensive Global Study Ever

10 April - May Training Opportunities from The IIA

12Why Audit Your Organization’s Social Media Efforts?

Volume 2 / I s sue 2 / March 2011

acl.com/steps

The new ACL Audit Analytic Capability Model provides clear guidance for organizations looking to improve their use of analytics. It’s how to talk to the business about the value of audit.

Theodore K. Walter CPA Manager, Financial Audits, Scripps Health

Your Trusted Partner for Audit Analytics

Take your audit analytics to the next level.

acl_iia_aacm_feb2011.indd 1 2/18/2011 12:15:49 PM

Dear IIA Member:

As vice president of The IIA Research Foun-dation (IIARF), the independent research arm of The Institute of Internal Auditors, I’m pleased to share with you the initial findings of our 2010 Global Internal Audit Survey, a component of The IIARF’s ongoing Com-mon Body of Knowledge (CBOK) study. It’s the most comprehensive global survey ever conducted on the practice of internal auditing, and it includes responses from audit practitioners in more than 107 countries.

This issue’s feature story, Understanding Internal Auditing Around the World, on page 6, explores the fascinating practices uncovered by the research and highlights critical areas for improvement worldwide. The researchers worked tirelessly to analyze the results of this survey, and we think you’ll be interested to learn about some of the common issues facing auditors around the globe. For instance, did you know that nearly half of internal audit organizations lack a mission statement and strategy for internal auditing? How does your audit function compare?

The study also explores trends such as the growing reliance on internal audit service providers, increased use of computer-assisted audit techniques, and heightened focus on risk management activities. Is your audit activity prepared to address these emerging issues?

With the CBOK database’s vast information about internal audit practices worldwide, the possibilities for further research analysis are endless. Perhaps you have your own area of interest or questions that can be answered by dig-ging deeper into the data collected by the Global Internal Audit Survey. The IIARF encourages budding researchers to participate in the research process by submitting a proposal. For more information on how to become an author or researcher for The IIARF, visit www.theiia.org/research .

Bonnie Ulmer Vice President IIA Research Foundation

PUBliCation direCtor Carrie Summerlin

editor Melissa Calhoun

staFF editors Lisa Krist

Paula Michaels

ContriBUting editors Margo Baeta

Christina Brune

art direCtor Jon Peters

ProdUCtion Manager Lori Shewack

iia President and Ceo Richard F. Chambers, CIA, CCSA, CGAP

iia ChairMan oF the Board Günther Meggeneder, CIA

IIA Today is a bimonthly publication pro-duced exclusively for members of The IIA. To learn more about this publication, please visit www.theiia.org/IIAToday . We welcome all comments, questions, and feedback. Please send your message to [email protected] and include your name and contact information.

the institute of internal auditors 247 Maitland Ave. Altamonte Springs, FL 32701-4201 USA +1-407-937-1100 www.theiia.org

All contents copyright © The Institute of Internal Auditors (IIA) 2010.

Today

w w w. t h e i i a . o r g / March 2 0 1 1 / 3

Welcome message

hoW do stakeholders PerCeive internal aUditing?Nearly one-third of internal audit stakeholders in the United States believe the internal audit group is insufficiently funded to fulfill its responsibilities, accord-ing to a recent survey conducted by The IIA Research Foundation (IIARF).

“The lack of support may become evident when audit plans are insufficient to cover the needs of the organization; when talent becomes difficult to attract; and when internal auditing is forced to limit itself to a traditional role of con-trols verification at the expense of providing counsel on efficiency, governance, risk, and strategy,” says Dan Bolger, author of the study’s research report, A Call to Action: Stakeholders’ Perspective on Internal Auditing.

The Stakeholders’ Expectations and Perceptions Study, a component of The IIARF’s Common Body of Knowledge, sought feedback from nearly 200 audit committee members, board chairs, CEOs, and chief financial officers. Its resulting research report offers themes and trends within the profession as well as helpful insights and actionable intelligence to chief audit executives (CAEs) and other internal audit professionals.

According to the report, recommendations for optimizing internal auditing include:

■ Ensuring that the CAE is well connected to the executive branch to keep abreast of the activities of the organization.

■ Building relationships based on trust so that the internal audit team is seen as a collaborator rather than a watchdog.

■ Engaging management throughout the audit process to enhance un-derstanding of operations, strategy, and strategic initiatives.

The report also offers insight for improving talent development, communica-tions with internal audit stakeholders, and strategic risk and corporate gover-nance. IIA members can download A Call to Action: Stakeholders’ Perspective onInternal Auditing free from The IIARF Bookstore, www.theiia.org/NewProducts .

the sky’s the liMit For iia on-site training

The IIA’s On-site Training has a solid reputation for deliver-ing professionally developed, practitioner-led, and afford-able internal audit training. In 2011, On-site Training has upped the ante with the addition of 100% course cus-tomization and a combination of live and virtual seminar delivery.

According to IIA On-site Train-ing Director Alan Dean, “I’ve added a ‘master builder’ to my team who is dedicated to designing and customizing training that meets client needs.” That means you can choose from 60+ existing courses or have one built from the ground up to your specifi-cations at no additional cost.

“We are also one of the first on-site training providers to combine live and virtual delivery,” explains Dean, “which enables us to engage your entire team regardless of their physical location.”

Learn more about On-site Training’s new “the sky’s the limit” features by visiting www.theiia.org/Onsite or calling +1-407-937-1388.

4 / I IA Today / w w w. t h e i i a . o r g

NeWs

enhanCed to Provide greater valUeVision University, a division of The IIA’s executive train-ing program created specifically for chief audit executive (CAE) development, has adjusted its offerings to provide a more value-added experience for new CAEs. The four-day course offers a limited class size to provide maximum interaction and networking opportunities.

For years, Vision University has offered two programs — Vision University: The New Chief Audit Executive (known as VU 1) and Vision University: The Experienced Chief Audit Executive (known as VU 2). “The programs have been second to none,” says Agnes Amos, director of Con-ferences & Executive Training for The IIA. “But, today’s experienced CAEs are looking for a more personalized networking forum, rather than a classroom experience.” For that reason, Vision University has begun a focused effort to retool the courses.

The revised class for new CAEs and senior-level execu-tives preparing to become CAEs incorporates elements from the VU 2 program such as the leadership component and strategic framework. The updated program also covers such topics as professional practices, client relationships, risk and control models, control self-assessment, human resources, and others.

“For now, the VU 2 class for experienced auditors is being discontinued, although we’re looking into ways to take material from that program and roll it into The IIA’s new Audit Executive Center,” notes Amos. The Audit Execu-tive Center, launched in October 2010, provides an array of services developed specifically to meet the needs of today’s CAEs. To learn more about the Audit Executive Center, visit www.theiia.org/CAE .

In 2011, the updated VU 1 program for new CAEs will be available in Chicago from May 23 to May 26, and in San Diego from November 7 to November 10. For more infor-mation about Vision University or to enroll in the program, visit www.theiia.org/VisionU .

Free WeBinar on health Care FraUdThe cost of health care is staggering. It’s estimated that annual expenditures for health care in the United States exceed US $2 trillion — that’s more than the annual revenues of any Fortune 500 com-pany. Fraud in the health care industry is estimated to be as high as 10 percent, or US $200 billion. Learn more about the scope and elements of health care fraud by attending The IIA’s free Members-Only Webinar, “Taming the Beast: Reining in Health Care Fraud,” on April 26 from 1:00 to 2:00 p.m. EST.

If your company provides health care benefits, combating health care fraud is critical to control-ling the cost of that valuable employee benefit. Webinar presenter Dennis McGuffie, vice president of Audit Services for Tenet Healthcare, will explain how health care fraud can impact your business and employees, regardless of your industry. Discover practical strategies for mitigating the risk of health care fraud within your own organization.

Don’t miss out on this valuable member benefit, which allows you to earn continuing professional education credits without leaving your desk or writing a check. To register for the webinar, visit www.theiia.org/mow . Members can also access an archived recording of February’s Members-Only Webinar on identity theft, which had more than 5,400 registrants, by visiting www.theiia.org/membership and clicking on the Members-Only Webinar Series button.

w w w. t h e i i a . o r g / March 2 0 1 1 / 5

NeWs

6 / I IA Today / w w w. t h e i i a . o r g

Feature story

Understanding internal aUditing aroUnd the Worldiia releases resUlts FroM its Most CoMPrehensive gloBal stUdy everTo meet the ever-demanding needs of their stakeholders, today’s internal auditors must move

beyond traditional internal control and assurance activities and sharpen their focus on risk

management, governance processes, and enhanced use of audit technology and automated

tools. These are just a few of the findings uncovered by The IIA Research Foundation’s

(IIARF’s) groundbreaking 2010 Global Internal Audit Survey.

The study, a component of The IIARF’s ongoing Common Body of Knowledge (CBOK) project, represents a two-year effort to collect and analyze responses from 13,582 practi-tioners in 22 languages and more than 107 countries. It’s the most comprehensive global study ever conducted on the practice of internal auditing, and its completion — marked by the release of five survey analysis reports — signifies the early stages of an unprecedented effort to understand and improve the practice of internal auditing globally.

“The purpose of the CBOK project, which began in 2006, is to create a living, comprehensive global database,” says IIARF Vice President Bonnie Ulmer, who points out that due to forward-looking questions on the 2010 survey, the CBOK database already includes information stretching from 2006 to 2015. “It’s an ongoing effort that allows the internal audit profession to stay relevant, vibrant, and vi-sionary. We want researchers to take this information, ask more questions, dive deeper into specific areas, compare results, and do trending,” she says.

w w w. t h e i i a . o r g / March 2 0 1 1 / 7

Feature story

In the meantime, the Global Inter-nal Audit Survey’s initial five-report analysis provides a snapshot of the profession worldwide and offers a wealth of tangible information to help chief audit executives (CAEs) and their teams make decisions and plan future initiatives regarding internal audit staffing, compliance with The IIA’s International Standards for the Professional Practice of Internal Auditing (Standards), and the role of the internal audit activity. The first four reports examine:

■ Characteristics of an inter-nal audit activity, including demographics, staffing levels, and reporting relationships.

■ The most important competencies for today’s internal auditors as well as compliance with The IIA’s Standards.

■ Measurement of the value of internal auditing to the organization.

■ Perceived changes in the roles of the internal audit activity over the next five years.

The fifth report, Imperatives for Change: The IIA’s Global Internal Audit Survey in Action, builds on the findings of the first four reports. It contains overall conclusions and observations from the Global Inter-nal Audit Survey as well as a related 2010 CBOK study, Stakeholders’ Perspective on Internal Auditing, which sought feedback from nearly 200 internal audit stakeholders in the United States. The Imperatives for Change report comprises 10 impera-tives and detailed action items to help CAEs plan a strategy for emphasizing risk management and governance, addressing key stakeholder priorities, optimizing internal audit resources, and leveraging technology effectively.

Emphasizing Risk managEmEnt and govERnancE “Internal auditors need to sharpen their focus on risk management and governance processes, which are projected to become the cornerstones of the internal audit profession,” researchers say. According to the survey, 80 percent of respondents foresee an increase in their risk man-

agement activities, and 23 percent project more corporate governance reviews in the next five years. A num-ber of factors are contributing to the heightened focus, including: (1) the increasing frequency and complexity of major risk events, (2) the fact that internal audit activities have stepped up their coverage of many risks in response to serious control break-downs in the financial services sector, (3) the rethinking of risk oversight by audit committees and boards, and (4) The IIA’s Standards requirement that internal auditors evaluate governance and risk management capabilities.

Survey results also highlight the need for CAEs to conduct a more responsive and flexible risk-based audit plan. “The idea that an internal audit activity can update its audit plan only once a year and still remain timely, responsive, and effective needs to be challenged strongly,” researchers say, pointing to the survey results, which revealed that more than 60 percent of respondents update their audit plans only once a year; approximately one-third update their plans more frequently.

addREssing kEy stakEholdER pRioRitiEs Only 57 percent of survey respon-dents have developed a mission statement for internal auditing, and just 51 percent have an internal audit strategy in place. This isn’t sufficient, say researchers, who encourage CAEs to strengthen their relation-ships and communications with the audit committee, determine the specific expectations of committee members and other chief stakehold-ers, and develop strategies and tactics to address these expectations.

aCCess the Five rePorts

IIA members can download the research reports for free from The

IIARF Bookstore, www.theiia.org/NewProducts , or purchase printed

copies of the six reports as a bundle for US $50 (US $75 for nonmembers).

Individual printed reports are available for US $25 to members and US $45 each

for nonmembers.

8 / I IA Today / w w w. t h e i i a . o r g

Feature story

Conducting stakeholder surveys is one of the best ways to assess the val-ue of internal auditing, say research-ers; however, less than 11 percent of study participants use surveys or feedback from the board, audit com-mittee, or senior management to as-sess internal auditing’s value. Instead, according to the survey, the most common method used to measure the value of internal auditing is by looking at the percentage of the audit plan that was completed.

Another key area where internal auditing needs to step up its efforts to respond to stakeholder priorities is compliance with The IIA’s Standards. Although 90 percent of internal audit stakeholders expressed strong sup-port for compliance with the Stan-dards, less than half of internal audit organizations are in full compliance with the Standards. The reasons for this disconnect should be explored via further discussions among the CAE, senior management, and the board, researchers say.

optimizing intERnal audit REsouRcEs Approximately half of organizations responding to the global study expect to recruit more staff during the next five years, and the two skills in great-est demand are: (1) understanding the business, and (2) knowledge of risk analysis and control assess-ment techniques. Researchers also note the growing need for special-ized training in data collection and analysis, operational research, and new audit tools and technologies due to the changing nature of internal audit procedures and their increas-ing automation. The report advises

CAEs to conduct an inventory of the skills needed to execute the organiza-tion’s strategy or vision, assess the skills and competencies of current staff members, and develop a plan to acquire required technical skills.

The growing trend of relying on internal audit service providers as an alternate source of support to address specific internal audit needs is evi-denced by the more than 44 percent of respondents who reported being involved in a third-party outsourc-ing or co-sourcing arrangement to augment their skills and capabilities. “With such a large group of quali-fied internal audit professionals now practicing their profession as service-provider employees, CAEs have a large, knowledgeable source of talent to consider when assessing their resource needs,” researchers say.

lEvERaging tEchnology EffEctivEly Rather than conducting separate “op-erational” and “IT” audits, auditors today are more likely to look for ways to conduct integrated and automated testing across entire populations, researchers say. In fact, nearly half of survey respondents report using computer-assisted audit techniques (CAATs), and approximately one-third use continuous auditing. Still, 21 percent of survey participants aren’t using any technology-based tools for their internal audit work.

During the next five years, survey respondents predict an increase in the use of CAATs, electronic workpa-pers, continuous/real-time auditing, data mining, and risk-based audit planning. To leverage the advan-

tages of technology-enabled auditing and keep pace with technological advancements, researchers advise CAEs to take a number of actions, including:

■ Establishing close ties with the in-house IT function to ensure the pursuit of complementary strategies and take advantage of avail-able technological resources.

■ Developing a long-term technology strategy that ad-dresses budget requirements to achieve technology-relat-ed goals.

■ Creating a comprehensive training program to support both current and long-term technology use.

sUPPort the next gloBal stUdy

The William G. Bishop III, CIA, Memorial Fund is the sole finan-

cial contributor to the CBOK project and was established to honor Bill Bishop, who served as president of The IIA from September 1992 until his untimely death in March 2004. Bishop’s dedication to and pride in the internal audit profession were unwavering. Visit www.theiia.org/Research to learn how to support this project.

w w w. t h e i i a . o r g / March 2 0 1 1 / 9

Feature story

aPril 2011april 4 – 6 / gaming ConferencePlanet Hollywood, Las Vegas, NVGain new perspectives from recognized practitioners while networking with colleagues and earning 18 CPE. Post-conference workshops earn you an additional 3 CPE.

4, 6, 8, 11, 13, 15, 18, 20, 22, 25, 27, 29 / virtual seminarCIA Review Part III / 6:00 – 8:15 p.m. Prepare to pass with a comprehensive study of the entire Part 3 syllabus.

4, 6, 8, 11, 13, 15 / virtual seminarEnterprise Risk Management (ERM): An Introduction / 3:00 – 5:15 p.m. ETImprove your understanding of ERM and the COSO ERM framework.

4, 6, 8, 11, 13, 15 / virtual seminarRisk-based Auditing: A Value Add Proposition / 6:00 – 8:15 p.m. ETLearn how to align your organization’s strategies, visions, and values with the internal audit process.

4 – 7 / iia/deloitte seminarAuditing JD Edwards / Costa Mesa, CAThrough hands-on computer experience, participants will learn about One World audit risks, navigation, and organizational structure.

25, 27, 29, May 2, 4, 6 / virtual seminarOperational Auditing: An Introduction / 3:00 – 5:15 p.m. ETGet started reviewing those areas of your organization where business actually gets done — operations.

2011IIA Members: Register early

for IIA training and save.

All offerings are subject to change without notice. 1 0 / I IA Today / w w w. t h e i i a . o r g

caleNdar

May 20112 – 5 / iia/deloitte seminarAuditing Oracle Applications / Costa Mesa, CALearn ways to provide an effective and efficient audit in an Oracle applications environment and how to audit Oracle applications security.

3 – 6 / seminarsChicago, ILThe IIA is bringing 13 of its most popular courses to the windy city.

9, 11, 13, 16, 18, 20 / virtual seminarOperational Auditing: Advanced / 6:00 – 8:15 p.m. ETThe operational auditing tools in the course are real-world techniques that can improve the controls in your organization

10 – 13 / seminarsSan Francisco, CAJoin your colleagues in the “city by the bay” for one of 15 tried-and-true courses.

16 – 19 / iia/deloitte seminarIntroduction to Auditing SAP ERP / Chicago, ILThis course provides an essential knowledge base as well as hands-on training in an SAP ERP system.

17, 19, 24, 26 / virtual seminarAudit Report Writing / 2:00 – 5:20 p.m. ETUPdated in 2011! This is a hands-on, dynamic seminar. It includes lectures, discussions, exercises, and writing practice.

23 – 26 / seminarsOrlando, FLSelect from 9 two- or four-day career-enhancing courses in Orlando.

for details, additional offerings, and to register, visit www.theiia.org/training

2011

Ask about group discounts on IIA training.

All offerings are subject to change without notice. w w w. t h e i i a . o r g / March 2 0 1 1 / 1 1

caleNdar

Why aUdit yoUr organization's soCial Media eFForts?

1 2 / I IA Today / w w w. t h e i i a . o r g

Bookstore

Someone, somewhere, is currently saying things about your organization. That part of the human experience has not changed for thousands of years. As long as commu-nication has existed, people have used it to express their opinions. However, there is an aspect of communication that has changed significantly in the last few years. While in the past such conversations may have been limited to gossiping over the neighbor’s fence or sharing a story over a cup of coffee, social media has taken that conversation and allowed it to be heard by millions of people worldwide at the speed of light.

Despite the magnitude of this change, most organizations do not understand the risks involved with this broadened conversation, nor have they taken steps to mitigate those risks. Many organizations ignore social media, shrugging it off as a passing fad. On the other hand, some organizations have jumped in wholeheartedly, without realizing their leap of faith is propelling them into a maelstrom of words, images, and audio that may already be out of their control.

Well-informed auditors can help their organization by understanding these risks and evaluating how well the organization is analyzing and responding to them. Auditing Social Media: A Governance and Risk Guide arms auditors with the information they need to understand, evaluate, and audit the organization’s approach to social media. The book discusses what social media is, how it is being used as a tool within corporations, and how it should be monitored. In addition, it addresses the various risks involved with the use of social media (e.g., reputation/brand risk; compliance risks; proprietary information risks; employee privacy risks; and vendor risks). It also covers compliance with U.S. Federal Trade Commission guidelines such as education and disclosure requirements as well as audit and record-keeping requirements.

visit the iia’s Bookstore at www.theiia.org/newproducts to purchase this useful guide.

international ProFessional PraCtiCes FraMeWork (iPPF) 2011

The IIA's authoritative guidance on the internal audit profession was recently updated and went into effect January 1, 2011. The IPPF presents current, relevant, internationally consistent information for internal audit professionals worldwide, and it includes both mandatory and strongly recommended guidance. The new IPPF 2011 features improved clarity, increased transparency, measurable account-ability, a defined cycle of review for all guidance, and availability in hard copy and as a fully interactive CD-ROM. www.theiia.org/Bookstore .

w w w. t h e i i a . o r g / March 2 0 1 1 / 1 3

Bookstore

As The IIA celebrates its 70th anni-versary, it’s fitting to reflect back — beyond just the formative years of The Institute, but to the birth of the profession itself. Where did internal auditing originate? What did the job entail in those early years? How has the profession evolved?

The term auditor appeared in the early Greek and Roman writings of Aristophanes, Caesar, and Cicero. Similarly, ancient documents from approximately 2,500 years ago reveal that internal audits were performed to manage the estates of Greek ruler Ptolemy Philadelphus II. These early audits examined the accuracy of accounting records and evaluated the propriety of activities reflected in the accounts.

In the United States, the need for internal auditing was initially recognized in government. The first Congress in 1789 approved the appointment of a secretary of the treasury, comptroller, and auditor. At

the time, the auditor's job was essen-tially a clerical function and involved receiving and examining all public accounts and certifying the balances.

Still, it wasn’t until the latter part of the 19th century that the first legitimate internal auditors appeared on the scene. Hired by railroad busi-nesses, these “traveling auditors” visited ticket agents to verify that money was properly accounted for.

The popularity of internal auditing soared in the early part of the 20th century with the development of large corporations that employed thousands of people and conducted operations in numerous locations. In those early days, the major objec-tive of internal auditing was to discover fraud quicker than it could be uncovered by the public accoun-tant during the annual audit. Over the years, with the increased use of computers and automatic checking procedures, internal auditors became free to expand their traditional role

of transaction verifier and focus not only on fraud, but also on waste and inefficiency.

In 1941, two dozen audit practitio-ners gathered in New York City to share their experiences, common challenges, and desires for the future growth of their beloved profession. Out of that initial meeting was born The IIA, a now global professional association for internal auditors.

Through its 70 years, The IIA has led internal auditors in the practice of their dynamic, continually evolv-ing profession. It has guided auditors through the advent of personal com-puters, the first electronic spread-sheet, and the enactment of the U.S. Sarbanes-Oxley Act of 2002. Today, as always, The Institute remains committed to advancing this great profession.

help us celebrate our 70th! visit www.theiia.org/anniversary .

genesis oF a great ProFession

1 4 / I IA Today / w w w. t h e i i a . o r g

special Feature

OUR PRINCIPAL PARTNERS MAKE A DIFFERENCEThe IIA acknowledges the ongoing support from our Principal Partners, who help enhance the internal audit profession by sharing their resources and knowledge with our most valuable asset – our members. These partners actively serve as members and volunteers within The IIA, participate in the introduction of new guidance, develop world-class training, and show their commitment in many other ways in an effort to advance the internal audit profession.

The IIA encourages you to tap into the expertise of our Principal Partners in 2011!

April 4 – 6, 2011

gaming ConferencePlanet Hollywood / Las Vegas, NV

July 10 – 13, 2011

70th international ConferenceKuala Lumpur Convention Centre / Kuala Lumpur, Malaysia

August 29 – 31, 2011

governance, risk, and Compliance ConferenceOmni Orlando Resort at ChampionsGate / Orlando, FL

October 17 – 19, 2011

all star ConferenceThe Bellagio / Las Vegas, NV

March 19 – 21, 2012

general audit Management ConferenceGaylord Palms Resort & Convention Center / Kissimmee (Orlando), FL

register early for iia Conferences and save! www.theiia.org/Conferences

NONPROFIT ORGANIZATIONU.S. POSTAGE

PaidTHE INSTITUTE OF

INTERNAL AUDITORS

247 Maitland AvenueAltamonte Springs, FL 32701-4201 USA

Please recycle this brochure by passing it along to a colleague.

Today

01/1

1036

/MC/

JP

A MEMBERS-ONLY PUBLICATION

Understanding internal aUditing

aroUnd the World

iia coNFereNce schedule

Volume 2 / Issue 2 / March 2011