Voice of the Customer: Stakeholders Messages from the CBOK ... · PDF file3 Background on CBOK Stakeholders Study Join Us: @IIAChicago #IIAChi ©Institute of Internal Auditors 2017

Voice of the Customer: Stakeholders Messages from the CBOK Global Internal Audit Study

Dick Anderson, De Paul University

Brad Rachmiel, Protiviti

April 3, 2017

2

Objectives of Session

©Institute of Internal Auditors 2017Join Us: @IIAChicago ● #IIAChi

Provide insights and observations on key issues related to stakeholders of internal audit identified during the CBOK Stakeholder Study

Provide actionable ideas and recommendations for you to consider for both you and your key stakeholders

1

2

Identify one topic or item to take back and improve on!

3

Background on CBOK Stakeholders Study


Seek direct feedback from stakeholders on a global basis

Protiviti chosen to execute in partnership with The IIA

Seeking leading, actionable practices and advice

4

Study Demographics

STAKEHOLDER STUDY FACTS

Survey participants 1,124

Interview participants 100+

IIA institute partners 23

Languages 13

STAKEHOLDER POSITIONS REPRESENTED

Board/audit committee chair

Board/audit committee member

Chief executive officer (CEO)

Chief financial officer (CFO)

Chief information officer (CIO)

Chief risk officer (CRO)

Chief compliance officer (CCO)

Chief operating officer (COO)

Chief legal officer (CLO)


Canada

Netherlands BelgiumUnited

KingdomFranceSpain

Russia

Poland Germany ItalyUnited

States Turkey Japan

Mexico United Arab Emirates

IndiaTaiwan

Malaysia Singapore

Brazil South Africa Australia

Five Reports from the Stakeholder Study

©Institute of Internal Auditors 2017

Join Us: @IIAChicago ● #IIAChi

Reports are free on the IIA’s

CBOK Resource website

Overall Conclusions



7

Stakeholders Give Internal Audit High Marks on

Foundational Elements


Agree that internal audit focused on areas and topics that are significant1

Internal audit keeps up to date with changes in the business2

Sufficiently communicates audit plans3

8

Stakeholders Give Internal Audit High Marks on

Foundational Elements


“Know your organization’s mission, strategy, objectives and risks. Effectiveness of internal audit continually comes back around to this foundation.”

This overall positive view provides a good foundation for internal auditors to leverage their reputation for quality into other areas in which they can add value

Assurance is Highly Valued



10

Assurance is Assumed


Stakeholders expect internal audit to provide assurance – and do it with excellence

11

Stakeholders View Assurance as Essential


Balance your work to reflect this

“Assurance is essential and consulting is nice to have, but should be secondary in priority.” Board Member, United States

12

Best Practices in Providing Assurance


1 Ensure the audit work is aligned to the strategic risks of the organization

2 Avenues to improve the role

Avenues for Internal Audit to Improve Its Role in Responding to Strategic Risks

13



3 Strategic risks

Incorporate a focus on strategic risks during assurance work

Ensure that the assurance work is closely aligned to the strategic risks of the organization

“Internal auditors need to be able to structure their annual plan to link the corporate strategy to their efforts/accomplishments. It is important to identify weaknesses and link them to the key strategy.”

Compliance Executive , Spain

14



3 Strategic risks

However, there are differences of opinion of stakeholders about internal audit’s role related to strategic risks

May point to a need to educate stakeholders

Should Internal Audit Have a More Active Role in an Organization’s Strategic Risks?

Moving Beyond Assurance



16

Building on Assurance


Stakeholders want internal audit to provide advisory work where it does not interfere with their assurance work

17

Areas to Address Beyond Assurance


Areas for Internal Audit to Address Beyond Assurance

18

Level of Advisory Work Varies


Maturity of the organization and its location 01

Some stakeholders concerned that being overly focused on advisory work will detract from assurance work

04

Competence of the internal audit function 02

Stakeholders do not see this as an either/or situation 03

19

The Assurance/Advisory BalancePursue advisory or consulting work where you have the

• Competency

• Capacity

• Support from your stakeholders


Other Stakeholders Expectations Voiced



21

Align with Expectations


Not all stakeholders see things the same way or want the same value from internal audit

The CAE bears the brunt of the responsibility of addressing this challenge

• Develop, socialize, validate a written set of expectations for value

Measure and report on progress with a

balanced scorecard

22

Know Your Business


To be effective, internal audit must view itself as a part of the business of the organization, understanding its industry, strategy and tactics1

Business acumen is necessary for this more active role2

Business acumen is not taught in classrooms, but gained through engaging with management and front-line personnel as they run the organization

3

Some stakeholders believe internal auditors should have business experience

4

“ I would expect CAE’s to have hands-on experience in business before taking up the internal audit function.”- CFO, India

23

Know Your Business

Action Items for CAE’s

• Identify the essentials to their success of your organization – its industry, the external environment, the chosen strategies and businesses and the risks related to those strategies and businesses

• Assess your level of business acumen and , if necessary, develop a plan to spend time and effort with those in your organization who can help you think more like a business leader

• Engage your stakeholders as a business leader not a technical auditor


24

Think Beyond Scope

CAE’s need to challenge their teams to “connect the dots” by thinking about the implications of audit findings across the organization


What is the real meaning of these findings? Is there a broader message?

Are there potential crisis events that we have not thought about and for which we are unprepared to respond?

How are we driving value out of our compliance and assurance activities?

As leaders of the organization, what are we missing?

25

Think Beyond Scope

A final comment regarding scope:

CAE’s need to communicate what is not being audited or cannot be audited. Audit Committees need clarity on this point.


In the CBOK Stakeholder Study, 21% of respondents indicate that internal audit does not communicate which of the organization’s risks or activities are not covered by the internal audit plan.

26

Coordinate with the Second Line of Defense


Stakeholders expect internal audit to work closely with the second lines of defense1

Internal audit is expected to communicate extensively with these functions and coordinate where possible2

Coordinate as much as possible, rely as much as possible but only do so based on evidence the functions in the second line of defense earn that reliance

3

27

Coordinate with the Second Line of Defense


Action items for CAE’s• Understand clearly the work down by functions in the

second line of defense• Coordinate as much as possible with these functions,

working toward common views of risks and compliance where possible

• Rely on assurance work done by these functions only when the objectivity and rigor of their work has been tested and verified.

28

Manage Competing Demands


Best Strategies to Address Competing Demands

The CAE must be effective in balancing competing priorities, a necessary and delicate task

Requires planning, corroboration and strong relationships

29

Manage Competing Demands


• Develop strong relationships with stakeholders of all types and levels

• Do not hesitate to take positions when they are needed

• Stay grounded in your professional obligations

• Build excellent interpersonal skills to be ready to use when they are critical


30

Importance of Relationships and Communications


Relationships are critical in understanding the business and keeping up with strategies

One critical aspect of relationships is communications

Needs to be in person, not just through documents and written messages

“To think in a strategic fashion, the head of internal audit must be in constant contact with the business, able to grasp the strategic changes by creating ongoing professional relationships with all key members of the company, not just the CEO.” Stakeholder in Italy

31

Importance of Relationships and Communications


• Perform a self-assessment of your relationships and communications. Be candid with yourself!

• Solicit input from stakeholders; ask them to identify areas for you to improve

• Seek out a mentor (internal or external) who is in a senior leadership position


32

Perform the Work with Excellence


Internal Audit Performance Factors

This is a problem, only 36% use these as

performance factors

33

Perform the Work with Excellence


Value of Conformance with Standards

“Conformance to Standards is expected and must occur”

CBOK Practitioner Study found that only 54% of respondents indicated that they conform to all Standards

This is another real problem

34

Organizational Culture –Promoting Change


CAE’s are in a unique position and in a unique role; that unique role brings opportunities to influence the culture of an organization

Stakeholders see internal audit as a valuable change agent

85% of respondents stated that internal audit brings value in this role

“Internal audit can definitely have a big impact on the culture of the organization and

can make it more process driven, efficiency focused, and risk focused. They can also bring in a lot of transparency as matters highlighted by the internal auditor are dealt

with at the highest levels.”- Chief Financial Officer, India

35

Conclusion


Use this to identify and focus on at least one major area for improvement2

Go to The IIA’s CBOK Resource Center for more information1

Thank You!



Voice of the Customer: Stakeholders Messages from the CBOK ... · PDF file3 Background on CBOK Stakeholders Study Join Us: @IIAChicago #IIAChi ©Institute of Internal Auditors 2017

Documents