www.globaliia.org

Gerry Cox CMIIA, CIA, CRMA

Chairman of IIA Global Advocacy Committee

CEO South West Audit Partnership Ltd., UK

New Challenges New Opportunities:

Internal Auditing 2014

www.theiia.org

www.globaliia.org

Overview

• Assessing Stakeholder Expectations

and Priorities

• Internal Audit Aligning With Change

• Evolving Competencies and Career

Paths for Internal Auditors

• The Blurring Lines of Defense

• Five Imperatives for the Year Ahead

• Attributes of high performing audit

functions in 2020

www.globaliia.org

Internal Audit in 2014:

Assessing Stakeholders’ Expectations and Priorities

www.theiia.org

www.globaliia.org

Expectations for Internal Auditing

Are Continuing To Evolve

Stakeholder Expectations of Internal Audit

Board • Assurance

• No Surprises

• Eyes and Ears

• Insight

Executive • Assurance

• Value for Money

• Management Tool

• Insight

• Source of Talent

Regulators • Independent Risk and Controls

Assurance

www.theiia.org

www.globaliia.org

Audit Committees Perspectives on

Internal Audit’s Role In 2014 • Over 70% believe internal audit’s role should extend beyond

financial reporting and controls (77% in Asia/Pacific*)

• Only 42% believe internal audit has the skills and resources to

be effective in role envisioned (43% in Asia Pacific*)

• Which areas would you like internal audit to devote more time in

the year ahead:

Source: “2014 Global Audit Committee Survey,” © 2014 KPMG International Cooperative

* Comprised of Japan, New Zealand, Hong Kong, Thailand, and Australia

Global Asia/Pacific*

Risk management process 65% 59%

IT and data management 58% 49%

Operational risks 52% 60%

Compliance and regulation 45% 48%

Corruption and fraud 36% 35%

Corporate governance 27% 32%

www.theiia.org

www.globaliia.org

Additional Stakeholder Concerns

Executive Management

• Knowledge of the business

• Efficiency and innovation

• Advice and assistance

• Duplication with other risk

and control functions

• Insight

Boards of Directors

• Communications

• Connect the dots

• Assurance on the

effectiveness of risk

management

• Strategic mindset

• Insight

www.theiia.org

www.globaliia.org

Executive Perspectives on

Key Global Risks in 2014:

Source: “”Executive Perspectives on Top Risks in 2014,” Research Conducted by Protiviti and North Carolina State’s

ERM Initiative © 2014, Protiviti, Inc.

www.theiia.org

www.globaliia.org

Global Challenges and Opportunities:

Stakeholder Expectations

• Continue to evolve

• Are influenced by their:

– Strategic needs

– Perspectives and experiences

– Emerging risks

• Internal auditors must:

– Continuously assess and align

– Secure resources, talent, and trust

www.globaliia.org

Internal Audit in 2014:

Aligning With Change

www.theiia.org

www.globaliia.org

The Outlook for Global Internal

Audit Resources Remains Strong

• Budgets:

• Staffing:

Increase Stable Decrease

Overall 39% 47% 14%

Change from 2013-2014

Increase Stable Decrease

Overall 27% 63% 10%

Change from 2013-2014

Source: “The Pulse of the Profession: © 2014 The IIA Audit Executive Center

www.theiia.org

www.globaliia.org

The Outlook for Global Internal

Audit Resources Remains Strong

• Budgets:

• Staffing:

Increase Stable Decrease

Overall 40% 46% 13%

Asia/Pacific Change from 2013-2014

Increase Stable Decrease

Overall 29% 62% 9%

Asia/Pacific Change from 2013-2014

Source: “The Pulse of the Profession: © 2014 The IIA Audit Executive Center

www.theiia.org

www.globaliia.org

The Outlook for Global Internal

Audit Budgets by Region

+41% - 15%

+49% - 12%

+56% - 11%

+29% - 16%

+40% - 13%

Source: “The Pulse of the Profession: © 2014 The IIA Audit Executive Center

+66% - 34%

www.theiia.org

www.globaliia.org

The Outlook for Global Internal

Audit Staffing by Region

+26% - 8%

+34% - 10%

+28% - 6%

+23% - 13%

+29% - 9%

Source: “The Pulse of the Profession: © 2014 The IIA Audit Executive Center

+66% - 0%

www.theiia.org

www.globaliia.org

Operational 24%

Compliance/ Regulatory 14%

Financial 8%

Sarbanes-Oxley 5%

Business Strategy 8%

Risk Management

Effectiveness 10%

Information Technology

9%

Corporate Governance 5% Other 11%

Fraud 5%

Total “Financial” 13%

2014 Audit Plans Continue to Refocus

Away From a Financial Control Focus

Source: The Pulse of the Profession Survey: © 2014 The IIA Audit Executive Center.

Data reflects summary of audit plans strictly from CAE respondents to the survey.

Totals may not equal 100 percent due to rounding.

Global

www.theiia.org

www.globaliia.org

Operational 23%

Compliance/ Regulatory 14% Financial 9%

Sarbanes-Oxley 3%

Business Strategy 8%

Risk Management

Effectiveness 11%

Information Technology

8%

Corporate Governance 5% Other 12%

Fraud 7%

Total “Financial” 12%

2014 Audit Plans Continue to Refocus

Away From a Financial Control Focus

Source: The Pulse of the Profession Survey: © 2014 The IIA Audit Executive Center.

Data reflects summary of audit plans strictly from CAE respondents to the survey.

Totals may not equal 100 percent due to rounding.

Asia/Pacific Region

www.theiia.org

www.globaliia.org

Distribution of Typical Internal

Audit Coverage in 2013

OP - 24% FIN – 21%* COMP – 14%

OP - 24% FIN – 12%

COMP – 13%

OP - 20% FIN – 10%

COMP – 17%

OP - 26% FIN – 9%

COMP – 13%

Source: “The Pulse of the Profession: © 2014 The IIA Audit Executive Center

* Inclusive of Sarbanes-Oxley work

OP - 23% FIN – 11%

COMP – 14%

OP - 19% FIN – 10% COMP – 9%

www.theiia.org

www.globaliia.org

Rank Audit Committees Executive Management

1 Strategic Business Risks Strategic Business Risks

2 Operational Operational

3 Compliance/Regulatory Compliance/Regulatory

4 Information Technology Information Technology

5 Risk Management

Effectiveness Cost/Expense Reduction

Survey respondents indicate that the top risks which

audit committees and executive management are

focusing on are…

Survey respondents reported that strategic business risks are the top priority for audit committees (37%) and executive management (45%).

Source: The Pulse of the Profession Survey: © 2014 The IIA Audit Executive Center.

Data reflects summary of audit plans strictly from CAE respondents to the survey.

Where are Internal Audit’s

Stakeholders Focused?

www.theiia.org

www.globaliia.org

Rank Audit Committees Executive Management

1 Strategic Business Risks Strategic Business Risks

2 Operational Operational

3 Compliance/Regulatory Compliance/Regulatory

4 Risk Management

Effectiveness Cost/Expense Reduction

5 Information Technology Information Technology

Survey respondents indicate that the top risks which

audit committees and executive management are

focusing on are…

Survey respondents reported that strategic business risks are the top priority for audit committees (39%) and executive management (50%).

Source: The Pulse of the Profession Survey: © 2014 The IIA Audit Executive Center.

Data reflects summary of audit plans strictly from CAE respondents to the survey for Asia/Pacific Region

Where are Internal Audit’s

Stakeholders Focused? Asia / Pacific

www.theiia.org

www.globaliia.org

• Internal resources remain strong

• The focus of internal audit globally:

– Continues to evolve

– Demonstrates agility

– Is generally risk based

• However, gaps may be emerging:

– Between expectations and focus

– In internal audit capabilities

Global Challenges and Opportunities:

Adapting to Change

www.globaliia.org

Internal Audit:

Competencies and Career Paths are

Evolving

www.theiia.org

www.globaliia.org

DESCRIPTION OF ROLE PRIOR TO CURRENT ROLE AS CAE

Within Internal Audit, 52%

Outside of

Internal Audit, 48%

2014 Global Path For

Chief Audit Executives

Source: The Pulse of the Profession Survey: © 2014 The IIA Audit Executive Center.

Data reflects summary of audit plans strictly from CAE respondents to the survey.

Totals may not equal 100 percent due to rounding.

www.theiia.org

www.globaliia.org

DESCRIPTION OF ROLE PRIOR TO CURRENT ROLE AS CAE – BY REGION

Within Internal Audit 58%

Outside of

Internal Audit 42%

North America Within Internal Audit 56%

Outside of

Internal Audit 44%

Latin America

Within Internal Audit 79%

Outside of

Internal Audit 22%

Middle East

Within Internal Audit 55%

Outside of

Internal Audit 45%

Africa Within Internal Audit 43%

Outside of

Internal Audit 57%

Europe Within Internal Audit 53%

Outside of

Internal Audit 47%

Asia Pacific

64 CAEs 119 CAEs 453 CAEs

136 CAEs 29 CAEs 367 CAEs

Source: The Pulse of the Profession Survey: © 2014 The IIA Audit Executive Center.

Data reflects summary of audit plans strictly from CAE respondents to the survey.

Totals may not equal 100 percent due to rounding.

2014 Global Path For

Chief Audit Executives

www.theiia.org

www.globaliia.org

Requisite Skills For Internal

Auditing Continue to Evolve

0% 10% 20% 30% 40% 50% 60% 70% 80%

Other

Quality Controls (e.g., Six Sigma; ISO)

Forensics and Investigations

Cybersecurity and privacy

Fraud Auditing

Finance

Accounting

Business Acumen

Industry Specific Knowlwdge

Data Mining & Analysis

IT (General)

Risk Mgmt. Assurance

Communication Skills

Analytical/critical thinking

6%

9%

13%

14%

20%

22%

28%

36%

36%

40%

41%

44%

58%

75%

Source: The Pulse of the Profession Survey: © 2014 The IIA Audit Executive Center.

Data reflects summary of audit plans strictly from CAE respondents to the survey.

Global

www.theiia.org

www.globaliia.org

Requisite Skills For Internal

Auditing Continue to Evolve

Source: The Pulse of the Profession Survey: © 2014 The IIA Audit Executive Center.

Data reflects summary of audit plans strictly from CAE respondents to the survey.

Asia/Pacific

0% 10% 20% 30% 40% 50% 60% 70%

Other

Quality Controls (e.g., Six Sigma; ISO)

Forensics and Investigations

Cybersecurity and privacy

Finance

Accounting

Fraud Auditing

Industry Specific Knowlwdge

IT (General)

Data Mining & Analysis

Business Acumen

Communication Skills

Risk Mgmt. Assurance

Analytical/critical thinking

3%

9%

18%

19%

23%

25%

29%

30%

42%

43%

43%

51%

53%

67%

www.theiia.org

www.globaliia.org

• Emerging emphasis on operational

and strategic business risks are:

– Driving different skill requirements

– Impacting the sources for CAE talent

– Resulting in new skills being recruited

• The cumulative effect is an

emerging strategic risk for the

internal audit profession

Global Challenges and Opportunities:

Evolving Career Paths

www.globaliia.org

Three Lines of Defense:

Are the Lines Blurring?

www.theiia.org

www.globaliia.org

Supporting Internal Audit as a

Third Line of Defense

www.theiia.org

www.globaliia.org

How clear are the distinctions

between the roles of internal audit

and your organization’s

management, risk, compliance,

and control functions?

Glo

bal

Afr

ica

Asia

Pacif

ic

Eu

rop

e

Lati

n A

meri

ca

Mid

dle

East

No

rth

Am

eri

ca

Not clearly defined at all 11% 13% 13% 8% 19% 17% 12%

Somewhat defined 21% 23% 24% 18% 19% 24% 25%

Moderately defined 32% 39% 31% 33% 29% 28% 29%

Very clearly defined 36% 25% 32% 42% 33% 31% 34%

Source: The Pulse of the Profession Survey: © 2014 The IIA Audit Executive Center.

Data reflects summary of audit plans strictly from CAE respondents to the survey.

Totals may not equal 100 percent due to rounding.

Three Lines of Defense: Distinction

Between 2nd and 3rd Lines?

www.theiia.org

www.globaliia.org

Coordination with their

organization’s risk, compliance,

or other related control

functions on an enterprise-wide

risk assessment?

Glo

bal

Afr

ica

Asia

Pacif

ic

Eu

rop

e

Lati

n A

meri

ca

Mid

dle

East

No

rth

Am

eri

ca

Not at all 7% 11% 6% 6% 4% 14% 8%

Somewhat 20% 8% 21% 20% 19% 10% 24%

Moderately 36% 42% 36% 37% 43% 38% 30%

Extensively 37% 39% 38% 37% 33% 38% 38%

Source: The Pulse of the Profession Survey: © 2014 The IIA Audit Executive Center.

Data reflects summary of audit plans strictly from CAE respondents to the survey.

Totals may not equal 100 percent due to rounding.

How Extensively Does Internal Audit

Coordinate on Risk Assessments?

www.theiia.org

www.globaliia.org

To what degree does internal audit

coordinate with the organization’s

risk, compliance, or other related

control functions to assess and

monitor the ongoing management of

risk areas?

Glo

bal

Afr

ica

Asia

Pacif

ic

Eu

rop

e

Lati

n A

meri

ca

Mid

dle

East

No

rth

Am

eri

ca

Not at all 7% 13% 4% 6% 10% 3% 9%

Somewhat 22% 11% 24% 22% 14% 14% 28%

Moderately 38% 41% 42% 38% 47% 38% 32%

Extensively 33% 36% 30% 35% 30% 45% 31%

Source: The Pulse of the Profession Survey: © 2014 The IIA Audit Executive Center.

Data reflects summary of audit plans strictly from CAE respondents to the survey.

Totals may not equal 100 percent due to rounding.

How Extensively Does Internal Audit

Coordinate on Risk Monitoring?

www.theiia.org

www.globaliia.org

Source: The North American Pulse of the Profession Survey: © 2013 The IIA Audit Executive Center

Is the internal audit department in

your organization expected to

provide independent assurance

regarding the activities of risk

management, compliance, and

other assurance functions?

Glo

bal

Afr

ica

Asia

Pacif

ic

Eu

rop

e

Lati

n A

meri

ca

Mid

dle

East

No

rth

Am

eri

ca

Yes 79% 88% 81% 79% 84% 83% 74%

No 15% 13% 10% 14% 8% 10% 22%

Unsure 6% 0% 9% 7% 7% 7% 4%

Source: The Pulse of the Profession Survey: © 2014 The IIA Audit Executive Center.

Data reflects summary of audit plans strictly from CAE respondents to the survey.

Totals may not equal 100 percent due to rounding.

Is Internal Audit Expected to

Provide Independent Assurance?

www.theiia.org

www.globaliia.org

• “Three Lines of Defense” has helped

articulate internal audit’s role/value

• Encroachment between 2nd and 3rd

lines of defense is occurring

• Audit/oversight fatigue presents

challenges and opportunities

• Internal audit can be a leader in

coordinating key players

Global Challenges and Opportunities:

The Blurring Lines of Defense

www.globaliia.org

Challenges and Opportunities:

Raising the Bar in 2014

www.theiia.org

www.globaliia.org

Five Imperatives That Will Enhance

Our Value in the Year Ahead

• Assess/address emerging stakeholder

expectation gaps on focus and capabilities

• Develop and implement knowledge and

talent acquisition strategies

• Develop/enhance continuous

methodologies for assessing risks

• Assume a leadership role in coordinating/

aligning the 2nd and 3rd lines of defense

• Seek out innovative solutions to enhance

internal audit efficiency

www.globaliia.org

Sharpening our Focus on the Road Ahead:

The High Performing

Internal Audit Function of 2020

www.theiia.org

www.globaliia.org

Internal Audit 2020: Attributes of

a “High Performing” Department

• Fully integrated into the “C-Suite” as a

trusted advisor

• Possessing deep expertise on strategic

business risks

• Embedded with extensive information

technology expertise/capability

• A magnet for talent with deep serving

both internal audit and enterprise needs

• A respected source of insight and

foresight

www.theiia.org

www.globaliia.org

Questions?

The Institute of Internal Auditors

Gerry Cox CMIIA, CIA, CRMA

Chairman, Global Advocacy Committee

CEO, South West Audit Partnership Ltd.

gerry.cox@southwestaudit.co.uk

www.southwestaudit.co.uk

© 2013 The Institute of Internal Auditors. All Rights Reserved.

@SouthWestAudit