PULSE OF INTERNAL AUDIT · 2015-05-11 · Survey Demographics Survey Conducted Oct. 2014 • 8th...
Transcript of PULSE OF INTERNAL AUDIT · 2015-05-11 · Survey Demographics Survey Conducted Oct. 2014 • 8th...
![Page 1: PULSE OF INTERNAL AUDIT · 2015-05-11 · Survey Demographics Survey Conducted Oct. 2014 • 8th consecutive year • 370 responses • 63% Public/Private companies • 84% CAEs and](https://reader034.fdocuments.in/reader034/viewer/2022042420/5f3756baf5480c5526653cb3/html5/thumbnails/1.jpg)
PULSE OF
INTERNAL
AUDIT
Navigating an Increasingly
Volatile Risk Environment
![Page 2: PULSE OF INTERNAL AUDIT · 2015-05-11 · Survey Demographics Survey Conducted Oct. 2014 • 8th consecutive year • 370 responses • 63% Public/Private companies • 84% CAEs and](https://reader034.fdocuments.in/reader034/viewer/2022042420/5f3756baf5480c5526653cb3/html5/thumbnails/2.jpg)
Survey Demographics
Survey Conducted Oct. 2014
• 8th consecutive year
• 370 responses
• 63% Public/Private
companies
• 84% CAEs and
Directors (311
responses)
• 92% internal audit
managers or above
311 Responses From CAEs and Directors• 63% Public/Private companies
• 22% Public Sector
Industry• 28% Finance and Insurance
• 14% Manufacturing
• 10% Educational services
• 7% Healthcare and social assistance
Large Companies• 55 Fortune 500
• 53% $1B or more revenue
Source: The Pulse of Internal Audit survey: © 2015 The IIA Audit Executive Center.
![Page 3: PULSE OF INTERNAL AUDIT · 2015-05-11 · Survey Demographics Survey Conducted Oct. 2014 • 8th consecutive year • 370 responses • 63% Public/Private companies • 84% CAEs and](https://reader034.fdocuments.in/reader034/viewer/2022042420/5f3756baf5480c5526653cb3/html5/thumbnails/3.jpg)
Key Themes
• Emerging and Evolving Risks
• Linking Risks and Audit Coverage
• Navigating an Escalating Talent Shortage
• Parting Thoughts: Navigating Thought Leadership
3
![Page 4: PULSE OF INTERNAL AUDIT · 2015-05-11 · Survey Demographics Survey Conducted Oct. 2014 • 8th consecutive year • 370 responses • 63% Public/Private companies • 84% CAEs and](https://reader034.fdocuments.in/reader034/viewer/2022042420/5f3756baf5480c5526653cb3/html5/thumbnails/4.jpg)
CONTINUOUSLY ASSESSING
EMERGING AND EVOLVING RISKS
![Page 5: PULSE OF INTERNAL AUDIT · 2015-05-11 · Survey Demographics Survey Conducted Oct. 2014 • 8th consecutive year • 370 responses • 63% Public/Private companies • 84% CAEs and](https://reader034.fdocuments.in/reader034/viewer/2022042420/5f3756baf5480c5526653cb3/html5/thumbnails/5.jpg)
• A high priority with which CAEs struggle
• Often necessitates “connecting dots”
• Is vital to “auditing at the speed of risks”
Assessing Emerging and Evolving Risks
5
![Page 6: PULSE OF INTERNAL AUDIT · 2015-05-11 · Survey Demographics Survey Conducted Oct. 2014 • 8th consecutive year • 370 responses • 63% Public/Private companies • 84% CAEs and](https://reader034.fdocuments.in/reader034/viewer/2022042420/5f3756baf5480c5526653cb3/html5/thumbnails/6.jpg)
Source: The North American Pulse of the Profession Survey: © 2013 The IIA Audit Executive Center
6
Identifying Emerging Risks is Critical: But Confidence is Lacking
Source: The Pulse of Internal Audit survey: © 2015 The IIA Audit Executive Center.
Total may not equal 100% due to rounding.
52 percent of CAEs
consider identifying
emerging risks to
be their biggest
challenge in 2015.
Organization’s ability Identify Respond
Extremely confident 3% 4%
Very confident 32% 31%
Moderately confident 45% 42%
Slightly confident 15% 17%
No confidence 5% 6%
![Page 7: PULSE OF INTERNAL AUDIT · 2015-05-11 · Survey Demographics Survey Conducted Oct. 2014 • 8th consecutive year • 370 responses • 63% Public/Private companies • 84% CAEs and](https://reader034.fdocuments.in/reader034/viewer/2022042420/5f3756baf5480c5526653cb3/html5/thumbnails/7.jpg)
7
The degree to which internal audit utilizes these
methodologies to continuously assess risk
Extensively
Utilized
Periodic Manual Monitoring of KRIs 9%
Using Technology to Continuously Monitor KRIs 2%
Periodically Interview Management to Identify Changes in the
Organization's Risk Profile 33%
Initiate Formal Updates of the Internal Audit Risk Assessment &
Audit Plan 29%
Initiate Informal or Ad Hoc Updates of the Internal Audit Risk
Assessment & Audit Plan26%
Periodically Update Risk Assessment Based on Changes to Risk
Ratings Identified During Ongoing Audit Operations 22%
Continuously Assessing
Emerging and Evolving Risk
Source: The Pulse of Internal Audit survey: © 2015 The IIA Audit Executive Center.
![Page 8: PULSE OF INTERNAL AUDIT · 2015-05-11 · Survey Demographics Survey Conducted Oct. 2014 • 8th consecutive year • 370 responses • 63% Public/Private companies • 84% CAEs and](https://reader034.fdocuments.in/reader034/viewer/2022042420/5f3756baf5480c5526653cb3/html5/thumbnails/8.jpg)
8
Taking Action When Risks Emerge is Vital!
Source: The Pulse of Internal Audit survey: © 2015 The IIA Audit Executive Center.
70% of CAE’s viewed cyberattacks as a high or critical priority –
AEC Pulse of Internal Auditing
Yet!
Only 53% say auditing cybersecurity risk is part of this year’s
plan – Protiviti 2015 IA Capabilities and Needs Survey Report
![Page 9: PULSE OF INTERNAL AUDIT · 2015-05-11 · Survey Demographics Survey Conducted Oct. 2014 • 8th consecutive year • 370 responses • 63% Public/Private companies • 84% CAEs and](https://reader034.fdocuments.in/reader034/viewer/2022042420/5f3756baf5480c5526653cb3/html5/thumbnails/9.jpg)
• Assess the existing risk assessment maturity
• Develop/refine processes to identify and report on emerging
risks
• Assess the existing process for updating the annual audit plan
• Obtain stakeholders input on the need for frequent updates
• Develop/ refine audit reporting to demonstrate a stronger link
between changes to:
• the organization’s risk profile
• associated changes to the audit plan
9
Continuously Assessing Emerging and
Evolving Risk – Key Imperatives
![Page 10: PULSE OF INTERNAL AUDIT · 2015-05-11 · Survey Demographics Survey Conducted Oct. 2014 • 8th consecutive year • 370 responses • 63% Public/Private companies • 84% CAEs and](https://reader034.fdocuments.in/reader034/viewer/2022042420/5f3756baf5480c5526653cb3/html5/thumbnails/10.jpg)
LINKING RISKS & AUDIT COVERAGE
![Page 11: PULSE OF INTERNAL AUDIT · 2015-05-11 · Survey Demographics Survey Conducted Oct. 2014 • 8th consecutive year • 370 responses • 63% Public/Private companies • 84% CAEs and](https://reader034.fdocuments.in/reader034/viewer/2022042420/5f3756baf5480c5526653cb3/html5/thumbnails/11.jpg)
11
Linking Risks and Audit Coverage:The Paradox of “Structural Expectations”
Source: The Pulse of Internal Audit survey: © 2015 The IIA Audit Executive Center.
Total may not equal 100% due to rounding.
• Stakeholders often expect base
level of coverage:
• Financial risks
• Regulatory risks
• Compliance risks
• Once base is addressed:
• Operating risks
• IT risks
• Only then, is there interest in
strategic and business risks
• The paradox:
• Base level coverage often
provides the lowest perceived
value
![Page 12: PULSE OF INTERNAL AUDIT · 2015-05-11 · Survey Demographics Survey Conducted Oct. 2014 • 8th consecutive year • 370 responses • 63% Public/Private companies • 84% CAEs and](https://reader034.fdocuments.in/reader034/viewer/2022042420/5f3756baf5480c5526653cb3/html5/thumbnails/12.jpg)
Delivering Internal Audit Value: According to Grant Thornton - CAE’s Believe
They Add Value by:
12
Barriers Include:
1. Identifying improvement
opportunities
2. Mitigating risk
3. Increased efficiency
4. Stronger corporate governance
5. Stronger financial controls
compliance
Source: “Competing Priorities: Are CAE and audit committee priorities in sync?”
© 2015 Grant Thornton LLP
1. Budget constraints (60%)
2. Talent quality or capacity (47%)
3. Focus on financial controls and
compliance (43%)
4. Perception of internal audit
(40%)
5. Organizational politics (40%)
![Page 13: PULSE OF INTERNAL AUDIT · 2015-05-11 · Survey Demographics Survey Conducted Oct. 2014 • 8th consecutive year • 370 responses • 63% Public/Private companies • 84% CAEs and](https://reader034.fdocuments.in/reader034/viewer/2022042420/5f3756baf5480c5526653cb3/html5/thumbnails/13.jpg)
13
Regulatory/Compliance
14%Sarbanes-Oxley
11%
General Financial 8%
Fraud 4%
Operational 23%
Information Technology 12%
Other 11%
Risk Management 7%
Strategic Business Risks
6%
Corporate Governance 4%
Total
“Financial”
19%
Audit Plan Coverage in 2015
Source: The Pulse of Internal Audit survey: © 2015 The IIA Audit Executive Center.
Pulse survey respondents were asked to estimate the distribution of their audit plan coverage.
This figure reflects a summary of the data. Total may not equal 100% due to rounding.
![Page 14: PULSE OF INTERNAL AUDIT · 2015-05-11 · Survey Demographics Survey Conducted Oct. 2014 • 8th consecutive year • 370 responses • 63% Public/Private companies • 84% CAEs and](https://reader034.fdocuments.in/reader034/viewer/2022042420/5f3756baf5480c5526653cb3/html5/thumbnails/14.jpg)
LINKING RISKS & AUDIT COVERAGE
![Page 15: PULSE OF INTERNAL AUDIT · 2015-05-11 · Survey Demographics Survey Conducted Oct. 2014 • 8th consecutive year • 370 responses • 63% Public/Private companies • 84% CAEs and](https://reader034.fdocuments.in/reader034/viewer/2022042420/5f3756baf5480c5526653cb3/html5/thumbnails/15.jpg)
Linking Risks and Audit Coverage
15
Source: The Pulse of Internal Audit survey: © 2015 The IIA Audit Executive Center.
Total may not equal 100% due to rounding.
Conceptually: In Practice:
Risk
Audit CoverageAudit Coverage
Resources
Driv
e
Driv
e
![Page 16: PULSE OF INTERNAL AUDIT · 2015-05-11 · Survey Demographics Survey Conducted Oct. 2014 • 8th consecutive year • 370 responses • 63% Public/Private companies • 84% CAEs and](https://reader034.fdocuments.in/reader034/viewer/2022042420/5f3756baf5480c5526653cb3/html5/thumbnails/16.jpg)
The Outlook for Internal Audit Resources
in 2015 Remains Strong
• Projected Changes in Budgets From 2014-15:
• Extent of Budget Increases:
Increase Stable Decrease
Overall 41% 50% 9%
F500 43% 53% 4%
Range All F500
1-5% 31% 29%
6-10% 33% 42%
11-15% 14% 17%
Over 15% 22% 12%
Source: “The Pulse of Internal Audit: © 2015 The IIA Audit Executive Center
![Page 17: PULSE OF INTERNAL AUDIT · 2015-05-11 · Survey Demographics Survey Conducted Oct. 2014 • 8th consecutive year • 370 responses • 63% Public/Private companies • 84% CAEs and](https://reader034.fdocuments.in/reader034/viewer/2022042420/5f3756baf5480c5526653cb3/html5/thumbnails/17.jpg)
Linking Risks & Audit Coverage: Key Imperatives
17
• Undertake a comprehensive assessment
• Develop an audit plan based on the “real risks”
• Identify areas in where resources and expertise
gaps exist
• Formulate strategies for addressing gaps
• Have candid conversations with management
and the audit committee regarding:
• Resource shortfalls
• Expertise gaps
• Risks that may fall victim
• A plan of action
• Develop a long-term strategy for addressing gaps
• Don’t let the “tail wag the dog”
“Disclosing the
gaps in risk
coverage and
discussing the
resources needed
to address the gaps
is essential.”
- Joe Steakly, CAE
of HCA
![Page 18: PULSE OF INTERNAL AUDIT · 2015-05-11 · Survey Demographics Survey Conducted Oct. 2014 • 8th consecutive year • 370 responses • 63% Public/Private companies • 84% CAEs and](https://reader034.fdocuments.in/reader034/viewer/2022042420/5f3756baf5480c5526653cb3/html5/thumbnails/18.jpg)
PCAOB CREATING
DOWNSTREAM IMPACTS ON
INTERNAL AUDIT
![Page 19: PULSE OF INTERNAL AUDIT · 2015-05-11 · Survey Demographics Survey Conducted Oct. 2014 • 8th consecutive year • 370 responses • 63% Public/Private companies • 84% CAEs and](https://reader034.fdocuments.in/reader034/viewer/2022042420/5f3756baf5480c5526653cb3/html5/thumbnails/19.jpg)
PCAOB Creating Downstream Impacts on
Internal Audit
19
Source: The Pulse of Internal Audit survey: © 2015 The IIA Audit Executive Center.
• Practice Alert 11
• Issued in October 2013
• In response to “significant auditing practice issues observed”
related to ICFR audits
• Directed at firms auditing ICFR
• PA 11 is having a significant “downstream” impact on:
• Management
• Audit committees
• Internal audit
• Documentation has taken center stage
• CAE’s have reported widespread lack of reliance on internal
audit’s work
![Page 20: PULSE OF INTERNAL AUDIT · 2015-05-11 · Survey Demographics Survey Conducted Oct. 2014 • 8th consecutive year • 370 responses • 63% Public/Private companies • 84% CAEs and](https://reader034.fdocuments.in/reader034/viewer/2022042420/5f3756baf5480c5526653cb3/html5/thumbnails/20.jpg)
PCAOB Creating Downstream Impacts on
Internal Audit
20
External Audit Scrutiny Is On the Move:
Changes Observed Since 2013
Source: The Pulse of Internal Audit survey: © 2015 The IIA Audit Executive Center.
Area of Focus Percentage
Increase
Management’s documentation of controls 65%
Internal audit’s workpaper documentation 55%
Testing scope 56%
Risk evaluation 36%
Internal auditor competence 27%
Internal audit’s objectivity 22%
![Page 21: PULSE OF INTERNAL AUDIT · 2015-05-11 · Survey Demographics Survey Conducted Oct. 2014 • 8th consecutive year • 370 responses • 63% Public/Private companies • 84% CAEs and](https://reader034.fdocuments.in/reader034/viewer/2022042420/5f3756baf5480c5526653cb3/html5/thumbnails/21.jpg)
PCAOB Creating Downstream Impacts on
Internal Audit
21
Internal Audit in Publicly Traded Companies:
• 95% are assisting management with ICFR documentation
o51% very or extremely involved
• 65% experiencing increased scrutiny expect external
audit fee increases (result of PA 11)
• 55% experiencing increased scrutiny expect an increase
in direct assistance hours
Source: The Pulse of Internal Audit survey: © 2015 The IIA Audit Executive Center.
![Page 22: PULSE OF INTERNAL AUDIT · 2015-05-11 · Survey Demographics Survey Conducted Oct. 2014 • 8th consecutive year • 370 responses • 63% Public/Private companies • 84% CAEs and](https://reader034.fdocuments.in/reader034/viewer/2022042420/5f3756baf5480c5526653cb3/html5/thumbnails/22.jpg)
Linking Risks & Audit Coverage
22
Questions CAEs should Pursue with Stakeholders:
• Does the audit committee understand:
• where external audit is/is not, placing reliance on internal
audit work?
• the rationale behind the reliance parameters?
• Does the CAE and the audit committee understand how
external audit evaluates the competence and objectivity of
internal audit?
• Does the external auditor have competence- and objectivity-
related discussions with the audit committee?
• If not, does the audit committee know to initiate the
conversation?
![Page 23: PULSE OF INTERNAL AUDIT · 2015-05-11 · Survey Demographics Survey Conducted Oct. 2014 • 8th consecutive year • 370 responses • 63% Public/Private companies • 84% CAEs and](https://reader034.fdocuments.in/reader034/viewer/2022042420/5f3756baf5480c5526653cb3/html5/thumbnails/23.jpg)
NAVIGATING AN ESCALATING
TALENT SHORTAGE
![Page 24: PULSE OF INTERNAL AUDIT · 2015-05-11 · Survey Demographics Survey Conducted Oct. 2014 • 8th consecutive year • 370 responses • 63% Public/Private companies • 84% CAEs and](https://reader034.fdocuments.in/reader034/viewer/2022042420/5f3756baf5480c5526653cb3/html5/thumbnails/24.jpg)
24
Internal audit “will face tougher
competition to recruit and retain the top
talent needed to meet the increased
complexity of regulatory changes,
emerging risks around cybersecurity, IT,
and the growing demands of
stakeholders…”
Navigating an Escalating Talent Shortage
Source: The Pulse of Internal Audit survey: © 2015 The IIA Audit Executive Center.
![Page 25: PULSE OF INTERNAL AUDIT · 2015-05-11 · Survey Demographics Survey Conducted Oct. 2014 • 8th consecutive year • 370 responses • 63% Public/Private companies • 84% CAEs and](https://reader034.fdocuments.in/reader034/viewer/2022042420/5f3756baf5480c5526653cb3/html5/thumbnails/25.jpg)
Navigating an Escalating Talent Shortage
25
SKILLS CONSIDERED VERY OR EXTREMELY ESSENTIAL RATE
1 Analytical/Critical Thinking 96%
2 Communication Skills 96%
3 Business Acumen 80%
4 Industry-specific Knowledge 69%
5 Accounting 48%
6 Data Mining and Analytics 44%
7 IT (general) 43%
8 Risk Management Assurance 40%
Source: The Pulse of Internal Audit survey: © 2015 The IIA Audit Executive Center.
Skills Rated Essential to Audit Function’s Ability to
Perform its Responsibilities
![Page 26: PULSE OF INTERNAL AUDIT · 2015-05-11 · Survey Demographics Survey Conducted Oct. 2014 • 8th consecutive year • 370 responses • 63% Public/Private companies • 84% CAEs and](https://reader034.fdocuments.in/reader034/viewer/2022042420/5f3756baf5480c5526653cb3/html5/thumbnails/26.jpg)
Navigating an Escalating Talent Shortage
26
RANK AREAS OF HIRING
DIFFICULTY
AREAS OF SKILLS
DEFICIENCIES
1 IT (general) Quality Controls, e.g. Six Sigma
2 Cybersecurity and Privacy Data Mining and Analytics
3 Data Mining and Analytics Cybersecurity and Privacy
4 Industry-specific Knowledge Forensics and Investigations
5 Analytical/Critical Thinking IT (general)
Source: The Pulse of Internal Audit survey: © 2015 The IIA Audit Executive Center.
Skills Gaps Identified
![Page 27: PULSE OF INTERNAL AUDIT · 2015-05-11 · Survey Demographics Survey Conducted Oct. 2014 • 8th consecutive year • 370 responses • 63% Public/Private companies • 84% CAEs and](https://reader034.fdocuments.in/reader034/viewer/2022042420/5f3756baf5480c5526653cb3/html5/thumbnails/27.jpg)
Navigating an Escalating Talent Shortage
PwC’s View
27
Internal audit functions providing
significant value have more diversified
skill sets:
• Business continuity – 84% vs
70%
• Data privacy – 80% vs 64%
• Specialized IT – 77% vs 61%
• Data analytics – 72% vs 59%
• Supply chain – 69% vs 48%
The talent gap is “fueling a
poor perception of internal
audit’s relevance and value:
65% of stakeholders who do
not find value in the internal
audit functions cite talent as
a top barrier.”
- PwC -
Source: 2015 State of the Internal Audit Profession Study, © 2015 PwC
![Page 28: PULSE OF INTERNAL AUDIT · 2015-05-11 · Survey Demographics Survey Conducted Oct. 2014 • 8th consecutive year • 370 responses • 63% Public/Private companies • 84% CAEs and](https://reader034.fdocuments.in/reader034/viewer/2022042420/5f3756baf5480c5526653cb3/html5/thumbnails/28.jpg)
Navigating an Escalating Talent Shortage
28
Source: The Pulse of Internal Audit survey: © 2015 The IIA Audit Executive Center.
Recruiting staff from outside of
internal audit, offering on-site
training, and outsourcing cited as
three effective approaches:
• Cybersecurity and privacy:
• 37% outsource
• 23% recruit
• Data mining and analytics:
• 9% outsource
• 23% recruit
Techniques Employed by Pulse Survey Participants to
Address Skill Gaps
![Page 29: PULSE OF INTERNAL AUDIT · 2015-05-11 · Survey Demographics Survey Conducted Oct. 2014 • 8th consecutive year • 370 responses • 63% Public/Private companies • 84% CAEs and](https://reader034.fdocuments.in/reader034/viewer/2022042420/5f3756baf5480c5526653cb3/html5/thumbnails/29.jpg)
Navigating an Escalating Talent Shortage
29
Key Imperative – 4 Step Process
• Step 1: Create an organizational risk profile
• Step 2: Assess team skills
• Step 3: Identify skills gaps and develop strategies to
close them
• Step 4: Address strategic business risks and the
effectiveness of risk management
![Page 30: PULSE OF INTERNAL AUDIT · 2015-05-11 · Survey Demographics Survey Conducted Oct. 2014 • 8th consecutive year • 370 responses • 63% Public/Private companies • 84% CAEs and](https://reader034.fdocuments.in/reader034/viewer/2022042420/5f3756baf5480c5526653cb3/html5/thumbnails/30.jpg)
PARTING THOUGHTS:
NAVIGATING NEW THOUGHT
LEADERSHIP
![Page 31: PULSE OF INTERNAL AUDIT · 2015-05-11 · Survey Demographics Survey Conducted Oct. 2014 • 8th consecutive year • 370 responses • 63% Public/Private companies • 84% CAEs and](https://reader034.fdocuments.in/reader034/viewer/2022042420/5f3756baf5480c5526653cb3/html5/thumbnails/31.jpg)
It’s “Whitepaper Season” for Internal Audit
31
• At least 7 “whitepapers” were released in March:
• Pulse of Internal Audit – The Audit Executive Center
• Intersecting Roles – The Center for Audit Quality and the AEC
• 2015 State of the Internal Audit Profession Study – PwC
• 2015 Internal Audit Capabilities and Needs Survey – Protiviti
• Competing Priorities: Are CAE and audit committee priorities
in sync? – Grant Thornton
• Strengthen Audit Committee Value: A 10-Step Approach –
TeamMate®
• Metrics Matter – How Internal Audit Can Help Organizations
assess performance measurement - EY
![Page 32: PULSE OF INTERNAL AUDIT · 2015-05-11 · Survey Demographics Survey Conducted Oct. 2014 • 8th consecutive year • 370 responses • 63% Public/Private companies • 84% CAEs and](https://reader034.fdocuments.in/reader034/viewer/2022042420/5f3756baf5480c5526653cb3/html5/thumbnails/32.jpg)
Questions?
32
The Institute of Internal Auditors
Richard Chambers, CIA, QIAL, CGAP, CCSA, CRMA
President & Chief Executive Officer
@RFChambers