Are We Asking Too Much of Internal Audit?

Whenever there are bad news or new events, many articles and posts start to pop up almost immediately questioning "where were the auditors?" and /or offering thoughts on internal audit's role in the event. Recent examples are the never-ending cases of sexual harassments and the rise of artificial intelligence. This leads to the question; "Are auditors still an easy target?". Or one would wonder if perhaps this reaction is done out of love to internal auditors and in recognition of their vital role? If it is the latter, it should, obviously, be welcomed by internal auditors! 

Many agree that the role of internal audit is continuously evolving as a result of increased stakeholders' expectations, the continuous advancement of new technology, the increase in business complexity, and the rapid emergence of risks. Many internal audit shops are rising to the expectations and challenges, but how many of them actually had the chance to “assess” the reasonability, practicality, and fairness of the expectations and discussed their views with their stakeholders?

They always say that with authority comes responsibility, and for the sake of this discussion I say: "with higher expectations come real empowerment of internal audit!".

The objective of this post is to ask for internal auditors’ thoughts to these questions:

-         Do you believe stakeholders are asking too much of you?

-          Are you provided with adequate tools, resources, and support to meet the expectations?

-          Have you had the chance to discuss the expectations with your stakeholders?

If I receive enough responses, I will summarize them is a separate post for the benefit of those interested in the subject.

Please share your thought.

My Publications!

Get Your Copy Today!

www.bibiconsulting.net

CAE ON-CALL

Coming Soon: Bibi Consulting will be soon offering a new service to connect qualified independent internal audit consultants with companies in need of part time /interim/contract/ consulting services from Chief Audit Executives.

While we are still evaluating the best business model for this service, we would like to clarify that Bibi Consulting is not in the recruitment business and we are not soliciting resumes!

More details will be available soon.

 

 For more information, please contact us at info@caeoncall.com 

                                                      http://www.caeoncall.com

Are Auditors Immune Against The Feeling of Guilt?

As some of you may know, I am in the process of writing my second audit novella (The Retirement)!

It is about a newly retired seasoned auditor who finds himself involved in a huge corporate scandal shortly after his retirement. At one point during his retirement celebration trip to an isolated cottage, he goes through a flashback of his life. This is one of  his career flashbacks:

"he remembered how bad he used to feel when one of his audit reports caused someone his/her job or other negative consequences. At the beginning of his career, as a young auditor, he used to feel some sort of guilt and blame himself for not reporting the audit findings in a softer tone! As he matured, this feeling had disappeared and was replaced with a strong belief in transparency and accountability!"

My question to you: Is it normal for auditors to have a feeling of guilt in similar circumstances? 

Have you ever had a feeling of guilt in your audit career? If yes, how you dealt with it?

Please share your thoughts and experience.

My first audit novella "The Internal Auditor" can be bought by following this link:

http://www.bibiconsulting.net/The-Internal-Auditor.html

One More Time:Internal Audit & Geopolitical Risks!

Last year, I was asked by a newly established IIA Chapter in the Middle East to write an article, in Arabic, for their magazine.I thought the most pressing and relevant issue in an area like the Middle East would be the existing geopolitical risks.So, I wrote a short article discussing the role internal audit can play in providing assurance that the organization can successfully identify and manage top geopolitical risks!The chapter did not disappoint, it declined to publish the article on the basis it was too political.I was not surprised because I have a firm belief that culture influences everything from the mindset of internal auditors to the quality of the audit.In the case of that specific chapter, it was the culture of fear that influenced their decision.

 The article was not political at all! To the contrary, I urged internal auditors to keep a vigilant watch of geopolitical risks free of bias or any political agendas and to maintain the utmost independence at all times. I made it clear that evaluating geopolitical risks will not and should not convert internal auditors to political activists! I called upon internal auditors to evaluate the adequacy of the organization’s  disaster recovery and business continuation plans and procedures, in addition to the adequacy of its insurance coverage.

The recent rift in the Gulf is just another example of the importance of geopolitical risks.Internal auditors in the Middle East can hide their heads in the sand and pretend that business is as usual, or do what they are supposed to do in these disruptive and uncertain times!!

These are my thoughts please share yours!

Educate your Internal Auditors While you Entertain Them!

Get your copy today!

http://www.bibiconsulting.net/The-Internal-Auditor.html

Depending on What you Read:"Reading Can Seriously Damage your Ignorance"

I love this quote from "The Mindunleashed"! But, it can not be complete without pointing out that the damage is dependent on what you read!! The wrong readings (and/or correctly understanding what you read) may damage your intelligence, dignity and probably your humanity!!

Do you have what it takes to be an internal auditor?

Are you considering a career in internal audit? Or, are you a new internal auditor? This presentation may help you identify what it takes to be a successful internal auditor!

                            Contact us for details and pricing: adapgility@bibiconsulting.net

التدقيق الداخلي ونظرية المؤامرة

كتبت مؤخرا تدوينه باللغة الإنجليزية بعنوان " المدققون الداخليون يحصلون على علامتي رسوب" استعرضت فيها نتائج استبيانين قامت بأجراء الاول شركة برايس وترهاوس كوبرز بينما الاخر تم من قبل شركة بروتفتي. تناول الاستبيان الأول حال مهنة التدقيق الداخلي ورسم صورة قاتمة عن تراجع ثقة أصحاب المصلحة في قدرة التدقيق الداخلي على فهم متطلباتهم او إضافة منفعة حقيقية لشركاتهم. اما الاستبيان الثاني فتناول قدرات واحتياجات التدقيق الداخلي وخلص الى ان قلة من إدارات التدقيق الداخلي تستعين ببرامج تحليل البيانات او تتبع التدقيق المستمر!

لست هنا بصدد إعادة البحث في نتائج الاستبيانين وعلى من يرغب بالمزيد من التفاصيل الرجوع الى تدوينتي او الى التقارير التي صدرت عن الشركتين. ما اريد بحثه هنا هو رد فعل بعض المدققين على النتائج. كما هو متوقع فان الانكار كان الصفة الغالبة على ردود الفعل، بل وقام البعض بمهاجمة شركة برايس وترهاوس كوبرز واتهمها بعدم الحيادية وان النتائج التي توصلت اليها انما تهدف الى تشويه صورة التدقيق الداخلي لهدف تسويقي بحت. وقد كان من المستغرب أيضا ان يرد معهد المدققين الداخليين على التغطية الإعلامية لهذه النتائج عبر تدوينة لمديره التنفيذي بالإيحاء بانها اخبار كاذبة! لست هنا بصدد الدفاع عن   الشركة لان هذا ليس من شأني ولان الشركة أقدر مني على الرد على الاتهامات الموجهة اليها، علما بانه لا تربطني باي من الشركتين اية علاقة لا من قريب او بعيد. لكن وبغض النظر عن الأسلوب الذي اعتمدته الشركة في اجراء الاستبيان او في وجود نوايا تسويقية لها، فقد كان من الاجدر لو وجه التدقيق الداخلي هذه الطاقة المتدفقة في التوقف للحظة واغتنام الفرصة لأجراء تقييم ذاتي لأدائه في ضوء هذه النتائج بدلا من الانغماس في نظرية المؤامرة!

من الملفت للنظر ان نتائج استبيان شركة بروتفتي لم تواجه بسيل من النقد كسابقتها  ربما لان هناك اتفاق على واقعية النتائج التي توصلت اليها او لعدم أهميتها للمدققين الداخليين، او ربما لأنها  صدرت عن شركة خدمات  تدقيق داخلي اما الشركة الأخرى فهي شركة تدقيق حسابات خارجية! علما بان الافتراض الاخير نظرية مؤامرة من عندي!!   

      

Internal Auditors Have Received Two Failing Marks!

The results of two recent surveys conducted by PwC (2017 State of the Internal Audit Profession Study) and Protiviti( 2017 Internal Audit Capabilities and Needs Survey) were disappointing, to say the least. I know some of you may find the title of this article a little offensive, but keep in mind that we can’t overcome our weaknesses and move forward if we don’t address them honestly and go through a thorough performance self-assessment!

Let’s start with the PwC report. It starts with a depressing statement :

“Despite strong ambition from CAEs to grow their value to the organization, PwC’s 2017 State of the Internal Audit Profession study shows Internal Audit is losing ground in trying to keep pace with stakeholder expectations. In the five years, we’ve been tracking this sentiment, 2017 represented the lowest stakeholder perception of Internal Audit value.”

The survey shows that  only 44% of the surveyed stockholders reported that internal audit contributes significant value! To understand how bad this is, just compare it to the 2016 survey results of 54%!The study suggests that ,among other things, ongoing compliance burdens and pressure to do more with less have contributed to the decline in the perceived internal audit value. The study also shows that only 9% of the surveyed respondents consider internal audit as a trusted advisor! PwC recipe for an agile internal audit is to be prepared & adaptive.

The Protiviti survey which deals with “Data Analytics", shows that while Data analytics is gaining a foothold in internal auditing, most internal audit shops are still in their “analytics infancy”.! To put things into perspective ,Protiviti survey shows that 90% of the respondents rated their data analytics maturity between (initial – defined),while the remaining 10% rated it between (managed – optimized)!The picture is not brighter when it comes to continuous auditing!The survey reveals that:

“The use of continuous auditing remains surprisingly low, only 37% of all internal audit functions that utilize data analytics employ continuous auditing.”

I hope that these two surveys serve as another wake-up call to internal auditors. As I said in one in my tweets:

“The greatest risk to internal audit remains the traditional, unpragmatic  & uncreative mindset of internal auditors!”

There is no substitute to courageous, committed  and visionary internal audit leaders to reverse the results of the surveys and “make internal audit great again”!!

These are my thoughts, please share yours!

  

Are CAEs Finally Managing & Leading IT Audits?

A joint Protiviti /ISACA webinar (Today’s Top Technology Challenges and the Relationship to the Audit Plan) discussed the results of the latest IT Audit Benchmarking Study from ISACA and Protiviti. One of the top findings that I found interesting and promising is that CAEs are now more involved in the management and leadership of IT Audits.

 The survey report indicates that:

“ a small but increasing number of IT audit leaders are reporting directly to the CEO. In these instances, it is possible that the CAE is serving as the IT audit director, which is a positive trend as it provides the IT audit function and responsibilities with greater visibility and stature. It also is a logical progression given how more organizations have become increasingly technology-dependent, driving the need for the technology-savvy CAE to also serve as IT audit director. More CAEs are now assuming this role, which can be advantageous because, among other reasons, skilled and experienced IT audit directors are hard to find.”

The report also mentions that:

“Overall, with more organizations and internal audit groups becoming increasingly technology-centric, it  is a natural progression for CAEs to assume IT audit leadership roles.”

Another encouraging sign is shown in this paragraph of the report:

“We also find that in cases where the IT audit director is not attending audit committee meetings regularly, the CAE usually has sufficient knowledge to discuss IT audit matters with the committee.”

Does the above reflect a continuous trend? Only time will tell!

A couple of years ago, I suggested that The IIA & ISACA merge! I still believe it makes sense and it would certainly add flavor to both institutions!

These are my thoughts, please share yours!