التدقيق الداخلي ونظرية المؤامرة

كتبت مؤخرا تدوينه باللغة الإنجليزية بعنوان " المدققون الداخليون يحصلون على علامتي رسوب" استعرضت فيها نتائج استبيانين قامت بأجراء الاول شركة برايس وترهاوس كوبرز بينما الاخر تم من قبل شركة بروتفتي. تناول الاستبيان الأول حال مهنة التدقيق الداخلي ورسم صورة قاتمة عن تراجع ثقة أصحاب المصلحة في قدرة التدقيق الداخلي على فهم متطلباتهم او إضافة منفعة حقيقية لشركاتهم. اما الاستبيان الثاني فتناول قدرات واحتياجات التدقيق الداخلي وخلص الى ان قلة من إدارات التدقيق الداخلي تستعين ببرامج تحليل البيانات او تتبع التدقيق المستمر!

لست هنا بصدد إعادة البحث في نتائج الاستبيانين وعلى من يرغب بالمزيد من التفاصيل الرجوع الى تدوينتي او الى التقارير التي صدرت عن الشركتين. ما اريد بحثه هنا هو رد فعل بعض المدققين على النتائج. كما هو متوقع فان الانكار كان الصفة الغالبة على ردود الفعل، بل وقام البعض بمهاجمة شركة برايس وترهاوس كوبرز واتهمها بعدم الحيادية وان النتائج التي توصلت اليها انما تهدف الى تشويه صورة التدقيق الداخلي لهدف تسويقي بحت. وقد كان من المستغرب أيضا ان يرد معهد المدققين الداخليين على التغطية الإعلامية لهذه النتائج عبر تدوينة لمديره التنفيذي بالإيحاء بانها اخبار كاذبة! لست هنا بصدد الدفاع عن   الشركة لان هذا ليس من شأني ولان الشركة أقدر مني على الرد على الاتهامات الموجهة اليها، علما بانه لا تربطني باي من الشركتين اية علاقة لا من قريب او بعيد. لكن وبغض النظر عن الأسلوب الذي اعتمدته الشركة في اجراء الاستبيان او في وجود نوايا تسويقية لها، فقد كان من الاجدر لو وجه التدقيق الداخلي هذه الطاقة المتدفقة في التوقف للحظة واغتنام الفرصة لأجراء تقييم ذاتي لأدائه في ضوء هذه النتائج بدلا من الانغماس في نظرية المؤامرة!

من الملفت للنظر ان نتائج استبيان شركة بروتفتي لم تواجه بسيل من النقد كسابقتها  ربما لان هناك اتفاق على واقعية النتائج التي توصلت اليها او لعدم أهميتها للمدققين الداخليين، او ربما لأنها  صدرت عن شركة خدمات  تدقيق داخلي اما الشركة الأخرى فهي شركة تدقيق حسابات خارجية! علما بان الافتراض الاخير نظرية مؤامرة من عندي!!   

      

Internal Auditors Have Received Two Failing Marks!

The results of two recent surveys conducted by PwC (2017 State of the Internal Audit Profession Study) and Protiviti( 2017 Internal Audit Capabilities and Needs Survey) were disappointing, to say the least. I know some of you may find the title of this article a little offensive, but keep in mind that we can’t overcome our weaknesses and move forward if we don’t address them honestly and go through a thorough performance self-assessment!

Let’s start with the PwC report. It starts with a depressing statement :

“Despite strong ambition from CAEs to grow their value to the organization, PwC’s 2017 State of the Internal Audit Profession study shows Internal Audit is losing ground in trying to keep pace with stakeholder expectations. In the five years, we’ve been tracking this sentiment, 2017 represented the lowest stakeholder perception of Internal Audit value.”

The survey shows that  only 44% of the surveyed stockholders reported that internal audit contributes significant value! To understand how bad this is, just compare it to the 2016 survey results of 54%!The study suggests that ,among other things, ongoing compliance burdens and pressure to do more with less have contributed to the decline in the perceived internal audit value. The study also shows that only 9% of the surveyed respondents consider internal audit as a trusted advisor! PwC recipe for an agile internal audit is to be prepared & adaptive.

The Protiviti survey which deals with “Data Analytics", shows that while Data analytics is gaining a foothold in internal auditing, most internal audit shops are still in their “analytics infancy”.! To put things into perspective ,Protiviti survey shows that 90% of the respondents rated their data analytics maturity between (initial – defined),while the remaining 10% rated it between (managed – optimized)!The picture is not brighter when it comes to continuous auditing!The survey reveals that:

“The use of continuous auditing remains surprisingly low, only 37% of all internal audit functions that utilize data analytics employ continuous auditing.”

I hope that these two surveys serve as another wake-up call to internal auditors. As I said in one in my tweets:

“The greatest risk to internal audit remains the traditional, unpragmatic  & uncreative mindset of internal auditors!”

There is no substitute to courageous, committed  and visionary internal audit leaders to reverse the results of the surveys and “make internal audit great again”!!

These are my thoughts, please share yours!

  

Are CAEs Finally Managing & Leading IT Audits?

A joint Protiviti /ISACA webinar (Today’s Top Technology Challenges and the Relationship to the Audit Plan) discussed the results of the latest IT Audit Benchmarking Study from ISACA and Protiviti. One of the top findings that I found interesting and promising is that CAEs are now more involved in the management and leadership of IT Audits.

 The survey report indicates that:

“ a small but increasing number of IT audit leaders are reporting directly to the CEO. In these instances, it is possible that the CAE is serving as the IT audit director, which is a positive trend as it provides the IT audit function and responsibilities with greater visibility and stature. It also is a logical progression given how more organizations have become increasingly technology-dependent, driving the need for the technology-savvy CAE to also serve as IT audit director. More CAEs are now assuming this role, which can be advantageous because, among other reasons, skilled and experienced IT audit directors are hard to find.”

The report also mentions that:

“Overall, with more organizations and internal audit groups becoming increasingly technology-centric, it  is a natural progression for CAEs to assume IT audit leadership roles.”

Another encouraging sign is shown in this paragraph of the report:

“We also find that in cases where the IT audit director is not attending audit committee meetings regularly, the CAE usually has sufficient knowledge to discuss IT audit matters with the committee.”

Does the above reflect a continuous trend? Only time will tell!

A couple of years ago, I suggested that The IIA & ISACA merge! I still believe it makes sense and it would certainly add flavor to both institutions!

These are my thoughts, please share yours!