Are You Ready for the New Global Internal Audit Standards?

 With the Global Internal Audit Standards set to take effect on January 9, 2025, it is crucial that the audit committee is well-prepared and familiar with these standards. To assist with this, we have created a brief presentation designed to equip audit committee members with essential information.

Reach out to us to schedule an in-person or remote presentation.

Takeaways from my 2023 ethics CPEs

 As you are aware, licensed CIA's are required to take at least two hours of training in the field of ethics. I have just completed mine and I would like to share with you some takeaways:

1. Becoming the everyday ethicist:

This session was presented by Amanda Erven. The one technique I liked about how to achieve this objective is by developing your own personal value statement and code of self-conduct! It is a great idea. I encourage internal auditors to adopt this important step towards becoming an everyday ethicist.

2. Exploring workplace honesty and ethical gray areas:

This session was presented by Christian Miller. I liked his discussion regarding the differences between an honest person and someone who exhibits honest behavior as shown below.

Finally, I came across a white paper by IIA Australia entitled "Why people do not accurately disclose their conflicts of interest". Here is a paragraph from it:

"There are three significant ways in which people withhold information about conflicts of interest:

1. People do not disclose conflicts of interest
2. People only partially disclose conflicts of interest
3. People give misleading disclosures that result in information being hidden

These are referred to in this White Paper as the sides of the ‘Conflict of Interest Bermuda Triangle’. Examining the reasons people do not make full disclosures of conflicts of interest will help us improve disclosure systems and internal controls over conflicts of interest."

Please share your takeaways from your ethics training with the group so we can raise awareness of the importance of ethics in our lives.

Do Internal Auditors Have Expiration Date?

 

 What do you think?

Internal Audit's Role in Returning to Workplaces

 Last year, Richard Chambers in a blog post entitled "Returning to Workplaces Will Be Risky: Roll Up Your Sleeves, Internal Audit", offered examples of the questions Internal Audit should ask and get answers to from management regarding their plans to a safe return to the workplaces. These questions included:

• Has management adequately identified and assessed return-to-workplace related risks?
• Do proposed return-to-workplace policies and controls address the key risks?
• Are policies/controls effectively implemented (including communications)?

• Is the overall program functioning as intended, or are improvements warranted?

Obviously, the return to the workplace was not significant last year or during the first half of 2021. However, this may change significantly during the second half of the current year due to progress made in vaccination and the reopening plans around the world. I believe Internal Audit should focus its attention on the following issues:

• Reinforce & strengthen relationships: working remotely for an extended period of time under a climate of uncertainty and disruption may have affected  Internal Audit's relationships with its stakeholders. The CAE's priority, in my view, should be to reestablish timely contacts including in-person meetings with stakeholders as much as the safety and pandemic protocols permit. The stakeholders want to talk to Internal Audit as well as hearing from CAEs on their views, insight, and plans. A smart CAE will find the time to connect with his /her stakeholders and make the most out of the connection.
• Work closely with HR & Legal Departments to ensure there are proper anti-discrimination and conflict resolution plans: it will not be surprising, in the short term at least, that there will be employees resisting and challenging the organization's safety protocols such as wearing masks and physical distancing. There will be also others who did not get vaccinated for whatever reason. This may lead to conflict between the employees themselves and with management.  Internal Audit needs to ensure that there are practical and fair plans to deal with such situations.
• Encourage management to communicate the return policies and procedures before the return to the workplace: employees should not be surprised by the organization's procedures and protocols when they show up to work. They need to be aware in advance of what is waiting for them in the office and plan accordingly.
• Monitor and assess changes in corporate culture: whether we realize it or not,the pandemic and working remotely have changed people. The change could be in the mindset, the mental welness, priorities, perspective of life, and career plans. These changes can potentially influence the corporate culture. Internal Audit needs to work closely with HR and others to monitor trends and changes in culture to enable management to take timely actions to address the change.

I would love to hear from CAEs who have already returned to the workplace. Please share your experience and what challenges have you faced. What advice would you give to those who are about to return to their offices?

These are my thoughts, please share yours!

Picture credit:www.telljp.com

What does innovation mean to Internal Audit?

 

The pressure is mounting on Internal Audit to become innovative and this is understandable and expected. The call for innovation is not new but has certainly intensified during the COVID 19 pandemic as organizations are going through changes and transformation to adapt to the new normals. Innovation may mean different things to different people, in this post I will discuss what innovation means to internal audit.

What is innovation?

In traditional dictionaries, innovation is defined as developing a new idea, method, service, or product. In reality, it is more than that. It also refers to updating current processes to improve the quality of services and products. It does not mean that you always start from scratch!

What is innovation in internal audit?

There may not be a unified definition of what innovation in internal audit means. For some it could mean reinventing internal audit, for others, it means one or more of the following:

• transformation to agile internal auditing
• better leveraging of technology and greater use of data analytics, RPA, and AI
• exploring and accepting new ideas and alternative processes to improve audits
• empowering the creativity of internal auditors and encouraging brainstorming
• better utilization of available resources
• understanding how the organization is changing its business model and operations and adjusting audit plans and procedures accordingly
• more access to specialized skills internally and externally
• enhanced reporting and real-time communication
• more investment in relevant training
• risk anticipation and enhanced risk assessment
• change of internal audit mindset and culture
• striking the right balance between consulting and assurance services

What else do you consider as an innovation in internal audit?

Please share what innovation means to you. I would love to update the above-mentioned list with your definition and understanding of innovation in internal audit.

How to become innovative?

The first step is to clearly define innovation and ensure that your stakeholders agree with it. Then develop your objectives and start working on your mindset and the mindset of your team. Don't be afraid to think loudly even if what you are thinking about sounds crazy and illusional! Put some of these crazy ideas to test and see what happens!  I like the advice offered by a  themuse article on how successful people become more innovative. It lists the following characteristics.

• they don't discount their crazy ideas
• they get comfortable with fear
• they learn about anything and everything
• they never think they know it all
• they surround themselves with heroes

Please share what innovation means to you and what have you done in practice to become innovative.

These are my thoughts, please share yours.

Getty Images

Has your Internal Audit function tested positive for the irrelevance virus?

 By now, most of you have realized that the world as we knew it has changed forever! The change has affected almost everything in our lives at the personal and professional levels. Some of the changes could be opportunities in disguise, while others could bring devastating consequences to some businesses and certain functions within an organization.

Has your Internal Audit function tested positive for irrelevance?

While many Internal Audit functions have shined and demonstrated that they are indispensable during the crises, others were not so lucky! If your Internal Audit has failed to provide help, add real value, and start the evolution process during the pandemic, it could be because it has been infected with the "irrelevance" virus! In this case, your Internal Audit is dying or most probably has been dead for a while!

On a more serious note, can the COVID 19 pandemic weaken internal audit in some organizations? The answer depends on many factors such as:

• The performance of Internal Audit: if you have not proved your value to the organization during this crisis, it is unlikely that your Internal Audit function will emerge from it unscathed.
• The performance of the organization: financial difficulties may lead to cuts in the Internal Audit budget, lay off of auditors, and/or other measures.
• Some fear that management may attempt to use the crisis as an excuse to weaken Internal Audit to serve its agenda or in retaliation for previous actions by Internal Audit! I would like to believe that this scenario will not happen.

Get Vaccinated!

Yes. there is a vaccine against irrelevance and if you have not taken it yet, do that now. It is not too late. Here are some basic vaccine dose recommendations:

• Leave your comfort zone immediately and be agile. At AdapGility Consulting we developed the motto " Be agile, be alive" because these days if your IA function is not agile it means it is paralyzed or dead!
• Work on your mindset (that could be the hardest part). Become flexible and adaptable, it is essential to enable you to transform into agile internal auditing.
• Understand the true meaning and intention of the internal audit independence concept. Don't hide behind it!
• Do not wait for a seat at the table to be offered to you. Invite yourself to the party.
• Keep your eyes, ears, and more importantly your mouth fully open! Real-time communication of what matters is the key to relevance.
• Maintain an up-to-date understanding of the company's objectives and business. This is a cornerstone for auditing what matters and adding value. Keep the conversation going with your stakeholders in these uncertain and unprecedented times.
•  Understand what is the stakeholders' perspective of what adding value by IA means to them.
• Take a tablespoon of the "courage syrup" three times a day!
• Put serious efforts into developing your soft and technical skills. Invest in yourself.
• Utilize available technology to its fullest potential.

The above is not rocket science and has been repeated time and time again by the IIA, the consulting firms, thought leaders, and others. Almost all internal auditors are familiar with it. However, there is still a gap between what internal auditors know and what they can successfully implement. Bridge the gap!

Can the world live without Internal Audit?

 How would the world look like If Internal Audit fails and is marginalized or eliminated?

In researching materials for this topic I came across an undated article questioning  "What if Internal Audit disappeared?". The conclusion was basically that it will not be the end of the world, and that    "key stakeholders would still demand some degree of checks and balances and that the other functions—second-line compliance and risk management, external audit, regulators—would naturally fill much of the void". The interesting thing is that the author's conclusion was based on discussions with his friends in Internal Audit who he described as pragmatic!

What do you think will happen if Internal Audit ceases to exist?

These are my thoughts, please share yours!

/

Are you the same person you were before the COVID-19 crisis?

Now that you have stayed at home and working remotely for some weeks, it may be time to ask how this life-changing experience has affected you at the personal and professional levels?

Are you the same person you were before the crisis?

What has changed in your perspective of life, family, and your profession?

When you return to your office, hopefully in the near future, what would you be doing differently? Will you be doing audit planning, risk assessment the same way you used to do? How will your relationships with the stakeholders be reshaped? And more importantly, how your understanding of your role as an internal auditor has changed or evolved?

If you believe this experience has not changed you, can you share why you feel this way and what contributed to your status quo?

Please share your thoughts!

picture credit:https://liveboldandbloom.com

How will Internal Audit look like after COVID-19?

There have been many articles and posts dealing with the Internal Audit's role during the COVID-19 crisis. These were useful, but now we need to plan for what happens next. The economic, social and financial implications of the crises are expected to be severe at least for the short term.

Eventually, this crisis will pass and most businesses will resume operations and will have to adapt to the new realities to survive. Changes to operations and mindset will need to be made at all levels including at Internal Audit Departments.

As most of you are at home during this difficult time and are probably bored, let's try to think about how the internal audit function at your organization will look like after the crises! For example:

• Did the crisis change you as a person and how this will reflect on you as an internal auditor?
• What lessons have you learned during the crises and what are you going to do about it?
• What type of changes will you make to strengthen internal audit?
• Do you anticipate an increase or decrease in the number of auditors within your department?
• Do you anticipate management to change its perspective of internal audit (positive or negative)?
• What would you do to be prepared for the next crisis?

I look forward to hearing your thoughts and feedback!

Can Internal Audit Apply Real-Time Quality Assurance?

I have recently attended a KPMG webinar that discussed "Trends and tips for internal controls over financial reporting". The presenter mentioned that the PCAOP is now focusing its reviews of the work of the accounting firms on the system of quality control such firms employe to ensure their audits meet the requirements. In response to this new approach, the presenter said that the accounting firms are improving their quality control process by shifting from "after the fact" to "real-time" quality control.

 In theory, Internal auditors should be applying the "real-time" approach to quality assurance as the International Standards for the Professional Practice of Internal Auditing require that the CAE must develop and maintain a quality assurance and improvement program that covers all aspects of the internal audit activity ( standard 1300). Moreover, standard (1311) calls for internal assessments to include ongoing monitoring of the performance of the internal audit activity.

The interpretation of standard  1311 explains ongoing monitoring as:

"Ongoing monitoring is an integral part of the day-to-day supervision, review, and measurement of the internal audit activity. Ongoing monitoring is incorporated into the routine policies and practices used to manage the internal audit activity and uses processes, tools, and information considered necessary to evaluate conformance with the Code of Ethics and the Standards". 

Do you believe the ongoing monitoring as mentioned above is equivalent to real-time quality control?

In practice, are you really able to apply ongoing monitoring on a daily basis?

Please share your thoughts and experience!

Picture credit:http://foothilllockandkey.com

Can Internal Auditors Identify Corporate Identity Crisis?

According to a Globe and Mail article published a couple of days ago, Canada's favorite coffee shop chain ( Tim Hortons) is going through an identity crisis that could erode its long-established brand. I will not be discussing Tim Hortons's situation in this post even though the coffee shop is an important part of the life of almost every Canadian ( It serves 8 of every 10 cups of coffee consumed outside the home in Canada), but rather I will use it as an inspiration to discuss whether internal audit is equipped to identify corporate identity crisis before it impacts the organization's brand and reputation.

What is Corporate Identity Crisis?

In general, identity crisis in people describe a state of confusion about who they are, their role in society and what they want to achieve in life. When it comes to corporations it means that how the organization perceives itself and promotes itself is in conflict. This description was offered by Jeffery A. Jolton, Ph.D. and Tim L. Geisert of Kenexa in an article entitled "Corporate Identity Crises". They offer more explanation regarding the conflict:

"This conflict prevents the organization from being able to fully attain its goals. Some companies are well aware of the conflict, but either don’t see it as an obstacle (yet it is) or don’t know how to resolve it in order to move forward. Many companies, however, are clueless. Although it is something that others may see as obvious, the leadership isn’t aware there is a problem, and as a result, faces a wall in the company’s progress that it is unable to see"

There are many causes of identity crises in organizations such as a change in leadership, rapid growth, disruption, merger, and change in culture. The signs of identity crisis could be obvious and visible and in other times could be difficult to spot!

To identify the crisis. one should have a deep understanding of the organization's business, objectives, strategic plans, customers, competition and potential risks and disruptions.

Identity crisis could impact organizations negatively if not identified at an early stage and treated!


What Internal Audit Can Do?

Do you think internal auditors are capable of identifying the signs of corporate identity crises in their organizations? Were you personally involved in an identity crisis situation? If your answer is yes please share:

• How you arrived at the conclusion that there may be an exposure to a crisis. What signs triggered your attention?
• What audit steps and procedures did you employ to verify and measure the risk of identity crises?
• What was the management reaction to your findings and recommendations?
• Was the issue satisfactorily resolved?

In my opinion, the first step in identifying the issue is for internal audit to recognize that corporate identity crisis is a real risk that could happen to any organization! It should be part of the continuous risk assessment and audit planning.

Many techniques can be used to identify identity crisis such as observations, discussions with all levels within the organization, attending executive meetings, internal and external surveys, and culture audits.

These are my thoughts, please share yours!

Photo Credit: sdecoret/ Shutterstock)

Internal Audit Relationship with Regulators

The Chartered Institute of Internal auditors has recently published an Internal Code of Practice which provides guidance on effective internal audit in the private and third sectors. This code builds on the success of its previous of a similar code for the financial services firms.

The code covers a wide range of areas:

•   role and mandate of internal audit,
•   scope and priorities of internal audit 
•   interaction with risk management, compliance, and finance
•   reporting results
•   independence and authority of internal audit
•   resources
•   QIAP
•   relationship with regulators
•  Relationship with external auditors

I will limit the discussion in this post to the relationship with regulators. The code states that:

" The chief internal auditor should consider the impact of the regulatory environment and have an open, constructive and cooperative relationship with relevant regulators."

How do you interpret and apply the above statement in your country? 

Do you think the code should provide more details and guidance on this important issue?

Would your management accept an open and cooperative relationship with regulators?

What should be the nature, objectives, and scope of such a relationship?

Back in 2015, I wrote a post about  the same subject after reading a Thomson Reuters white paper, you may want to take a look at it:

Should Internal Audit Forge Relationships with Regulators & Other Outsiders?

Please provide your thoughts!

The Proposed Internal Audit Code of Practice: A Necessity or A Duplication?

The Chartered Institute of Internal Auditors has published for consultation a draft of a proposed Internal Audit Code of Practice. According to the Institute, the 30 recommendations included in the draft are aimed at enhancing the overall effectiveness of internal audit, and its impact, in the UK and Ireland. The recommendations can be regarded as a benchmark of good practice against which organizations can assess their internal audit function.
The Institute emphasized that the code should be applied in conjunction with the existing International Professional Practices Framework (IPPF). It continued to mention that the code builds on the IIA standards and seeks to clarify expectations and requirements needed to strengthen the effectiveness and impact of internal audit.

The 30 principle-based recommendations cover the following areas:
·  Role and mandate of internal audit
· Scope and priorities of internal audit
· Reporting results
· Interaction with risk management, compliance and finance
·  Independence and authority of internal audit
· Resources
 The recommendations range from identifying the primary role of internal audit to calling for the internal audit to have sufficient and timely access to key management information and right of access to all of the organization’s records.
The code which is described as “voluntary” is written in the context of a reasonably sized organization operating in all private sector organizations within the UK and Ireland. Modifications may be needed to accommodate the size, scope, risk profile and complexity of operations of various organizations.

 After reading the recommendations, do you think they:

1.        Duplicate  the IIA standards and add little value
2.       Complement the IIA standards
3.        Add significant value to the IIA standards .

 Also, do you think other countries should adopt similar code through the  IIA chapters?

 Please share your thoughts.

  

AdapGility Consulting is Launced!

AdapGility Consulting in association with Bibi Consulting launched a new service to connect CAEs (Chief Audit Executives) to organizations that need the services of such executives on temporary/short-term basis. This is a CAE ON-CALL service available worldwide

This service will be provided under the brand " AdapGility"  (www.caeoncall.com) which refers to the two most important characteristic of a value adding internal audit activity:  

                                                           Adaptability 

                                                                   &                           

                                                                Agility

We are teaming with world-class internal audit executives worldwide to provide quality value adding service. If you are an internal audit executive and wish to explore the opportunities,please forward your resume to:

info@caeoncall.com

Do Internal Auditors Have An Expiration Date?

The Right Way to Start Your Day!

The right way to start your day would be by having a chat with us to discuss how you can get the best value from your #internalaudit function!

Call us today to inquire about our free high-level review of IA functions in selected cities around the world!

Are We Asking Too Much of Internal Audit?

Whenever there are bad news or new events, many articles and posts start to pop up almost immediately questioning "where were the auditors?" and /or offering thoughts on internal audit's role in the event. Recent examples are the never-ending cases of sexual harassments and the rise of artificial intelligence. This leads to the question; "Are auditors still an easy target?". Or one would wonder if perhaps this reaction is done out of love to internal auditors and in recognition of their vital role? If it is the latter, it should, obviously, be welcomed by internal auditors! 

Many agree that the role of internal audit is continuously evolving as a result of increased stakeholders' expectations, the continuous advancement of new technology, the increase in business complexity, and the rapid emergence of risks. Many internal audit shops are rising to the expectations and challenges, but how many of them actually had the chance to “assess” the reasonability, practicality, and fairness of the expectations and discussed their views with their stakeholders?

They always say that with authority comes responsibility, and for the sake of this discussion I say: "with higher expectations come real empowerment of internal audit!".

The objective of this post is to ask for internal auditors’ thoughts to these questions:

-         Do you believe stakeholders are asking too much of you?

-          Are you provided with adequate tools, resources, and support to meet the expectations?

-          Have you had the chance to discuss the expectations with your stakeholders?

If I receive enough responses, I will summarize them is a separate post for the benefit of those interested in the subject.

Please share your thought.

Educate your Internal Auditors While you Entertain Them!

Internal Auditors & Self-Destruction!

Do some internal auditors come equipped with self-destruction mechanism? Sadly, the answer to this question is yes! Recently, a member of my LinkedIn group “Internal Audit & Risk Management Consultants” Posted a discussion enquiring whether internal audit can answer an internal control questionnaire on areas other than internal audit such as HR and accounting.The discussion was very popular with many internal auditors offering their cliché answer:

“Internal Controls are the responsibility of management; Internal Audit should not complete the questionnaire.”

And of course, the justification for this answer was that completing the questionnaire impairs internal audit independence!Once again, some internal auditors try to hide behind independence and elect to do nothing and prove over and over again that internal audit can be stagnant and irrelevant!I was so frustrated with most of the comments to the point of saying in one of my updates:

“Comments posted on a discussion on my LinkedIn group confirmed that the worst enemy of internal audit is internal auditors themselves!

Assuming that answering the questionnaire impairs independence, internal auditors should not push the self-destruct button and stop at providing their cliché answer.They should recognize that their insight and experience are needed, and they should be creative in finding an alternative way to participate and add value!

Wishing you all a successful and happy new year!

My Thoughts is now on Amazon!

I have combined my internal audit posts from 2011 to 2016 in one document. It is now available at Amazon for only US $3.If you find my posts interesting, this document will be a useful tool to access the posts. It can be bought using the below link (Amazon Canada) or the Amazon webpage for your Country:

                                            https://www.amazon.ca/dp/B01N591VRA

Is There Such Thing as the "Future Auditor"?

The last issue of Protiviti's "The Bulletin" entitled "The Future Auditor Revisited ", discusses some of the characteristics of future auditors and how they can add more value and stay relevant. It builds on  the firm's 2014 vision of future auditors. It suggests that future internal auditors should:

• Focus More on Strategic Risks
• Think Beyond the Scope
• Add More Value Through Consulting
• Facilitate Effective, High Quality Communication 
• Elevate Stature and Perspective
• Align Stakeholder Expectation

The firm offered an example of 15 ways the future auditors can achieve the above and add value:

While I have no problem with the above, I am not sure why we are still talking about it as the "future" when it has been around for years! Should not this be the present and we start thinking beyond it to shape the future of internal audit. Are internal auditors stuck in their past that the future remains a moving target! Or to put it bluntly:Is there such thing as the future auditor?

These are my thoughts,please share yours!