Internal Audit Month

 May is Internal Audit Month, a time to celebrate and promote the vital role of internal auditors worldwide. This year, the Institute of Internal Auditors (IIA) is making it a global initiative, encouraging participation from 117 National Institutes and 144 North American Chapters.

How to Get Involved:
1. Join the Global Celebration – On May 2, 2025, share unified social media posts using the hashtags hashtag#OneIIA and hashtag#InternalAuditMonth.
2. Promote the Profession – Use your platforms to highlight the value of internal auditing and share your own experiences.
3. Engage with Your Network – Respond to comments and discussions to keep the conversation going.

Internal auditors play a crucial role in ensuring organizations run efficiently, manage risks, and uphold governance standards. This month is all about recognizing their contributions and raising awareness.
hashtag#OneIIA and hashtag#InternalAuditMonth hashtag#iia hashtag#internalauditors hashtag#auditcommittee hashtag#cae hashtag#celebration

Are You Ready for the New Global Internal Audit Standards?

 With the Global Internal Audit Standards set to take effect on January 9, 2025, it is crucial that the audit committee is well-prepared and familiar with these standards. To assist with this, we have created a brief presentation designed to equip audit committee members with essential information.

Reach out to us to schedule an in-person or remote presentation.

Is Climate Change a Greater Risk in the Middle East than Geopolitical Risks?

 Is climate change a greater risk in the Middle East than geopolitical risks in the next three years? According to the 179 respondents to the IIA Foundation's "2025 Risk in Focus—Middle East" survey, it seems so!

Geopolitical risk in the Middle East is real and should definitely be among the top five risks on the list of emerging risks. Anyone who disagrees is out of touch with reality!"

CAEs in the region often avoid addressing what could appear to be politically sensitive issues, which is understandable given the context. However, CAEs, in our opinion, must give more serious attention to the impact of geopolitical risks on their region and organizations.

Takeaways from my 2023 ethics CPEs

 As you are aware, licensed CIA's are required to take at least two hours of training in the field of ethics. I have just completed mine and I would like to share with you some takeaways:

1. Becoming the everyday ethicist:

This session was presented by Amanda Erven. The one technique I liked about how to achieve this objective is by developing your own personal value statement and code of self-conduct! It is a great idea. I encourage internal auditors to adopt this important step towards becoming an everyday ethicist.

2. Exploring workplace honesty and ethical gray areas:

This session was presented by Christian Miller. I liked his discussion regarding the differences between an honest person and someone who exhibits honest behavior as shown below.

Finally, I came across a white paper by IIA Australia entitled "Why people do not accurately disclose their conflicts of interest". Here is a paragraph from it:

"There are three significant ways in which people withhold information about conflicts of interest:

1. People do not disclose conflicts of interest
2. People only partially disclose conflicts of interest
3. People give misleading disclosures that result in information being hidden

These are referred to in this White Paper as the sides of the ‘Conflict of Interest Bermuda Triangle’. Examining the reasons people do not make full disclosures of conflicts of interest will help us improve disclosure systems and internal controls over conflicts of interest."

Please share your takeaways from your ethics training with the group so we can raise awareness of the importance of ethics in our lives.

Internal Audit has a role to play when it comes to mental health!

 

Internal Audit has a role to play when it comes to mental health! It starts with ensuring that its own staff are enjoying good mental health.

Internal Audit can play a vital role in helping the organization promote and improve mental wellness and provide assurance on the effectiveness of the organization's policies and practices and provide insight that can help improve them.

More details are discussed is an older post:

My Thoughts: Internal Audit and Mental Health! (waelbibi.blogspot.com)

Do Internal Auditors Have Expiration Date?

 

 What do you think?

Why did you become an Internal Auditor?

Many years ago, I have prepared a presentation for training purposes aimed at new and "would be" internal auditors. The presentation title was "So, you want to be an internal auditor!". It addresses the reasons why someone would want to be an internal auditor and if he/she have what it takes to be a successful one.
I am sharing it with you today although it needs to be updated.

https://www.linkedin.com/feed/update/urn:li:activity:7099449373981327360?utm_source=share&utm_medium=member_desktop

Takeaways from my recent readings

In this post, I am sharing some interesting takeaways from my recent readings. I will keep it very brief to enable you to go through it despite of your busy schedule! Of course, you can always download the original documents if you wish to learn more.

 Key Components of Digital Trust:

ISACA in a new free guide (Understanding the Six Key Components of Digital Trust| ISACA) defines digital trust as:

"Digital trust is confidence in the integrity of relationships among providers and consumers in a digital ecosystem."

The guide has identified six key components of the trust as follows:

• Quality of products and services
• Availability of information 24/7/365
• Security and Privacy
• Ethics and Integrity
• Transparency and honesty 
• Stability and Resilience

 Recession Playbook for Chief Audit Executives:

A Gartner 2022-2023 playbook identified the following 9 actions across three main areas that is believed to help in managing resources, being agile in securing talent, and accelerate digital and technological initiatives:

You can download the playbook by following this link:

Recession Playbook for Chief Audit Executives (gartner.com)

Turning Audit Clients into Allies

In its 2022 audit management playbook, AUDITBOARD offered some tips for turning audit clients into allies:

You can download a copy by following this link:

The Audit Management Playbook [2022 Updated] | AuditBoard

Do you have the "right to disconnect" outside business hours?

 A few days ago, the Province of Ontario in Canada introduced a right to disconnect law under which companies with 25 or more employees are required to establish policies that give employees the right to disconnect from business-related communications(including emails, messages, and phone & video calls, a ) outside regular business hours.

While the benefits and importance of the right to disconnect and its impact on the work/life balance and mental health wellness are not disputable, its implementation and success in practice are yet to be seen. 

Areas of consideration for internal audit

• Do you fully understand the spirit of the right to disconnect concept and are able to assess its effectiveness and implementation?
• Do you think it will limit your access to staff and information and impact your audit plan?
• Do you think it will increase your productivity?
• Would you plan to include it in your HR/culture audits?

If you work in a country that has already adopted the right to disconnect regulation, please share your experience.

picture source:Why You Should Respect Your Employees' Right to Disconnect | FlexJobs

Internal Audit's Role in Returning to Workplaces

 Last year, Richard Chambers in a blog post entitled "Returning to Workplaces Will Be Risky: Roll Up Your Sleeves, Internal Audit", offered examples of the questions Internal Audit should ask and get answers to from management regarding their plans to a safe return to the workplaces. These questions included:

• Has management adequately identified and assessed return-to-workplace related risks?
• Do proposed return-to-workplace policies and controls address the key risks?
• Are policies/controls effectively implemented (including communications)?

• Is the overall program functioning as intended, or are improvements warranted?

Obviously, the return to the workplace was not significant last year or during the first half of 2021. However, this may change significantly during the second half of the current year due to progress made in vaccination and the reopening plans around the world. I believe Internal Audit should focus its attention on the following issues:

• Reinforce & strengthen relationships: working remotely for an extended period of time under a climate of uncertainty and disruption may have affected  Internal Audit's relationships with its stakeholders. The CAE's priority, in my view, should be to reestablish timely contacts including in-person meetings with stakeholders as much as the safety and pandemic protocols permit. The stakeholders want to talk to Internal Audit as well as hearing from CAEs on their views, insight, and plans. A smart CAE will find the time to connect with his /her stakeholders and make the most out of the connection.
• Work closely with HR & Legal Departments to ensure there are proper anti-discrimination and conflict resolution plans: it will not be surprising, in the short term at least, that there will be employees resisting and challenging the organization's safety protocols such as wearing masks and physical distancing. There will be also others who did not get vaccinated for whatever reason. This may lead to conflict between the employees themselves and with management.  Internal Audit needs to ensure that there are practical and fair plans to deal with such situations.
• Encourage management to communicate the return policies and procedures before the return to the workplace: employees should not be surprised by the organization's procedures and protocols when they show up to work. They need to be aware in advance of what is waiting for them in the office and plan accordingly.
• Monitor and assess changes in corporate culture: whether we realize it or not,the pandemic and working remotely have changed people. The change could be in the mindset, the mental welness, priorities, perspective of life, and career plans. These changes can potentially influence the corporate culture. Internal Audit needs to work closely with HR and others to monitor trends and changes in culture to enable management to take timely actions to address the change.

I would love to hear from CAEs who have already returned to the workplace. Please share your experience and what challenges have you faced. What advice would you give to those who are about to return to their offices?

These are my thoughts, please share yours!

Picture credit:www.telljp.com

When Internal Audit Is Agile And The Audit Committee Is Not!

The traditional challenge for Internal Audit was in its ability to meet and/or exceed its stakeholders' growing expectations. While some Internal Audit functions may have suffered and failed to achieve this objective,  I would like to believe that most of the functions have been successful not only in meeting the expectations but also in taking the lead and initiative to introduce change and innovation and prove their relevance!

One of the buzzwords and trends nowadays is "agile internal auditing". Internal Audit functions around the world are working on understanding what it is about, exploring what it means to their operations and how to successfully implement it in their organizations. A successful implementation requires the buy-in and collaboration of stakeholders. You would think that management and the audit committees would be thrilled when Internal Audit starts the transformation process. That would be true in most cases, but sometimes there are forces within the Organization that resist change. When these forces are management, Internal Audit can seek the support of the audit committee to convince management. But, what if the audit committee is the resisting force? Imagine a situation where a CAE approaches the audit committee with  his/her plans to implement agile internal auditing and the answer he/she gets is:

• "This is a luxury we can't afford",
• "Stick with the audit plan, it works", 
• "This is not the time for a dramatic change", 
• "We don't have the resources and/or experience to do this", 
• " We will think about it",
• "What is agile internal auditing?"

Does this sound familiar? If you have heard any of the above responses, you are not alone! 

What comes to your mind when you hear such a response? You may conclude that Internal Audit did not do a good job communicating the concept and benefits of agile internal auditing to the audit committee. Perhaps they did not explain that it is more of a  mindset than a methodology, that it can be applied gradually, that it is not all or nothing approach or a one approach fits all solution. The reaction of the audit committee could indicate that there is a deeper disconnect with the audit committee! You may also conclude that the audit committee members don't possess the right mindset, vision, experience, or qualification to discharge their duties in these uncertain times! 

What will be your strategy to bridge the gap with the audit committee and initiate the transformation to agile internal auditing.? Please share your experience and thoughts. And remember to:

                                                               "be agile, be alive"!

Adapgility Consulting is your Internal Audit Partner and can help with the agility transformation process.

Picture source:www.hme-business.com

What Does It Mean to Be Ready And Relevant?

There is a common consensus that Internal Auditors need to be ready and relevant to succeed and thrive in the current disruptive times and to be ready for what comes next in the highly unpredictable future. Last August, I wrote a post entitled " Has Your Internal Audit Function Tested Positive For The Irrelevance Virus" in which I offered internal auditors some basic suggestions on how to get vaccinated against the irrelevance virus including:

• working on their mindset
• keeping an up-to-date understanding of the company's objectives and business
• understanding the stakeholders perspective on value internal audit can add
• transforming to agile auditing
• understanding the true essence of the internal audit independence concept
• communicating what matters in real-time
• utilization of available technology to its fullest potential
• taking a tablespoon of the "courage syrup" three times a day! 

You can read the full post by clicking on the link above.

Recently, I have attended a webinar sponsored by Workivia. The webinar took the form of a live discussion with Tim Berichon the author of the book " Ready and Relevant - Prepare to Audit What Matters Most ". While I have not read the book yet, I thought the discussion with Tim offered a good summary of his thoughts. The key takeaways from the webinar, at least as I understood it, are as follows:

• Stakeholders want to see internal audit become relevant and they now see how internal audit can perform
• Internal audit leaders have stepped up and taken their independence hat off and not allowed that to be a barrier or stopping them from being most relevant
• Relevance is about survival at the internal audit level and the business level
• The top barrier to agility and innovation was the internal audit team's resistance to change. Internal auditors need to look in the mirror and ensure they have the right mindset and the commitment to that mindset
• Get in the middle of the ERM fan! Internal audit leaders can own the risk management programs
• Automate everything you can. Free up internal auditors, they can not add value unless they can use their brains
• Automation can not replace soft skills yet
• Artificial Intelligence as it starts to be  more affordable may creep into the internal auditors' world in the future
• Tell your stockholders something they do not know, If you tell them what they know, you are irrelevant.
• Internal audit will never be irrelevant if it helps management meet its objectives
• Drop the word added from the phrase"value-added".Everything internal audit does should be a value, it does not need to be added to anything
• Set aside a certain percentage of internal audit time for management request and flexibility

I encourage you to watch the entire webinar, it is available on-demand and can be accessed by clicking on the title of the webinar as shown above.

After reading the above, do you think you know what being "ready and relevant" really means? How do you define it and communicate it to your stakeholders? What do you do to achieve the "ready and relevant goal? Let's start a dialogue and share experiences. 

picture credit:www.ieltsg.com