Monday, April 4, 2016

Can Positive Illusions be the Survival Solution for the Unappreciated Internal Audit Activity?


Let’s imagine this hypothetical scenario:
“you are managing an internal audit activity and working really hard to make it a value-adding function to the organization. But yet, whatever you do go unnoticed and/or unappreciated by management and the Board”

What do you do in this situation?
Call it a quit and leave?
 Or
Hang on and keep trying to win the hearts and minds of management and hoping that one day your hard work will pay off?
 If you choose the second option, how would you be able to mentally and psychologically survive until you achieve your goal?
The answer, according to some psychologists, may be in adopting “positive illusions”!

What are Positive Illusions?
According to Wikipedia:
Positive illusions are a form of self-deception or self-enhancement that feel good, maintain self-esteem or stave off discomfort at least in the short term. There are three broad kinds:
- inflated assessment of one's own abilities,
- unrealistic optimism about the future,
- and an illusion of control.

If you were in the shoes of the internal audit leader in the above mentioned hypothetical situation, which option would you choose? Is there third or more options? Would you adopt positive illusions as a mechanism to survive or would you come with other techniques?

Please share your thoughts!




Thursday, March 3, 2016

التدقيق الداخلي والمخاطر الجيوسياسية

 ان المتغيرات السياسية و الاقتصادية المتسارعة في المنطقة و ما ينتج عنها من عدم استقرار و عدم يقين
  تتطلب 
التعامل مع المخاطر الجيوسياسية بجدية اكثر من اي وقت مضى 

في مقالة نشرها معهد المدققين الداخليين في بريطانيا عام 2015,تمت الإشارة الى ان دراسة حديثة بينت بان 70 بالمائة من المدراء التنفيذين المشمولين بالدراسة ينظرون الى التوترات السياسية في العالم على انها تشكل خطرا على النمو الاقتصادي خلال فترة ال 12 شهرا التالية للدراسة وذلك بزيادة مقدارها 27 بالمائة منذ نهاية عام 2013.

ان نظرة واحدة على قائمة اهم مخاطر 2016 التي تصدرها مجموعة يوراسيا المتخصصة بتحليل المخاطر السياسية العالمية كفيلة بطرد النوم من اعين المدققين الداخليين ولجان التدقيق في الشرق الأوسط! كما ان نظرة أخرى على قائمة المخاطر لنفس العام الواردة ادناه والصادرة عن المنتدى الاقتصادي العالمي تبين أهم الاخطار الجيوسياسية على العالم:



بالمقابل فان تقرير معهد المدققين الداخليين الصادر في أذار من عام 2015 تحت مسمى "نبض التدقيق الداخلي" يشير الى ان 6 بالمائة فقط من الذين شملتهم الدراسة اعتبروا ان التطورات الجيوسياسية بما فيها المقاطعة الاقتصادية لها تأثير هام على خطة التدقيق بينما قال 40 بالمئة بأنهم لا يعيرون هذه التطورات اية أهمية! في الحقيقة فان هذه النتيجة مقلقة وقد اعتبرها التقرير ناتجة عن عدم قدرة التدقيق الداخلي على "توصيل النقاط". وانا اضيف الى ذلك عدم قدرة التدقيق الداخلي على استيعاب وفهم “الصورة الكبرى" وعدم فهم مكونات الاخطار الاستراتيجية!  
 ربما لم تكن المخاطر الجيوسياسية أولوية على اجندة وظائف التدقيق الداخلي في الشرق الاوسط في السنوات الماضية على الرغم من تاريخ المنطقة الحافل بالأزمات، وذلك يعود الى ان التدقيق الداخلي في تلك المرحلة كان يمر بعملية ولادة واثبات وجود بالإضافة الى جهوده المستمرة في تطوير نفسه. ولما كان التدقيق الداخلي قد قطع شوطا طويلا في تحقيق هذه الأهداف فهو مهيئ الان لان يقوم بدوره في فهم ومواجهة هذه المخاطر!


قبل القيام بأي دور على التدقيق الداخلي:
1.  ان يكون لديه الاطلاع الكافي على اهم التطورات السياسية والاقتصادية في بلده وفي دول الجوار وان يقوم بمتابعتها عن كثب ومن أكثر من مصدر واحد. على ان تكون هذه المصادر حيادية وذات مصداقية عالية وبعيدة عن الاجندات السياسية والاقتصادية الضيقة والخاصة.
2. ان يكون لديه الفهم العميق لتأثير المخاطر الجيوسياسية على المنشأة بشكل عام، وعلى مستوى العمليات الفردية. 
3. ان يلتزم الحياد التام والموضوعية والاستقلالية في جمع وتحليل المعلومات وتقدير المخاطر بعيدا عن المعتقدات السياسية الخاصة به. ان المدقق الداخلي ليس محللا سياسيا او اقتصاديا ولاحد يتوقع منه القيام بهذا الدور!

دور التدقيق الداخلي
دور المدقق الداخلي بالنسبة للمخاطر الجيوسياسية لا يختلف عن دوره في المخاطر الأخرى والتي يحكمها المعيار 2120,     والتي لا داعي لتكرارها هنا، الا من حيث ان طبيعة الاخطار الجيوسياسية تتطلب لباقة أكثر في عرضها ومناقشتها ومراقبة أعمق لها في الدول المصنفة بانها عالية المخاطر نظرا لان أثارها قد تكون كارثية على المنشأة. بشكل عام فان على التدقيق الداخلي ان يقوم بما يلي:
1.القيام بتقييم شامل ومستقل للمخاطر الجيوسياسية بالتعاون والتشاور مع الإدارة، لجنة التدقيق وإدارة المخاطر بهدف تحديد المخاطر الأكثر أهمية ودمجها في خطة التدقيق. والقيام بتعديل الخطة بناء على نتائج التقييم المستمر والمخاطر المستجدة. وهذا يتطلب ان يكون للتدقيق الداخلي القدرة على القيام بالتنبؤ بالمخاطر التي قد تستجد مستقبلا. 
2.التاكد من ان الادارة ولجنة التدقيق على دراية تامة بهذه المخاطر واثارها وأنها تقوم باتخاذ الإجراءات المناسبة للتعامل معها ومعالجتها في الوقت المناسب.
3.التاكد بان لجنة المخاطر تقوم بعملها بكل كفاءة وفعلية وأنها تقوم بتقديم المعلومات المناسبة والضرورية للإدارة بالوقت المناسب.  
4.التاكد من وجود خطط ملائمة "لاستمرارية العمل" و "التعافي من الكوارث" ومدى مطابقتها لاحتياجات المنشأة. كما يجب التأكد من ان هذه الخطط يتم تحديثها وتجربتها بشكل دوري.
5.التاكد من كفاية التامين لتغطية الاثار الناجمة عن مخاطر الحروب، الاعمال العدائية، الكوارث البيئية والطبيعية، هجرة المدنيين وانقطاع الدخل.
6.التاكد من قيام إدارة الموارد البشرية بأجراء "فحص الخلفية" لكافة الموظفين قبل التوظيف والحصول على الموافقات الأمنية اللازمة ومراقبة اية تصرفات تثير الشكوك والابلاغ عنها مباشرة للإدارة.
7.التاكد من قيام المنشأة بالامتثال للقوانين والتشريعات المتعلقة بغسل الاموال ومكافحة الإرهاب.

الخلاصة بان تقييم المخاطر الجيوسياسية ليس " ترفا فكريا" أو تعاطيا بالسياسة وانما هو جزء أساسي 
من مهمه المدقق الداخلي الناجح الذي يضيف قيمة للمنشـأة التي منحته ثقتها ! ا

Sunday, February 7, 2016

Do You Have Enough Stress?



Last night, I was watching a rerun episode of  "The Big Bang Theory" show. In this episode, Sheldon concluded that he needs some "productive anxiety" in his life to boost his performance in order to solve a scientific issue he was having difficulties with. He explained his needs to his friends as follows:
"According to a classic psychological experiment by Yerkes and Dodson, in order to maximize performance, one must create a state of productive anxiety. So I’d like to ask you all to do something for me. Keep me on my toes. Just throw me off my game. Essentially, go out of your way to make my life miserable"
While the objective of the show is to make us laugh, the Yerkes and Dodson Law is real. To explain it in few words, I am borrowing the below paragraph from The ExaminedExistence website:
"The Yerkes-Dodson law states that performance increases with physiological or mental arousal (stress), but only up to a point. When the level of arousal (stress) becomes too high, performance decreases".

I guess internal auditors are lucky! They have access to endless sources of stress, at all levels, from all stakeholders! So, next time management or the audit committee gives you a hard time, convince yourself that this is a blessing in disguise. They are only trying to boost your performance!


The concept of productive anxiety resonates with me. I would like to think that my best performance is achieved when I am under pressure and stressed out! It simply stimulates my brain and forces me to leave my comfort zone!

Do you have enough stress? If not, create some "calculated" stress in your life!

These are my thoughts, please share yours!
















Sunday, January 31, 2016

Please God, let Him Not be an Internal Auditor!


A visitor to my company’s website (www.bibiconsulting.net) has sent me the following message:  “send to me all publications”

 

He was referring to a section in the website where I offer visitors to send them a PDF copy of my blog posts. My first reaction was “wow”! I do not see “hello”,” please” or “thank you”! My second reaction was a prayer “Please God, let him not be an internal auditor”!

 

Before I proceed with this post, I should show some manners and thank the visitor for inspiring this post!

 

Can you imagine what would be the reaction of a customer if an internal auditor communicates with him/her in this way! This type of manners will not only reflect on the auditor alone, but on the internal audit activity as a whole, on its reputation and on its efforts to market itself as a professional value adding party!

 

Good manners, in general, and good communications manners, in particular, are part of the “must have” soft skills for internal auditors! I call on CAEs to take a hard look at their auditors’ communication manners and offer guidance and training when needed.

 

Bottom line is “Manners still matter”!

These are my thoughts, please share yours!

 

 

 

 

Sunday, December 27, 2015

2016 Internal Audit Horoscope!

 

Following my annual tradition, here is your 2016 horoscope!

Word of caution: it is provided for entertainment purposes only, so don't rely on it and certainly don’t be offended by it! Having said that, it does contain “between the lines” messages to internal auditors!

 

       January:                 OMG, you made it to the new year! You are still an internal auditor!

    February:              There is a cybersecurity breach in your future! Stay calm, IT Audit will step in  and solve it for you!

    March:                   Get serious, CIA does not stand for “Clown in Action”! Although this one can be achieved without an exam! A better meaning for it would be “Competence, Integrity & Availability”

     April:                     Don’t worry, your seat at the table is reserved ...at McDonald’s!

     May:                     This is your month! Celebrate as never before, management will understand!

     June:                    There is a promotion in your future. You may finally be promoted to your dream 2nd LoD position!

     July:                    Yes, you are the eyes and ears of management, but avoid sticking your nose in their business!

     August:               Your reputation is at risk! Watch out what you do on social media! Particular attention should be given to LinkedIn!

     September:        “Auditors can be audited” is not a myth! Watch your back and keep your business in order!

     October:             Just because you are now calling Auditees "customers", does not mean that the customer is always right!

     November:        The year is almost over and you have not audited company culture! What are you waiting for?

     December:        If you still can’t explain what you do to a 10-year-old, it is time to move on and pursue another career!

   On a serious note, I wish you and your families a happy, healthy and prosperous new year!
 

Tuesday, December 1, 2015

Should IT Audit Report to the CAE?


The ISACA/Protiviti fifth annual IT Audit Benchmarking Survey in the third quarter of 2015 was released today. While I have not had the chance to read the full 48-page report, a quick scan focused my attention on one area of the survey. It relates to the relationship between IT Audit and Internal Audit. The heading for it is:

                             “IT Audit in Relation to the Internal Audit Department”

The survey starts by stating that there has been no significant change in the relationship over the years. It says that many companies still have established reporting structure for IT audit that are less than optimal. It continues to say that having the IT Audit Director report to the CAE or equivalent is best practice.

Interesting statistics from the survey:

58% of the surveyed companies have an IT Audit Director or equivalent position.

91% of the surveyed Oceania companies have an ideal reporting structure (reporting to the CAE or a director under him/her) for the IT Audit director.

The break down for the rest of the world is as follows:

Africa  63%

Asia    86%

Europe  70%

Latin/South America  79%

Middle East 79%

North America 79%

Oceania 91%

How is the IT Audit structured in your company and to whom it reports?

Do you agree that IT Audit should report to the CAE?

Few years ago I wrote a short but wild blog post asking for the merger of the IIA and ISACA, I still stand by this crazy idea!

These are my thoughts, please share yours!

When Management Says: is this what internal auditors do?

If you have heard your management saying “is this what internal auditors do?”, chances are it was meant as a compliment not a complaint! It means that you, the internal auditor, has said or done something that took management by surprise and exceeded what is expected from a traditional internal auditor!
If you have not heard that question /statement yet, you better start wondering why!

How do you get there?
It takes someone with an open mind, courage, flexibility and very high level of curiosity to get there! In particular, you need to:

Think outside the box, but stay inside it!
The concept of “think outside the box” while widely accepted as a unique way of providing solutions, is also criticized by some as being flawed! In an 2014 Forbes article, Dileep Rao questioned the meaning of this widely used cliché and asked who defined the box .What I find interesting in the article is how he talked about the imaginary box and the real one! He said:

“The imaginary box is one that you have imposed on yourself. This box can be based on your assumptions. The real box is more difficult to define, but it is there. It can be based on what your market is willing to accept, or on the strategy you have selected, or on your capabilities.
MY TAKE: There is always a real box that you should stay inside of. The laws of physics still apply. But this real box can change with new trends and technologies. Yesterday’s real box is usually different from today’s real box. The key is to be able to separate today’s real box from the imaginary one. Yes, by all means think outside the imaginary box that imposes artificial constraints on your achievements. But stay inside the real box that is defined by your market and your capacity to satisfy your customers – if you want to win.”

For me, thinking outside the box means leaving your comfort zone, being creative, learning new things and being curious. It does not mean going stray!

Not limiting yourself
Nothing kills a profession like the self-imposed and imaginary limitations! There is no limitation on thinking, applying common sense, imagining and day dreaming!
Keep in mind that the IPPF is not a fence that limits the internal audit process, it is rather its cornerstone! So, build on it and always try to improve it. The IIA cited that the development of the standards is an ongoing process, so be part of it.

You can free yourself from your imposed limitations and turn them into abilities by unleashing these powers within you:

                                Imagination +day dreaming+ curiosity +courage

Never underestimate the power of imagination and day dreaming! Never underestimate your capabilities! Challenge yourself every day, you won’t be disappointed!

Richard Bach once said:

                                      “Argue for your limitations, and sure enough they're yours.”


Utilize your special status
Internal auditors enjoy a very unique status! They combine the characteristics of insiders and outsiders. They are insiders because they are employees of the company and possess thorough understanding of its operations. They are at the same time outsiders in the sense that they are independent and are not involved in the management process.
This gives internal audit the opportunity to take an independent, fresh and holistic look at the operations from both an outsider and insider perspective.

 Release your thoughts
If you have a thought that could improve operations and/or minimize risk, research it and share it! Don’t keep it in the back of your mind. Act on it even if it sounds wild! Don’t be shy to ask for advice and help in exploring and developing your thoughts.

This quote from  Stephen Richards explains what thoughts are about:

                     “Reality is a projection of your thoughts or the things you habitually think about.” 

 

These are my thoughts, please share yours!

Extreme Tail Risk vs. Black Swan Event

  When Canadian Prime Minister Mark Carney recently described the possibility of U.S. military action against Canada as an "extreme tai...