We get it, you are proud to be an Internal Auditor! But, what are you doing to promote the profession?

Each May, many Internal Auditors show their pride in their profession by posting the IIA's digital icon "Proud to be an internal auditor" all over the Internet. That is great! They have every right to be proud, but is this enough? What are they actually doing to promote the profession and raise awareness about it?

         "It is not enough to talk the talk, Internal Auditors need to walk the walk as well!"

The IIA publishes annual "awareness toolkits", which include tips and templates, to help guide internal auditors to celebrate the awareness month and spread the word about the value and role of internal audit. While the toolkits include useful practical suggestions, I have not seen statistics or evidence showing how and to what extent they are utilized!

This post is not intended to discuss how to promote the profession, as I believe this is a mental exercise that internal auditors need to arrive at by themselves! Just keep in mind that every internal auditor is an ambassador of the profession and his/her actions (or lack of) are what promote or hinder the profession.

There are no "one size fits all" tools that internal auditors can use around the world. Each internal audit activity needs to customize its own awareness campaign to fit the culture and business practices of its organization and country. For example, while producing "bumper stickers" could be a great idea in North America, it may not be a useful tool in other parts of the world! The local IIA chapters should spearhead the efforts to create local tools!

And because actions speak louder than words, the best promotional tool remains the value internal auditors add throughout the year!

         "Let your stakeholders be your greatest promotional tool, Let them celebrate you!"

Have a happy awareness month!

How Do Internal Auditors Gain Influence?

I have recently attended an IIA webinar "The Evolution of Internal Audit: Assure, Advise, & Anticipate" presented by Deloitte. The first part of the presentation had an interesting theme "Adapt or Disappear"! The message to internal audit was crystal clear: "do not be a dinosaur". The presentation offered the following action plan for internal audit to navigate from present to future:

While there is no surprises in the above four steps, the "gain influence" part caught my attention!

How do Internal Auditors Gain Influence?
In a document that bears the same title (Adapt or Disappear),Deloitte explains how influence is gained as follows:

"Strong leadership from the CAE, a compelling articulation and cultivation of an impactful role, including as a trusted advisor, will help raise the stature of internal audit and gain the CAE a seat at the table with other c-suite executives for greater influence and impact".

I would simplify this by providing my suggested  formula:

Courage + Vision + Charisma + Passion + Effective Communications + Relevant Audits + Practical Advice + Marketing Plan + Real Time learning!

I may also add "Translation" which is a term I borrowed from a Harvard Business Review article. It was explained as: "personally helping decision makers understand complex content".

Now, what is your strategy to gain influence? Please share your thoughts and experience.

The Big Question:Shall I Move from External to Internal Audit?

One of my LinkedIn connections  sent me the following message:

"Dear Wa'el
 hope everything is well. as I see that you are an internal auditor professional, so I would like to ask for you advise. I'm working for Big4 as an external auditor, and recently I have received an offer from international company for an internal auditor position and I am confused if I want to move on or to stay, so as you are an internal experience auditor what do you say? Thanks in advance"

I have replied as follows:
"Dear ....,
Thank you for contacting me. While I am not a career internal auditor (I provide internal audit consultation), I will attempt to address your question as objectively as I can!
1. I have started my professional life with Arthur Andersen in the Middle East and stayed there until I became a partner! Why? Because I loved and enjoyed what I was doing and secondly, my objective from day one was to make it to the partnership level.
 Now ask yourself these questions:
- When you wake up in the morning do you look forward to going to your office or working with   clients?
- Do you really enjoy what you are doing. Do you do it with passion, or is it only a job to you?
- Are your career objectives clear an do you know what you want to be in 10 years?
2. Internal audit comes with its own challenges and limitations! Unlike external audit, internal auditors gain deeper understanding of the business but at the same time their experience may be limited to their company or to the industry it is in! Many professionals join internal audit to gain experience and move out to operations at a later stage. For the fun of it, almost each new internal auditor I talked to in the past wanted to be the CEO of the company in the near future!
3.How the internal audit activity at the company is valued and treated should be a major factor in your decision to move there. Company culture and tone at the top is an essential indicator, so do your homework!
4.If there is no strong and courageous CAE (with a vision & mission) leading the internal audit activity, then the future does not look promising!
 At the end of the day, you are the only one who can take that decision. Take it without pressure and just follow your gut!
Good luck, and please keep me informed of your decision! "


What else would you add to my answer? Have you made the move from external to internal audit? If so, what was your experience?

These are my thoughts,please share yours!

Interesting Takeaways from the IIA - PwC Cybersecurity Session!

It is not a secret that I am not a big fan of the IIA Ottawa Chapter!



I usually avoid its IIAOttawa@Noon training events ,but today I have attended  the event because the topic is of high interest to me.The session was about "Trends in Cybersecurity and Privacy" and was based on PwC 's Global State of Information Security Survey 2016.The presentation was delivered by two PwC partners from the Toronto and Ottawa offices. The full survey is available at the PwC website, so I am not going to repeat any of its contents here, but rather would like to share some of the interesting points discussed during the session:

• Organized crime "as- a -service" is on the rise on the deep web! It is much easier to hire criminals online than ever before!
• Insiders and former insiders remain the biggest risk to cybersecurity and the focus of the cybersecurity experts.
Cybersecurity insurance is gaining momentum in the private sector ,the public sector is still to catch up!

• Cybersecurity and Privacy are business issues, internal auditors should avoid the technology trap when dealing with it.
• More organizations are monitoring the activities of their employees during and after working hours!
• Canada is slow in using the cloud due to fear of the "big brother" eyes!
• Canada is behind when it comes to cloud usage guidance. It did not issue official guidance similar to those issued by the US and the UK.
• Ontario.ca website ,that we Ontarians use to renew our driving licences and health cards,  is hosted by Amazon! The justification is that it provides the highest security  available in light of the daily 2-3  denial-of-service (DoS) attacks it receives.
• And finally compliance with cybersecurity frameworks does not necessary mean security is achieved! 

I must admit that I have enjoyed today's event and found it informative and relevant! I am glad I have attended .
The $20 I paid for parking fees was indeed a good investment!

Can Positive Illusions be the Survival Solution for the Unappreciated Internal Audit Activity?

Let’s imagine this hypothetical scenario:

“you are managing an internal audit activity and working really hard to make it a value-adding function to the organization. But yet, whatever you do go unnoticed and/or unappreciated by management and the Board”

What do you do in this situation?

Call it a quit and leave?
 Or
Hang on and keep trying to win the hearts and minds of management and hoping that one day your hard work will pay off?
 If you choose the second option, how would you be able to mentally and psychologically survive until you achieve your goal?
The answer, according to some psychologists, may be in adopting “positive illusions”!

What are Positive Illusions?

According to Wikipedia:
Positive illusions are a form of self-deception or self-enhancement that feel good, maintain self-esteem or stave off discomfort at least in the short term. There are three broad kinds:
- inflated assessment of one's own abilities,
- unrealistic optimism about the future,
- and an illusion of control.

If you were in the shoes of the internal audit leader in the above mentioned hypothetical situation, which option would you choose? Is there third or more options? Would you adopt positive illusions as a mechanism to survive or would you come with other techniques?

Please share your thoughts!

التدقيق الداخلي والمخاطر الجيوسياسية

 ان المتغيرات السياسية و الاقتصادية المتسارعة في المنطقة و ما ينتج عنها من عدم استقرار و عدم يقين

  تتطلب 

التعامل مع المخاطر الجيوسياسية بجدية اكثر من اي وقت مضى 

في مقالة نشرها معهد المدققين الداخليين في بريطانيا عام 2015,تمت الإشارة الى ان دراسة حديثة بينت بان 70 بالمائة من المدراء التنفيذين المشمولين بالدراسة ينظرون الى التوترات السياسية في العالم على انها تشكل خطرا على النمو الاقتصادي خلال فترة ال 12 شهرا التالية للدراسة وذلك بزيادة مقدارها 27 بالمائة منذ نهاية عام 2013.

ان نظرة واحدة على قائمة اهم مخاطر 2016 التي تصدرها مجموعة يوراسيا المتخصصة بتحليل المخاطر السياسية العالمية كفيلة بطرد النوم من اعين المدققين الداخليين ولجان التدقيق في الشرق الأوسط! كما ان نظرة أخرى على قائمة المخاطر لنفس العام الواردة ادناه والصادرة عن المنتدى الاقتصادي العالمي تبين أهم الاخطار الجيوسياسية على العالم:

بالمقابل فان تقرير معهد المدققين الداخليين الصادر في أذار من عام 2015 تحت مسمى "نبض التدقيق الداخلي" يشير الى ان 6 بالمائة فقط من الذين شملتهم الدراسة اعتبروا ان التطورات الجيوسياسية بما فيها المقاطعة الاقتصادية لها تأثير هام على خطة التدقيق بينما قال 40 بالمئة بأنهم لا يعيرون هذه التطورات اية أهمية! في الحقيقة فان هذه النتيجة مقلقة وقد اعتبرها التقرير ناتجة عن عدم قدرة التدقيق الداخلي على "توصيل النقاط". وانا اضيف الى ذلك عدم قدرة التدقيق الداخلي على استيعاب وفهم “الصورة الكبرى" وعدم فهم مكونات الاخطار الاستراتيجية!  

 ربما لم تكن المخاطر الجيوسياسية أولوية على اجندة وظائف التدقيق الداخلي في الشرق الاوسط في السنوات الماضية على الرغم من تاريخ المنطقة الحافل بالأزمات، وذلك يعود الى ان التدقيق الداخلي في تلك المرحلة كان يمر بعملية ولادة واثبات وجود بالإضافة الى جهوده المستمرة في تطوير نفسه. ولما كان التدقيق الداخلي قد قطع شوطا طويلا في تحقيق هذه الأهداف فهو مهيئ الان لان يقوم بدوره في فهم ومواجهة هذه المخاطر!

قبل القيام بأي دور على التدقيق الداخلي:

1.  ان يكون لديه الاطلاع الكافي على اهم التطورات السياسية والاقتصادية في بلده وفي دول الجوار وان يقوم بمتابعتها عن كثب ومن أكثر من مصدر واحد. على ان تكون هذه المصادر حيادية وذات مصداقية عالية وبعيدة عن الاجندات السياسية والاقتصادية الضيقة والخاصة.

2. ان يكون لديه الفهم العميق لتأثير المخاطر الجيوسياسية على المنشأة بشكل عام، وعلى مستوى العمليات الفردية. 

3. ان يلتزم الحياد التام والموضوعية والاستقلالية في جمع وتحليل المعلومات وتقدير المخاطر بعيدا عن المعتقدات السياسية الخاصة به. ان المدقق الداخلي ليس محللا سياسيا او اقتصاديا ولاحد يتوقع منه القيام بهذا الدور!

دور التدقيق الداخلي

دور المدقق الداخلي بالنسبة للمخاطر الجيوسياسية لا يختلف عن دوره في المخاطر الأخرى والتي يحكمها المعيار 2120,     والتي لا داعي لتكرارها هنا، الا من حيث ان طبيعة الاخطار الجيوسياسية تتطلب لباقة أكثر في عرضها ومناقشتها ومراقبة أعمق لها في الدول المصنفة بانها عالية المخاطر نظرا لان أثارها قد تكون كارثية على المنشأة. بشكل عام فان على التدقيق الداخلي ان يقوم بما يلي:

1.القيام بتقييم شامل ومستقل للمخاطر الجيوسياسية بالتعاون والتشاور مع الإدارة، لجنة التدقيق وإدارة المخاطر بهدف تحديد المخاطر الأكثر أهمية ودمجها في خطة التدقيق. والقيام بتعديل الخطة بناء على نتائج التقييم المستمر والمخاطر المستجدة. وهذا يتطلب ان يكون للتدقيق الداخلي القدرة على القيام بالتنبؤ بالمخاطر التي قد تستجد مستقبلا. 

2.التاكد من ان الادارة ولجنة التدقيق على دراية تامة بهذه المخاطر واثارها وأنها تقوم باتخاذ الإجراءات المناسبة للتعامل معها ومعالجتها في الوقت المناسب.

3.التاكد بان لجنة المخاطر تقوم بعملها بكل كفاءة وفعلية وأنها تقوم بتقديم المعلومات المناسبة والضرورية للإدارة بالوقت المناسب.  

4.التاكد من وجود خطط ملائمة "لاستمرارية العمل" و "التعافي من الكوارث" ومدى مطابقتها لاحتياجات المنشأة. كما يجب التأكد من ان هذه الخطط يتم تحديثها وتجربتها بشكل دوري.

5.التاكد من كفاية التامين لتغطية الاثار الناجمة عن مخاطر الحروب، الاعمال العدائية، الكوارث البيئية والطبيعية، هجرة المدنيين وانقطاع الدخل.

6.التاكد من قيام إدارة الموارد البشرية بأجراء "فحص الخلفية" لكافة الموظفين قبل التوظيف والحصول على الموافقات الأمنية اللازمة ومراقبة اية تصرفات تثير الشكوك والابلاغ عنها مباشرة للإدارة.

7.التاكد من قيام المنشأة بالامتثال للقوانين والتشريعات المتعلقة بغسل الاموال ومكافحة الإرهاب.

الخلاصة بان تقييم المخاطر الجيوسياسية ليس " ترفا فكريا" أو تعاطيا بالسياسة وانما هو جزء أساسي 

من مهمه المدقق الداخلي الناجح الذي يضيف قيمة للمنشـأة التي منحته ثقتها ! ا

Do You Have Enough Stress?

Last night, I was watching a rerun episode of  "The Big Bang Theory" show. In this episode, Sheldon concluded that he needs some "productive anxiety" in his life to boost his performance in order to solve a scientific issue he was having difficulties with. He explained his needs to his friends as follows:
"According to a classic psychological experiment by Yerkes and Dodson, in order to maximize performance, one must create a state of productive anxiety. So I’d like to ask you all to do something for me. Keep me on my toes. Just throw me off my game. Essentially, go out of your way to make my life miserable"

While the objective of the show is to make us laugh, the Yerkes and Dodson Law is real. To explain it in few words, I am borrowing the below paragraph from The ExaminedExistence website:
"The Yerkes-Dodson law states that performance increases with physiological or mental arousal (stress), but only up to a point. When the level of arousal (stress) becomes too high, performance decreases".

I guess internal auditors are lucky! They have access to endless sources of stress, at all levels, from all stakeholders! So, next time management or the audit committee gives you a hard time, convince yourself that this is a blessing in disguise. They are only trying to boost your performance!


The concept of productive anxiety resonates with me. I would like to think that my best performance is achieved when I am under pressure and stressed out! It simply stimulates my brain and forces me to leave my comfort zone!

Do you have enough stress? If not, create some "calculated" stress in your life!

These are my thoughts, please share yours!