Is There Such Thing as the "Future Auditor"?

The last issue of Protiviti's "The Bulletin" entitled "The Future Auditor Revisited ", discusses some of the characteristics of future auditors and how they can add more value and stay relevant. It builds on  the firm's 2014 vision of future auditors. It suggests that future internal auditors should:

• Focus More on Strategic Risks
• Think Beyond the Scope
• Add More Value Through Consulting
• Facilitate Effective, High Quality Communication 
• Elevate Stature and Perspective
• Align Stakeholder Expectation

The firm offered an example of 15 ways the future auditors can achieve the above and add value:

While I have no problem with the above, I am not sure why we are still talking about it as the "future" when it has been around for years! Should not this be the present and we start thinking beyond it to shape the future of internal audit. Are internal auditors stuck in their past that the future remains a moving target! Or to put it bluntly:Is there such thing as the future auditor?

These are my thoughts,please share yours!

  

Internal Audit is not Rocket Science,but it Still Needs to be Managed by Qualified Professionals!

A member of my LinkedIn group (Internal Audit & Risk Management Consultants) has posted a serious of discussions asking for help in understanding several  audit concepts and  techniques for the purpose of starting what sounds to be a new internal audit activity.The member does not seem to have previous internal audit experience (at least this is my impression from the questions raised).I am happy that many members have offered advice and guidance based on their experience and that the group, once again, has been utilized to add value to its members.But at the same time,I am troubled with the idea of tasking someone with no internal audit experience or qualification to start building an internal audit activity!Unfortunately,I come across similar situations too often! I am in no way trying to undermine the experience or qualification of this member, to the contrary I appreciate it when one asks for help when he/she needs it! I am simply trying to shed  light on this important issue!

Would you ask a civil engineer  to perform an open heart surgery? Of course not, regardless of how  good  this engineer is at what he/she does (engineering)! Why do companies ask people with no internal audit backgrounds to start an internal audit activity? It could be one or more of the following reasons:

• Lack of understanding of what internal audit is about and what qualifications are needed to do the job.
• Lack of appreciation of the importance of internal audit on the basis that it is not a rocket science, anybody can do it!
• The desire to save money by not hiring qualified auditors and trying to utilize existing resources regardless of their experiences.
• The person tasked with starting the internal audit activity is very much trusted by management and their is a  belief that he/she can handle the assignment regardless of experience!
• Sometimes someone with no prior internal audit experience will volunteer to set up shop and convinces  management that he/she can handle it!

I do not believe it is fair to any person to be put in such a situation regardless of the circumstances. The consequences to the company and other stakeholders as a result of this practice may be serious! It could simply be that the internal audit activity is doomed to fail before it set sail!

My advice to any person in similar situation is to have an honest and open discussion with management and explain what he/she can or can not do.Asking colleagues/contacts for help is fine,but sometimes outside professional help through hiring or other venues will be needed and should be done with management's  knowledge and approval!

Let's remember what standard 1210 stipulates:

"Proficiency: Internal auditors must possess the knowledge, skills, and other competencies needed to perform their individual responsibilities. The internal audit activity collectively must possess or obtain the knowledge, skills, and other competencies needed to perform its responsibilities."

Can you imagine the consequences of  this situation especially when the entire internal audit activity consists of that single person with no internal audit experience!

These are my thoughts, please share yours!

The Cost of Bad Internal Audit Activities!

The cost of not having an internal audit activity is relatively well recognized and understood by most corporations and investors. However, the cost of having a bad one may not be so obvious and understood by some!

But, what is the definition of bad as it relates to this post? I am sure the first thing that jumps to your mind is the “value adding” theme! Others may add “inefficient”, “ineffective”, “irrelevant”, "weak”, “stagnant” and “stress creating” to the list! The list can go on and on depending on who is providing the input!

Regardless of the definition, the cost of having a “bad” internal audit activity may include:

- Damage to the reputation of the Internal Audit profession as a whole!

- Damage to the credibility of management and the Audit Committee at the concerned organization.

- Loss of the public and investors’ trust in the organization.

- Management not getting relevant and timely information to help make  the right decisions. Or worse, getting wrong information resulting in major problems! 

- Management and other stakeholders getting false sense of security.

- Major risks go unidentified, undetected or underestimated.

- Waste of time, resources and money!

- Loss of opportunity for real improvement of operations.

- Distraction and loss of focus on real issues.

- Disruption of business and processes.

- Negative impact on other assurance and compliance functions.

Sadly,the above is not a comprehensive list! Can you suggest more items to it?

 You may have noticed that some of the costs listed above are also applicable to situations where internal audit activities do not exist at all! Based on that and If you have to choose between having a bad internal audit activity (on the basis that something is better than nothing!) or not having one at all, which would be your choice?

The first step in “fixing” a bad internal audit activity is by admitting that there is a problem, then having the courage to seek help!

These are my thoughts,please share yours!

التدقيق الداخلي بين تقييم الأداء و الجمهور عايز كده

يؤمن البعض بان المقياس الحقيقي لإداء ادارة التدقيق الداخلي و ما تضيفه من قيمة على المؤسسة هو في مدى رضا أصحاب الشأن أو المصلحة (Stakeholders ) عن هذا الأداء على قاعدة أن القيمة هي في عين الناظر (value is in the eye of the beholder).والناظر هنا بالطبع هم أصحاب المصلحة!

أوافق على هذه المقولة، بل و اشجع عليها إن تحققت الأمور التالية:

• وجود إدارة و لجنة تدقيق على ادراك كامل بما يتوجب على التدقيق الداخلي إنجازه بحسب معايير التدقيق الداخلي وافضل الممارسات المهنية ( best practices) حتى تتمكن من تقديم تقييم موضوعي و عادل.
• ومن البديهي القول بضرورة وجود أهداف محددة و واضحة و عقلانية تسعى الإدارة إلى تحقيقها.
• وجود النية الحقيقية عند أصحاب المصلحة في وجود إدارة تدقيق داخلي قوية و مؤثرة ،وليس مجرد وجود شكلي يتم المبالغة في الثناء عليه لغرض في نفس يعقوب! 
• القيام بواجبات التدقيق الداخلي بكل حيادية وموضوعية وجراءة بهدف إضافة قيمة حقيقية، لا لمجرد  التقرب من أو إرضاء رغبات أصحاب المصلحة باي شكل من الأشكال. إن ارضاء الادارة العليا و لجنة الإدارة يجب أن لا يكون هدفا بحد ذاته بل نتيجة طبيعية يتم التوصل إليها  عندما يقوم التدقيق الداخلي باداء مهامه بحرفية و مسؤولية و أمانة.   

إن لم تتوفر الأمور السابقة الذكر فان تقييم الأداء لن يزيد عن كونه عملية عقيمة على طريقة "الجمهور عايز كده" !!

وخير الكلام ما قل و دل!

هل هو "تدقيق داخلي" ام "مراجعة داخلية"؟ دعونا نتفق على المصطلحات

في الأيام القليلة الماضية كان لي تغريدات تتعلق بالترجمة العربية لبعض المصطلحات المهنية واهمها الترجمة للمصطلح :

 

"Internal Audit"

وعلى الرغم أن الأمر يبدو في ظاهره على انه خلاف شكلي إلا انه يستحق منا أن نبذل الجهد المهني الكافي لتوحيد ترجمة المصطلحات المهنية حرصا على تطوير الخطاب العربي المهني ولإزالة الالتباس والخلط الذي يصاحب استعمال اكتر من ترجمة ,فهناك  على سبيل المثال فرق كبير بين التدقيق و المراجعة  (في مجال التدقيق الخارجي على الاقل)  من حيث الهدف ونطاق العمل.

ومن الجدير بالذكر بان معهد المدققين الداخليين (IIA)  يعتمد "التدقيق الداخلي" في منشوراته باللغة العربية.

ومع التطور المستمر لمهنة التدقيق الداخلي في الوطن العربي فإنني أوجه النداء إلى معاهد و جمعيات التدقيق الداخلي و المراجعة الداخلية إلى تشكيل لجنة تنسيق موحدة لتحقيق هذا الهدف  للرقي بهذه المهنة إلى اعلى المستويات.

أتمنى أن يحصل هذا و أن نكون متحدين على المستوى المهني على الأقل!  

    

The State of Internal Audit in the GCC Region!

The Saudi Institute of Internal Auditors and the UAE Internal Audit Association have recently issued a research report discussing the state of internal audit in the Gulf Cooperation Council (GCC) Region.

The report was based on a survey that included 918 internal auditors across the region (Saudi Arabia, UAE, Kuwait, Qatar, Bahrain and Oman).

The key findings of the report are as follows:

• Positioning of the Internal Audit Activity

The survey results show that the majority (77%) of the IA activities in the region functionally  report to the Audit Committee or board. When it comes to administrative reporting 64% of the activities surveyed report to the CEO or equivalent position.                 

• Role of the Internal Audit Activity

Only one third of the surveyed respondents indicated that the three lines of defense model is defined and understood in their organizations.

The assurance services are the dominant value adding services with consulting services on the rise. 

• Internal Audit Focus Areas

only 50% of the respondents indicated that their IA activities are aligned with the strategic plans of their organizations. Operational risks seem to be the focus of most of the activities in the region.

• Processes and Operations

Formal internal audit strategic plans are not present in many of the surveyed activities. Only small number of activities adopt a flexible audit plans although the majority update their audit plans at least annually.

only 57% of IA activities follow all of the IIA standards with the quality assurance standard being the least complied with.

•  Skills and Resources Management

Accounting skills remain the most sought after skills when recruiting internal auditors.

54% of internal auditors and 40% of CAEs  in the region do not posses any internal audit certification.

• Leading Practices and trends

Internal audit activities in the region seem to be behind when it comes to combined assurance, performance audit and auditing ethics and cultures.

• Managing Expectations & Demonstrating Performance

Most of the IA activities do not use formal KPIs. Traditional performance  measurement techniques such as number/percentage of audits completed are in use.

While the results of the survey did not include any significant surprises, it is obvious that despite of the advancement of the profession in the GCC region, there are still many opportunities for improvement .

The report provided an excellent source of information for management, audit committees ,CAEs and independent internal audit consultants ,like myself, to focus their efforts on the right direction!

I would certainly love to see similar reports for the rest of the Middle East countries!

We get it, you are proud to be an Internal Auditor! But, what are you doing to promote the profession?

Each May, many Internal Auditors show their pride in their profession by posting the IIA's digital icon "Proud to be an internal auditor" all over the Internet. That is great! They have every right to be proud, but is this enough? What are they actually doing to promote the profession and raise awareness about it?

         "It is not enough to talk the talk, Internal Auditors need to walk the walk as well!"

The IIA publishes annual "awareness toolkits", which include tips and templates, to help guide internal auditors to celebrate the awareness month and spread the word about the value and role of internal audit. While the toolkits include useful practical suggestions, I have not seen statistics or evidence showing how and to what extent they are utilized!

This post is not intended to discuss how to promote the profession, as I believe this is a mental exercise that internal auditors need to arrive at by themselves! Just keep in mind that every internal auditor is an ambassador of the profession and his/her actions (or lack of) are what promote or hinder the profession.

There are no "one size fits all" tools that internal auditors can use around the world. Each internal audit activity needs to customize its own awareness campaign to fit the culture and business practices of its organization and country. For example, while producing "bumper stickers" could be a great idea in North America, it may not be a useful tool in other parts of the world! The local IIA chapters should spearhead the efforts to create local tools!

And because actions speak louder than words, the best promotional tool remains the value internal auditors add throughout the year!

         "Let your stakeholders be your greatest promotional tool, Let them celebrate you!"

Have a happy awareness month!