Soft Controls:The human angle of an audit!‎

I have recently attended an IIA webinar about Coordinating Risk Management and Assurance. One of ‎the poll questions was as follows:
‎
Soft controls are easier to audit:
‎
‎– True
‎– False
‎– Depends on circumstances

Almost two-thirds of the respondents choose “false” while the other third choose “it depends”.‎
Soft controls in the above-mentioned webinar were characterized as controls that” Tells you what’s ‎really inside the people”.
‎
‎ Having determined the difficulty of auditing soft controls, my question is as follows: Are internal ‎auditors really trained to audit soft controls? Do we need some basic training in human behavior and ‎psychology?

Please share your thoughts and experience.‎

Picture credit:https://executivefinance.nl/

Can a CAE become a CFO ?

I am always asked if a CAE can make the move to operations and become a CFO. My short answer is ‎‎“yes” and my detailed answer is “it depends”.‎

My” yes” answer assumes that the CAE has the experience, educations, and mindset that enables ‎him/her to function as a CFO. I strongly believe that you cannot audit what you do not understand; ‎accordingly, any successful CAE should have a good understanding of the CFO function.‎

My “it depends “answer refers to the fact that CFO roles may be influenced by the complexity and ‎nature of operations of the organization. I believe that there is no “CFO” fits all type of thing. Each ‎organization has specific requirements for its CFO experience and education. An organization going ‎through an IPO, for example, would require a different type of CFO than a small or not for profit ‎organization.‎

I would love to hear from CAEs who made it to the CFO position. Please share your experience, ‎recommendations and lessons learned during this process.‎

Reputational Risk or Risks to Reputation?

My Reputational risk article is published.It can be viewed here:

http://bibiconsulting.homestead.com/riskarticle.html

Please let me know what you think.

IT Security and the Average Person

Last week, I was visiting a healthcare provider and was impressed with the software he was using to provide his services .I asked him when was the last time he backed up the data and patient files on his computer, I was shocked when he said "never". I asked him what will happen to his practice if his 3 year old laptop suddenly collapsed and the data can't be retrieved from the hard disk. He simply shock his head .I did not leave him that day until an external hard drive was bought and all his data were backed up.

This is only one example of too many cases that people face every day .How many of you can access unprotected Wi-Fi networks at home or work? How many of you know of people who do not have antivirus software installed on their computers? Or who do not use passwords to protect their computers of mobile phones?

This lack of basic IT security knowledge is not limited to the older generation of technology users, but can be seen at all age categories.

Spreading basic IT knowledge and awareness is an important step in living in a safer world. If every one of us can help those we know to reach a minimum level of IT security awareness, we will contribute to living in a world of less spam, identity theft and other risks.

I know that this takes time and effort, but it is worth it!

Do internal auditors need accounting designations?‎

Despite the important progress made in recognizing the value of the CIA designation and other internal audit-related certifications, I am still surprised that many companies (at least in Canada) are still requiring an accounting designation for their internal audit vacancies. The accounting designation is always “a must-have”, while the CIA is “a plus or nice to have”.

The question is: do internal auditors really need an accounting designation? The market seems to suggest that!! In my opinion, The CIA should be “a must-have” and the accounting designation “ a plus or nice to have”. What do you think?

Picture credit:https://bibf.com

Is it A Liquidity Trap?‎

I am not an economist or pretend to understand how the markets work. I am a simple person who invested in equities and mutual funds directly and through financial advisors and ended up losing a lot of money under both scenarios. I start my morning watching business programs on CNN, Bloomberg, CNBC and BNN to try to understand what’s going on in the financial markets .All what I hear these days is explanations  of why the financial markets are plummeting. There is no shortage of excuses!! I honestly do not understand why stock prices are falling when most companies are doing well and full of cash!

Today, I heard one of the commentators (I think on CNN) saying that we can blame what is happening on the “liquidity trap”! He said that individuals have money but not spending it because they want companies to hire people. On the other hand, companies have money, but won’t hire people unless they start buying their goods and services. He did not offer any solution on how to break this deadlock!

My solution is to switch off the TV and forget all about my investment for a couple of years!!

What is Wrong with Corporate Canada ?

With the news of problems facing RIM and its intention to cut 2,000 jobs worldwide ,due to declining sales, I am reminded that Canadian success stories may not be as successful as we think .Yesterday it was Nortel and today it is RIM, and who knows who it will be tomorrow ! What is happening in Corporate Canada? Is it merely the conditions of the markets that are leading to these results? or lack of leadership? My guess is that it is the latter! Look at the co –CEO structure at RIM as an example! Another RIM example would be its new Playbook that does not have G3 connection! It only connects to the internet through Wi-Fi! I did not expect this from a company that manufactures one of the best smart phones in the world!How would they be able to compete with Apple with a product like this?