The Cost of Bad Internal Audit Activities!

The cost of not having an internal audit activity is relatively well recognized and understood by most corporations and investors. However, the cost of having a bad one may not be so obvious and understood by some!

But, what is the definition of bad as it relates to this post? I am sure the first thing that jumps to your mind is the “value adding” theme! Others may add “inefficient”, “ineffective”, “irrelevant”, "weak”, “stagnant” and “stress creating” to the list! The list can go on and on depending on who is providing the input!

Regardless of the definition, the cost of having a “bad” internal audit activity may include:

- Damage to the reputation of the Internal Audit profession as a whole!

- Damage to the credibility of management and the Audit Committee at the concerned organization.

- Loss of the public and investors’ trust in the organization.

- Management not getting relevant and timely information to help make  the right decisions. Or worse, getting wrong information resulting in major problems! 

- Management and other stakeholders getting false sense of security.

- Major risks go unidentified, undetected or underestimated.

- Waste of time, resources and money!

- Loss of opportunity for real improvement of operations.

- Distraction and loss of focus on real issues.

- Disruption of business and processes.

- Negative impact on other assurance and compliance functions.

Sadly,the above is not a comprehensive list! Can you suggest more items to it?

 You may have noticed that some of the costs listed above are also applicable to situations where internal audit activities do not exist at all! Based on that and If you have to choose between having a bad internal audit activity (on the basis that something is better than nothing!) or not having one at all, which would be your choice?

The first step in “fixing” a bad internal audit activity is by admitting that there is a problem, then having the courage to seek help!

These are my thoughts,please share yours!

التدقيق الداخلي بين تقييم الأداء و الجمهور عايز كده

يؤمن البعض بان المقياس الحقيقي لإداء ادارة التدقيق الداخلي و ما تضيفه من قيمة على المؤسسة هو في مدى رضا أصحاب الشأن أو المصلحة (Stakeholders ) عن هذا الأداء على قاعدة أن القيمة هي في عين الناظر (value is in the eye of the beholder).والناظر هنا بالطبع هم أصحاب المصلحة!

أوافق على هذه المقولة، بل و اشجع عليها إن تحققت الأمور التالية:

• وجود إدارة و لجنة تدقيق على ادراك كامل بما يتوجب على التدقيق الداخلي إنجازه بحسب معايير التدقيق الداخلي وافضل الممارسات المهنية ( best practices) حتى تتمكن من تقديم تقييم موضوعي و عادل.
• ومن البديهي القول بضرورة وجود أهداف محددة و واضحة و عقلانية تسعى الإدارة إلى تحقيقها.
• وجود النية الحقيقية عند أصحاب المصلحة في وجود إدارة تدقيق داخلي قوية و مؤثرة ،وليس مجرد وجود شكلي يتم المبالغة في الثناء عليه لغرض في نفس يعقوب! 
• القيام بواجبات التدقيق الداخلي بكل حيادية وموضوعية وجراءة بهدف إضافة قيمة حقيقية، لا لمجرد  التقرب من أو إرضاء رغبات أصحاب المصلحة باي شكل من الأشكال. إن ارضاء الادارة العليا و لجنة الإدارة يجب أن لا يكون هدفا بحد ذاته بل نتيجة طبيعية يتم التوصل إليها  عندما يقوم التدقيق الداخلي باداء مهامه بحرفية و مسؤولية و أمانة.   

إن لم تتوفر الأمور السابقة الذكر فان تقييم الأداء لن يزيد عن كونه عملية عقيمة على طريقة "الجمهور عايز كده" !!

وخير الكلام ما قل و دل!

هل هو "تدقيق داخلي" ام "مراجعة داخلية"؟ دعونا نتفق على المصطلحات

في الأيام القليلة الماضية كان لي تغريدات تتعلق بالترجمة العربية لبعض المصطلحات المهنية واهمها الترجمة للمصطلح :

 

"Internal Audit"

وعلى الرغم أن الأمر يبدو في ظاهره على انه خلاف شكلي إلا انه يستحق منا أن نبذل الجهد المهني الكافي لتوحيد ترجمة المصطلحات المهنية حرصا على تطوير الخطاب العربي المهني ولإزالة الالتباس والخلط الذي يصاحب استعمال اكتر من ترجمة ,فهناك  على سبيل المثال فرق كبير بين التدقيق و المراجعة  (في مجال التدقيق الخارجي على الاقل)  من حيث الهدف ونطاق العمل.

ومن الجدير بالذكر بان معهد المدققين الداخليين (IIA)  يعتمد "التدقيق الداخلي" في منشوراته باللغة العربية.

ومع التطور المستمر لمهنة التدقيق الداخلي في الوطن العربي فإنني أوجه النداء إلى معاهد و جمعيات التدقيق الداخلي و المراجعة الداخلية إلى تشكيل لجنة تنسيق موحدة لتحقيق هذا الهدف  للرقي بهذه المهنة إلى اعلى المستويات.

أتمنى أن يحصل هذا و أن نكون متحدين على المستوى المهني على الأقل!  

    

The State of Internal Audit in the GCC Region!

The Saudi Institute of Internal Auditors and the UAE Internal Audit Association have recently issued a research report discussing the state of internal audit in the Gulf Cooperation Council (GCC) Region.

The report was based on a survey that included 918 internal auditors across the region (Saudi Arabia, UAE, Kuwait, Qatar, Bahrain and Oman).

The key findings of the report are as follows:

• Positioning of the Internal Audit Activity

The survey results show that the majority (77%) of the IA activities in the region functionally  report to the Audit Committee or board. When it comes to administrative reporting 64% of the activities surveyed report to the CEO or equivalent position.                 

• Role of the Internal Audit Activity

Only one third of the surveyed respondents indicated that the three lines of defense model is defined and understood in their organizations.

The assurance services are the dominant value adding services with consulting services on the rise. 

• Internal Audit Focus Areas

only 50% of the respondents indicated that their IA activities are aligned with the strategic plans of their organizations. Operational risks seem to be the focus of most of the activities in the region.

• Processes and Operations

Formal internal audit strategic plans are not present in many of the surveyed activities. Only small number of activities adopt a flexible audit plans although the majority update their audit plans at least annually.

only 57% of IA activities follow all of the IIA standards with the quality assurance standard being the least complied with.

•  Skills and Resources Management

Accounting skills remain the most sought after skills when recruiting internal auditors.

54% of internal auditors and 40% of CAEs  in the region do not posses any internal audit certification.

• Leading Practices and trends

Internal audit activities in the region seem to be behind when it comes to combined assurance, performance audit and auditing ethics and cultures.

• Managing Expectations & Demonstrating Performance

Most of the IA activities do not use formal KPIs. Traditional performance  measurement techniques such as number/percentage of audits completed are in use.

While the results of the survey did not include any significant surprises, it is obvious that despite of the advancement of the profession in the GCC region, there are still many opportunities for improvement .

The report provided an excellent source of information for management, audit committees ,CAEs and independent internal audit consultants ,like myself, to focus their efforts on the right direction!

I would certainly love to see similar reports for the rest of the Middle East countries!

We get it, you are proud to be an Internal Auditor! But, what are you doing to promote the profession?

Each May, many Internal Auditors show their pride in their profession by posting the IIA's digital icon "Proud to be an internal auditor" all over the Internet. That is great! They have every right to be proud, but is this enough? What are they actually doing to promote the profession and raise awareness about it?

         "It is not enough to talk the talk, Internal Auditors need to walk the walk as well!"

The IIA publishes annual "awareness toolkits", which include tips and templates, to help guide internal auditors to celebrate the awareness month and spread the word about the value and role of internal audit. While the toolkits include useful practical suggestions, I have not seen statistics or evidence showing how and to what extent they are utilized!

This post is not intended to discuss how to promote the profession, as I believe this is a mental exercise that internal auditors need to arrive at by themselves! Just keep in mind that every internal auditor is an ambassador of the profession and his/her actions (or lack of) are what promote or hinder the profession.

There are no "one size fits all" tools that internal auditors can use around the world. Each internal audit activity needs to customize its own awareness campaign to fit the culture and business practices of its organization and country. For example, while producing "bumper stickers" could be a great idea in North America, it may not be a useful tool in other parts of the world! The local IIA chapters should spearhead the efforts to create local tools!

And because actions speak louder than words, the best promotional tool remains the value internal auditors add throughout the year!

         "Let your stakeholders be your greatest promotional tool, Let them celebrate you!"

Have a happy awareness month!

How Do Internal Auditors Gain Influence?

I have recently attended an IIA webinar "The Evolution of Internal Audit: Assure, Advise, & Anticipate" presented by Deloitte. The first part of the presentation had an interesting theme "Adapt or Disappear"! The message to internal audit was crystal clear: "do not be a dinosaur". The presentation offered the following action plan for internal audit to navigate from present to future:

While there is no surprises in the above four steps, the "gain influence" part caught my attention!

How do Internal Auditors Gain Influence?
In a document that bears the same title (Adapt or Disappear),Deloitte explains how influence is gained as follows:

"Strong leadership from the CAE, a compelling articulation and cultivation of an impactful role, including as a trusted advisor, will help raise the stature of internal audit and gain the CAE a seat at the table with other c-suite executives for greater influence and impact".

I would simplify this by providing my suggested  formula:

Courage + Vision + Charisma + Passion + Effective Communications + Relevant Audits + Practical Advice + Marketing Plan + Real Time learning!

I may also add "Translation" which is a term I borrowed from a Harvard Business Review article. It was explained as: "personally helping decision makers understand complex content".

Now, what is your strategy to gain influence? Please share your thoughts and experience.

The Big Question:Shall I Move from External to Internal Audit?

One of my LinkedIn connections  sent me the following message:

"Dear Wa'el
 hope everything is well. as I see that you are an internal auditor professional, so I would like to ask for you advise. I'm working for Big4 as an external auditor, and recently I have received an offer from international company for an internal auditor position and I am confused if I want to move on or to stay, so as you are an internal experience auditor what do you say? Thanks in advance"

I have replied as follows:
"Dear ....,
Thank you for contacting me. While I am not a career internal auditor (I provide internal audit consultation), I will attempt to address your question as objectively as I can!
1. I have started my professional life with Arthur Andersen in the Middle East and stayed there until I became a partner! Why? Because I loved and enjoyed what I was doing and secondly, my objective from day one was to make it to the partnership level.
 Now ask yourself these questions:
- When you wake up in the morning do you look forward to going to your office or working with   clients?
- Do you really enjoy what you are doing. Do you do it with passion, or is it only a job to you?
- Are your career objectives clear an do you know what you want to be in 10 years?
2. Internal audit comes with its own challenges and limitations! Unlike external audit, internal auditors gain deeper understanding of the business but at the same time their experience may be limited to their company or to the industry it is in! Many professionals join internal audit to gain experience and move out to operations at a later stage. For the fun of it, almost each new internal auditor I talked to in the past wanted to be the CEO of the company in the near future!
3.How the internal audit activity at the company is valued and treated should be a major factor in your decision to move there. Company culture and tone at the top is an essential indicator, so do your homework!
4.If there is no strong and courageous CAE (with a vision & mission) leading the internal audit activity, then the future does not look promising!
 At the end of the day, you are the only one who can take that decision. Take it without pressure and just follow your gut!
Good luck, and please keep me informed of your decision! "


What else would you add to my answer? Have you made the move from external to internal audit? If so, what was your experience?

These are my thoughts,please share yours!