Do Internal Auditors Have Expiration Date?

 

 What do you think?

Why did you become an Internal Auditor?

Many years ago, I have prepared a presentation for training purposes aimed at new and "would be" internal auditors. The presentation title was "So, you want to be an internal auditor!". It addresses the reasons why someone would want to be an internal auditor and if he/she have what it takes to be a successful one.
I am sharing it with you today although it needs to be updated.

https://www.linkedin.com/feed/update/urn:li:activity:7099449373981327360?utm_source=share&utm_medium=member_desktop

Are you getting the most from the ethics mandatory hours?

 Like many of you at this time of year, I have been looking to take the mandatory two hours of ethics training to comply with the IIA cpe  requirements. During the last few years, I attended webinars that did not interest me or added real value to my knowledge. So, this year I looked harder, and I was happy to find some really good free webinars that I have enjoyed attending. In fact, I found so many good webinars and I ended attending more than the required two hours.

One of the webinars was entitled "Why good people do bad things at work" by Andy Felo. The webinar is about the relationship between the "tone at the tope" and the "tune in the middle" and its impact on culture and ethical behavior within the Organization.

Another webinar was entitled "The seven deadly ethical sins of an organization" by Amanda Erven. I have found the definition and discussion of the seven sins engaging and I particularly liked the real-life examples she provided for each sin.

Another interesting webinar discussed an import issue which is bullying and bias in the workplace. The webinar is by Francine Griesing and its title is " Not just for school children: conquering bullying and bias in the workplace". This is such an important issue that should be in the radar of internal auditors.

One last example is a webinar that discussed ethics in this era of technological advancement. It is entitled "The ethical elements of Artificial Intelligence" by Katrina Ingram. This webinar provides a brief history of AI, ethical issues surrounding data, and discusses the principles of an AI ethical framework.   

I encourage you to choose your ethical webinars carefully and make the most out of it.

Takeaways from my recent readings

In this post, I am sharing some interesting takeaways from my recent readings. I will keep it very brief to enable you to go through it despite of your busy schedule! Of course, you can always download the original documents if you wish to learn more.

 Key Components of Digital Trust:

ISACA in a new free guide (Understanding the Six Key Components of Digital Trust| ISACA) defines digital trust as:

"Digital trust is confidence in the integrity of relationships among providers and consumers in a digital ecosystem."

The guide has identified six key components of the trust as follows:

• Quality of products and services
• Availability of information 24/7/365
• Security and Privacy
• Ethics and Integrity
• Transparency and honesty 
• Stability and Resilience

 Recession Playbook for Chief Audit Executives:

A Gartner 2022-2023 playbook identified the following 9 actions across three main areas that is believed to help in managing resources, being agile in securing talent, and accelerate digital and technological initiatives:

You can download the playbook by following this link:

Recession Playbook for Chief Audit Executives (gartner.com)

Turning Audit Clients into Allies

In its 2022 audit management playbook, AUDITBOARD offered some tips for turning audit clients into allies:

You can download a copy by following this link:

The Audit Management Playbook [2022 Updated] | AuditBoard

Do you have the "right to disconnect" outside business hours?

 A few days ago, the Province of Ontario in Canada introduced a right to disconnect law under which companies with 25 or more employees are required to establish policies that give employees the right to disconnect from business-related communications(including emails, messages, and phone & video calls, a ) outside regular business hours.

While the benefits and importance of the right to disconnect and its impact on the work/life balance and mental health wellness are not disputable, its implementation and success in practice are yet to be seen. 

Areas of consideration for internal audit

• Do you fully understand the spirit of the right to disconnect concept and are able to assess its effectiveness and implementation?
• Do you think it will limit your access to staff and information and impact your audit plan?
• Do you think it will increase your productivity?
• Would you plan to include it in your HR/culture audits?

If you work in a country that has already adopted the right to disconnect regulation, please share your experience.

picture source:Why You Should Respect Your Employees' Right to Disconnect | FlexJobs

Internal Audit's Role in Returning to Workplaces

 Last year, Richard Chambers in a blog post entitled "Returning to Workplaces Will Be Risky: Roll Up Your Sleeves, Internal Audit", offered examples of the questions Internal Audit should ask and get answers to from management regarding their plans to a safe return to the workplaces. These questions included:

• Has management adequately identified and assessed return-to-workplace related risks?
• Do proposed return-to-workplace policies and controls address the key risks?
• Are policies/controls effectively implemented (including communications)?

• Is the overall program functioning as intended, or are improvements warranted?

Obviously, the return to the workplace was not significant last year or during the first half of 2021. However, this may change significantly during the second half of the current year due to progress made in vaccination and the reopening plans around the world. I believe Internal Audit should focus its attention on the following issues:

• Reinforce & strengthen relationships: working remotely for an extended period of time under a climate of uncertainty and disruption may have affected  Internal Audit's relationships with its stakeholders. The CAE's priority, in my view, should be to reestablish timely contacts including in-person meetings with stakeholders as much as the safety and pandemic protocols permit. The stakeholders want to talk to Internal Audit as well as hearing from CAEs on their views, insight, and plans. A smart CAE will find the time to connect with his /her stakeholders and make the most out of the connection.
• Work closely with HR & Legal Departments to ensure there are proper anti-discrimination and conflict resolution plans: it will not be surprising, in the short term at least, that there will be employees resisting and challenging the organization's safety protocols such as wearing masks and physical distancing. There will be also others who did not get vaccinated for whatever reason. This may lead to conflict between the employees themselves and with management.  Internal Audit needs to ensure that there are practical and fair plans to deal with such situations.
• Encourage management to communicate the return policies and procedures before the return to the workplace: employees should not be surprised by the organization's procedures and protocols when they show up to work. They need to be aware in advance of what is waiting for them in the office and plan accordingly.
• Monitor and assess changes in corporate culture: whether we realize it or not,the pandemic and working remotely have changed people. The change could be in the mindset, the mental welness, priorities, perspective of life, and career plans. These changes can potentially influence the corporate culture. Internal Audit needs to work closely with HR and others to monitor trends and changes in culture to enable management to take timely actions to address the change.

I would love to hear from CAEs who have already returned to the workplace. Please share your experience and what challenges have you faced. What advice would you give to those who are about to return to their offices?

These are my thoughts, please share yours!

Picture credit:www.telljp.com

When Internal Audit Is Agile And The Audit Committee Is Not!

The traditional challenge for Internal Audit was in its ability to meet and/or exceed its stakeholders' growing expectations. While some Internal Audit functions may have suffered and failed to achieve this objective,  I would like to believe that most of the functions have been successful not only in meeting the expectations but also in taking the lead and initiative to introduce change and innovation and prove their relevance!

One of the buzzwords and trends nowadays is "agile internal auditing". Internal Audit functions around the world are working on understanding what it is about, exploring what it means to their operations and how to successfully implement it in their organizations. A successful implementation requires the buy-in and collaboration of stakeholders. You would think that management and the audit committees would be thrilled when Internal Audit starts the transformation process. That would be true in most cases, but sometimes there are forces within the Organization that resist change. When these forces are management, Internal Audit can seek the support of the audit committee to convince management. But, what if the audit committee is the resisting force? Imagine a situation where a CAE approaches the audit committee with  his/her plans to implement agile internal auditing and the answer he/she gets is:

• "This is a luxury we can't afford",
• "Stick with the audit plan, it works", 
• "This is not the time for a dramatic change", 
• "We don't have the resources and/or experience to do this", 
• " We will think about it",
• "What is agile internal auditing?"

Does this sound familiar? If you have heard any of the above responses, you are not alone! 

What comes to your mind when you hear such a response? You may conclude that Internal Audit did not do a good job communicating the concept and benefits of agile internal auditing to the audit committee. Perhaps they did not explain that it is more of a  mindset than a methodology, that it can be applied gradually, that it is not all or nothing approach or a one approach fits all solution. The reaction of the audit committee could indicate that there is a deeper disconnect with the audit committee! You may also conclude that the audit committee members don't possess the right mindset, vision, experience, or qualification to discharge their duties in these uncertain times! 

What will be your strategy to bridge the gap with the audit committee and initiate the transformation to agile internal auditing.? Please share your experience and thoughts. And remember to:

                                                               "be agile, be alive"!

Adapgility Consulting is your Internal Audit Partner and can help with the agility transformation process.

Picture source:www.hme-business.com