Oklahoma City IIA Presentation How to Optimize your IA function December 13, 2012 Agenda 1 IA current role and environment ► The role of IA is evolving ► Current environment: insights and trends 2 Issues/Challenges ► Challenges of balancing cost, risk and value ► Top 10 issues 3 Ernst & Young’s point of view ► Our point of view ► Our internal audit framework ► Our approach ► How to transform your IA department into a business advisor Page 1 © Ernst & Young LLP 2012. All rights reserved. Confidential & Proprietary Subject to Contract. Section 1 IA current role and environment The role of internal audit is evolving IA departments are facing challenges today that have altered their expectations, strained their resources, and caused a paradigm shift in their processes. Expectations from the IA function have been driven especially by audit committees, executive management, and stakeholder demands for stronger corporate governance and transparency. New focus and capabilities have emerged over time in reaction to important regulatory developments. The global financial crisis has had a major impact on stakeholder expectation as to what constitutes sound corporate governance and risk management. Clearer accountabilities are impacting directors, accounting officers and risk/assurance functions. Professionalism/ globalization late 90s – early 00s ► Wide variety of purpose i.e. (advisory versus assurance) ► Adoption of common standards for risk-based auditing Late 1990s Page 3 Post-SOX re-orientation mid 00s to 2008 The SOX effect early – mid 00s ► Financial control and process domination ► Limited investment in audit development ► ► Broader risk focus Investing and retooling core IA skills 2005 © Ernst & Young LLP 2012. All rights reserved. Confidential & Proprietary Subject to Contract. 2008 Financial crisis and beyond 2008 – 20XX ► Enabling business improvement while: ► Assurance is still paramount ► Addressing potential failures 20XX Current environment: insights 75% of companies believe strong risk management has a positive impact on their long-term earnings performance. 75% of companies believe that their IA function has a positive impact on their overall risk management efforts. Yet, 80% of companies recognize that their IA function has room for improvement – that it is not “leading class” today. And, 83% of companies have been asked to improve the risk coverage that IA provides. 80% of organizations believe there is a need to improve their IA function. Of these organizations, 80% of believe they should make improvements within the next 24 months. The top five priorities for IA functions today are: 1. Improving the risk assessment process 2. Enhancing the ability to monitor emerging risks 3. Becoming more relevant to achieving the organization’s business objectives 4. Reducing overall IA function costs without compromising risk coverage 5. Identifying opportunities for cost savings in our business Organizations are striving to make their risk functions 35% more coordinated than they are today. Source – Ernst &Young Risk Survey conducted in December 2011 and January 2012 with Global Audit Committee Members, CAEs, CEOs and CFOs Page 4 © Ernst & Young LLP 2012. All rights reserved. Confidential & Proprietary Subject to Contract. 80% surveyed believe cosourcing is a viable business option for their IA department. Current environment: trends in execution IA risk assessment, regulatory requirements and enterprise risk assessment, in order of importance, remain the top three drivers of the IA plan. IA plan focus Companies’ IA plans are focused both in Information Technology (IT) and business, with particular emphasis on operational risks. 15% 19% 14% IA is playing an increasing role in organizational issues, including: ► 21% ► 13% ► ► Major capital projects (49%) IT systems implementations (42%) Mergers and acquisitions (37%) Material contracts (32%) While still struggling to have a defined role in: 18% ► ► Compliance IT Regulatory Financial Operational Strategic ► Major construction projects (25%) New market entry (21%) New product roll-out (17%) Technology remains critical with 48% claiming IT security and privacy risk assessments are top priorities. Evolving trends require a different approach in thought, skills and execution Source – Ernst &Young Risk Survey conducted in December 2011 and January 2012 with Global Audit Committee Members, CAEs, CEOs , COOs and CFOs of Global 1000 Page 5 © Ernst & Young LLP 2012. All rights reserved. Confidential & Proprietary Subject to Contract. Section 2 Issues/Challenges Challenges of balancing cost, risk and value IA departments struggle with the balancing act of reducing costs but increasing value to the company, all while maintaining the appropriate risk coverage. Cost Risk Value Examples of factors that influence the balance level: industry challenges ► economic issues ► Page 7 government regulations ► stakeholder requirements ► © Ernst & Young LLP 2012. All rights reserved. Confidential & Proprietary Subject to Contract. Top 10: issues top of mind for chief audit executives (CAEs) Plan Execute and evaluate Enablers 1 IA strategy: develop an IA-specific strategy document 2 Assurance and advisory: determine the appropriate mix for the audit plan 3 Thematic audits: structure portion of the plan around overarching themes 4 Issue-based audits: create a playbook of relevant reviews to address specific business issues, leveraging subject-matter resources 5 Audit plan refresh: re-evaluate frequency of audit plan adjustments and formality 6 Risk coordination: coordinate with other risk and oversight functions for optimal coverage 7 Innovation: employ innovative audit techniques (e.g., data analytics, continuous monitoring, integrated audits) to drive efficiency and results 8 Value charter and scorecard: track and monitor success of the IA function and share 9 Organizational structure: align to business structure and risk profile for optimal coverage 10 Competency and talent management: assess required and existing competencies for the IA team to use IA function as a talent pipeline; develop roadmap to close gaps Source – Ernst &Young Future of Internal Audit Page 8 © Ernst & Young LLP 2012. All rights reserved. Confidential & Proprietary Subject to Contract. Assurance and advisory: reevaluate the IA mandate and stakeholder expectations to create the optimal balance Assurance Control and compliance monitoring structure IA function focused on evaluating the design and the effectiveness of internal controls in those areas outlined in their charter or mandate. Also includes focusing on compliance with key regulations and policies Mandate of IA Advisory Business insight In addition to covering the “basics,” the IA function is designed to provide highquality, relevant business insight as an integral part of its activities. Business insight is not a by-product, but an explicit outcome from the function’s activities. Non-negotiable Strategic and valued advisor The IA function serves as a subject-matter specialist to business management around strategic initiatives, challenges and changes in the organization. The function has the people, knowledge and experiences to effectively provide this level of service. Emerging trend 90% of those surveyed are trending towards advisory reviews, comprising more than 25% of the audit plan and in general are trending upwards. Page 9 © Ernst & Young LLP 2012. All rights reserved. Confidential & Proprietary Subject to Contract. Issue-based audits: continually demonstrate IA’s value and relevance by providing insight on strategic business issues ► Merger, acquisitions and/or divestitures ► Major construction projects ► Material contracts ► IT systems implementations ► New market entry ► New product launch ► Material capital projects Issued-based audits are top of mind for CAEs as IA struggles to balance cost, risk and value Page 10 © Ernst & Young LLP 2012. All rights reserved. Confidential & Proprietary Subject to Contract. Innovation: seek opportunities to leverage innovative techniques while executing audit plan Cost Risk Value Integrated audits Data analytics Continuous monitoring Integrate across teams for greater impact Employ technology for greater coverage and insight Implement continuous monitoring approach for processes, risks and controls CAEs are challenged with innovation due to lack of technology, skills and execution throughout the audit life cycle Page 11 © Ernst & Young LLP 2012. All rights reserved. Confidential & Proprietary Subject to Contract. Section 3 Ernst & Young’s point of view Our point of view: an internal audit function must drive strategic value to the organization As the economy continues to be unpredictive and volatile and emerging markets become more relevant, executives continue to challenge their risk management processes. They are looking for an IA function that is efficient and effective that operates and interacts with the business – one that drives strategic value for the business and its key stakeholders while fully aligning with the company’s current needs and supporting those strategies to move the company forward. Our point of view is referenced below: Looking beyond processes and controls, IA is in a strategic position within the organization to provide: ► key insights that enable the business to focus on the risks that matter, ► identification of enterprise-wide cost efficiencies, and ► strategic insights that improve business performance. IA’s scope aligns with the strategic direction of the organization and enables the organization to operate at a level that improves preformance and achieve strategic objectives. This kind of support reaps multiple benefits for the organization, including increased shareholder value, improved credit ratings and enhanced ability to attract capital. Given that 83% of corporate leaders will be pushing for enhancement to their audit function in the next two years or less*, IA has the opportunity to be more agile in driving competitive value across the enterprise. * Source – Ernst &Young Risk Survey conducted in December 2011 and January 2012 with Global Audit Committee Members, CAEs, CEOs and CFOs Page 13 © Ernst & Young LLP 2012. All rights reserved. Confidential & Proprietary Subject to Contract. Leading strategic internal audit function attributes Our point of view Outcome performance measurements Tailoring of audit responses allows for adaptable assurance needs Business intelligence and technology underpins all IA work Quality, independence, objectivity fully embedded in IA work Global people model with wide range of competencies Value score card monitors IA performance Page 14 Stakeholder driven activities around EGRC (enterprise, governance, risk and compliance) Risk assessments aligned to organizational strategy and refreshed at least quarterly Focus on organizational impact and consistency with EGRC Sustainable improvements to enable business objectives deemed imperative Leading Class IA department Flexible audit plans that adapt to changing significant risk areas, not lower risk focus Relevancy and timeliness: focus on significant areas without exception; monitor low risk © Ernst & Young LLP 2012. All rights reserved. Confidential & Proprietary Subject to Contract. Full integration in overall governance strucutre, leveraging group wide best practices Our internal audit framework Page 15 © Ernst & Young LLP 2012. All rights reserved. Confidential & Proprietary Subject to Contract. Internal audit framework explained Some common focus areas that we are seeing make a difference at multiple organizations supported by EY’s IA framework: ► IA strategy ► Align with business on IA’s strategy, vision and mandate ► Coordinate with other risk/oversight functions for optimal coverage ► Core delivery methodology ► Reevaluate risk assessment and audit plan refresh processes ► Re-engineer audit responses to risk ► Incorporate thematic audits and end-to-end process audits into audit plan ► Determine the appropriate mix of assurance and advisory effort ► Perform issue-based audits, leveraging subject matter resources ► Refresh IA reporting to board, management and auditees ► People model ► Align IA organizational structure to business structure and risk profile for optimal coverage ► Revamp talent management processes (e.g., competency and rotation models, training, resourcing) ► Support processes ► Track key performance indicators on a value scorecard to demonstrate value to key stakeholders ► Increase efficiency of audit process and transparency of data through a strong technology platform ► Consider IA branding and revitalize stakeholder engagement ► Enterprise intelligence ► Employ innovative techniques (e.g., behavior analysis, data analytics, continuous monitoring) to drive efficiency and results Page 16 © Ernst & Young LLP 2012. All rights reserved. Confidential & Proprietary Subject to Contract. EY’s IA framework …aligning to the organization’s strategy through each step of the audit cycle Core delivery methodology Develop an IA strategy Establish engagement protocols Develop IA strategy, mandate, & charter Conduct audit needs assessment Develop audit plan Map key risks to risk functions, create combined assurance coverage map Execute Communicate results Measurable impact Execute the audit plan using innovative techniques & analytics throughout Facilitate accelerated solutions development workshop Communicate results IA stakeholders Track measurable value through an IA value scorecard Establish protocols (e.g. audit management office) Create IA annual plan based on the Audit Response Continuum Page 17 © Ernst & Young LLP 2012. All rights reserved. Confidential & Proprietary Subject to Contract. The optimal internal audit operating approach leads to a world class internal audit Added value to your audit process Insightful data analytics capability Globally consistent approach Leading Class IA Function Streamlined delivery costs Technology enablement IIA standards compliant Page 18 © Ernst & Young LLP 2012. All rights reserved. Confidential & Proprietary Subject to Contract. Our approach ARC – Audit Response Continuum framework ARC is a robust IA planning process. ► Audit approach selection is explicitly based on: ► ► ► ► The complexity and nature of the risk and controls being audited The objectives of the organization and the degree of assurance required Skills determined through roundtable planning meetings Provides for: ► ► ► ► ► Page 19 A more sophisticated and broad approach to planning and delivering IA engagements Clearer alternatives in selecting the most appropriate response Explicit audit planning decision-making Better language in discussions with the stakeholder/auditee More transparent reporting of effort Audit response category ‘Standard’ audits Risk and control framework reviews ‘Complex’ audits Education © Ernst & Young LLP 2012. All rights reserved. Confidential & Proprietary Subject to Contract. Audit response 1 Health check/Diagnostic 2 ‘Standard’ sample testing audit 3 Project/Engagement monitoring 4 Pre-implementation review 5 Post-implementation review 6 Compliance audit 7 Risk interviews/verbal advice 8 Project management framework 9 Control process overview 10 Control framework review 11 End-to-End process audit 12 Deep dive 13 Investigation 14 Probity audits 15 Business coaching/Education Our approach Root cause analysis Root cause analysis (RCA) is a structured approach to identifying the underlying factor(s) that resulted in a deviation from the desired outcome in a given process or situation. ► Asks “why?” (more than once, typically 5 times) ► Identifies all the possible causes of an issue before narrowing down to the root causes (the real problems) that should be addressed 2 0 Without effective RCA, management may become distracted by symptoms and remain in a constant “firefighting” state. Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step7 Identify the problem Categorise major causes Brainstorm Gather data Identify most likely causes Choose most likely cause Select and test the best solution Page 20 © Ernst & Young LLP 2012. All rights reserved. Confidential & Proprietary Subject to Contract. Our approach Data analytics Data analytics: an integrated approach Layer 1 – Analytical risk identification ► Analytical diagnostics are performed to identify risks ► Risks are validated / refined through analytical support ► Consider predictive, scenario-based models Layer 2 – Analytical scoping/procedural development ► Using system data to prioritize the audits / locations / sites for inclusion in the audit plan ► Detailed audit procedures are enhanced through the inclusion of analytical test procedures Layer 3 – Analytical testing ► Pre-audit analytics are performed to better equip field auditors ► Analytical testing is used in place of, or in addition to, manual test procedures to increase the effectiveness / efficiencies of the audit plan Layer 4 – Interactive reporting/Trend analyses ► Provides easy interpretation as well as drill-down capabilities for more details ► Trend Analyses can be performed to better understand risks in the organization, and to better focus audit / remediation efforts Leverage continuous monitoring for ongoing support 2 1 Page 21 © Ernst & Young LLP 2012. All rights reserved. Confidential & Proprietary Subject to Contract. Initiating next steps to position your IA into a valued business advisor 1 2 3 Assess your current needs and determine where you want IA to be. Consider what is required to meet IA’s goals. Based on responses, determine what is the best option for moving ahead. Page 22 © Ernst & Young LLP 2012. All rights reserved. Confidential & Proprietary Subject to Contract. Questions??? Page 23 © Ernst & Young LLP 2012. All rights reserved. Confidential & Proprietary Subject to Contract. Ernst & Young Assurance | Tax | Transactions | Advisory About Ernst & Young Ernst & Young is a global leader in assurance, tax, transaction and advisory services. Worldwide, our 152,000 people are united by our shared values and an unwavering commitment to quality. We make a difference by helping our people, our clients and our wider communities achieve their potential. Ernst & Young refers to the global organization of member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients. For more information about our organization, please visit www.ey.com Ernst & Young LLP is a client-serving member firm of Ernst & Young Global and of Ernst & Young Americas operating in the US. About Ernst & Young’s Assurance Services Strong independent assurance provides a timely and constructive challenge to management, a robust and clear perspective to audit committees and critical information for investors and other stakeholders. The quality of our audit starts with our 60,000 assurance professionals, who have the experience of auditing many of the world’s leading companies. We provide a consistent worldwide audit by assembling the right multidisciplinary team to address the most complex issues, using a proven global methodology and deploying the latest, high-quality auditing tools. And we work to give you the benefit of our broad sector experience, our deep subject matter knowledge and the latest insights from our work worldwide. It’s how Ernst & Young makes a difference. © 2012 Ernst & Young LLP. All Rights Reserved. Confidential & Proprietary Subject to Contract. 1208-1382337 Page 24 © Ernst & Young LLP 2012. All rights reserved. Confidential & Proprietary Subject to Contract.
© Copyright 2024