Leading the Internal Audit Function

Day 1: The rapidly changing role of Internal Audit

The need for Internal Audit to be a strategic advisor

• New IIA Code of Conduct
  • Helping the Board to protect the assets, reputation and sustainability of the organisation.
  • Internal audit should have the right to attend and observe all or part of executive committee meetings
  • The primary reporting line for the chief internal auditor should be to the chair of the Audit Committee.
• New IIA Audit Executive guidance
• Key messages from the IIA Body of Knowledge survey
• Deciding the strategic direction for your function
• Pulse of the profession survey results
• IIA becoming more effective guidance will be shared
• Ensuring effective communication lines between the CAE and the Board
• Gaining assurance regarding the quality of the function’s work.
• Overseeing the relationship between the IA function and the organisation’s centralised risk monitoring function.
• Exercise 1 – The new challenges facing IA

Ensuring IA is a challenger and a business champion

• Independence & Objectivity
• Reporting lines – the need for independence
• Should you report to the Chief Executive or the Audit Committee?
• Audit Committee relationships
• Key requirements of the role and the implications
  • Objective assurance
  • Consulting
  • Adding value
  • Improving the organisation’s operations· Assisting the business to achieve its objectives
  • Systematic and disciplined approach
  • Evaluate and improve risk management, control and governance processes
• Dealing with the misconceptions of the role
• It is not internal audit’s responsibility to :-
  • Detect fraud
  • Introduce more and more control
  • Find management out
  • Assess the ability of management and staff
  • Train staff
  • Tell management what to do
• Exercise 2 – Dealing with the misunderstandings of IA

Auditing the ERM process

• The need to focus audit attention towards the most significant risks
• New IIA guidance – maturity models for assurance
• The need for much higher levels of assurance than ever before
• What level of assurance can really be provided?
• Could working with management to identify and evaluate risks compromise the independence of the function?
  Ensure risk is defined as the need to get things right – not what can go wrong
• ‘Ring fencing’ risk exposure – never allow one part of the business to impact the whole organisation
• Determining and communicating your attitude to risk and your required risk culture to managers and stakeholders
• Recognise that reputation is both your biggest asset and the biggest risk you face – and one you cannot insure
• Do not wait until you are required to provide evidence of effective risk management by regulators or legislation – this will usually be too late
• Promote risk as the pulse of the organization and make sure that you have personnel to regularly take this pulse
• Exercise 3 – What steps can IA take to help make risk management a value added process?

Strategic audit planning

• The need to determine which topics to audit (and their frequency)
• The audit universe
• The need for risk-based audit plans
• Tapping into risk assessments carried out by management
• Determining the level of assurance required
• Getting management input
• Dealing with requests
• New IIA guidance on audit plan preparation will be provided
• The need for a structured approach.
• A world-renowned strategic audit planning tool will be shared (the model is used by more than 2500 audit functions across the world)
• Exercise 4 Determining audit priorities using the model

The need to exceed stakeholder expectations

• Who are the stakeholders?
• Are stakeholders’ expectations known?
• Arranging meetings with all stakeholders
• Workshops with key stakeholders?
• Are the expectations clear?
• How can you meet the widely differing expectations?
• Are there any areas where expectations could be exceeded?
• Are there any quick wins?
• What reports should IA provide to stakeholders?
• A new paper on working with stakeholders will be shared
• New advice on auditing strategy
• What every Director should know about IA – new guidance
• Exercise 5 – Meeting the ever expanding requirements of stakeholders – what should the IA role be?

Day 2: Managing and overseeing the IA process

Corporate Governance and the IA Role

Ensuring full Assurance Mapping is in place

Extending the audit coverage

The audit leadership skill set

Audit assignment oversight

Consultancy assignments