IIA Annual Survey - Governance and Risk Report 2013 Tuesday 5 th November 2013

WELCOME TO THE WEBINAR The audio for this webcast will be broadcast via your PC speakers – you do not need to dial in. If you are unable to use your PC speakers please click on the Request icon on the WebEx tool bar to receive teleconference information. Please submit your questions in the Q&A window. If viewing in full screen mode, please click the icon in the floating participant panel tray. We will address as many questions as time permits at the end of the presentation.

THOMSON REUTERS GRC

WEBINAR PRESENTERS Papiya Chatterjee, Senior Policy Officer Papiya has over 10 years’ experience in research and policy analysis and has worked in a wide range of policy areas in Parliament, the National Audit Office and more recently regulation. She also has a background in both value for money and external audit. David Lyscom, Policy Director David has been the IIA Policy Director since August He had a long career in the Diplomatic Service where he specialised in economic and financial policy issues. He was UK Ambassador to the OECD from 2004 to Susannah Hammond, Senior Regulatory Intelligence Expert Susannah joined the regulatory affairs team at Thomson Reuters from the GE Capital Bank where she was head of compliance. Susannah has more than 20 years’ wide-ranging experience in international and UK financial services. A qualified chartered accountant, more recently Susannah was head of international regulatory risk for the Halifax Group and became head of retail regulatory risk for HBOS plc upon Halifax’s merger with Bank of Scotland.

IIA Annual Survey - Governance and Risk Report 2013 First ever annual policy survey of IIA heads of internal audit (HIA) conducted in July / August The purpose - to collect factual data on the profession, including its position in organisations, and the services it provides; and to find out HIAs’ views on risk management issues and the skills and competencies internal audit needs to function effectively. Of the 642 HIAs sent the survey 307 responded - 48 per cent - broadly representative in terms of sector, location of work and gender.

IIA Annual Survey Results 1 In your view, what is the level of your organisation's risk maturity? Risk Management

IIA Annual Survey 2 Resource priorities Areas where respondents spend most of their time according to their audit plans

IIA Annual Survey 3 Whistleblowing and Fraud

IIA Annual Survey Results 4 Risk Focus of Audit Resources Areas of risk where internal audit spends most of its time

IIA Annual Survey Results 5 Reporting lines. Functional reporting line (to whom are you ultimately accountable?)

IIA Annual Survey Results 6 Who has ultimate responsibility for approving your Overseeing internal audit.

IIA Annual Survey Results 7 Executive management responsible for: All sectors Financial services Public sector Private sector (non FS) Budget50%31%62%51% Remuneration69%48%82%70% Appraisal79%71%86%78% Audit Committee responsible for: All sectors Financial services Public sector Private sector (non FS) Appointment59%76%38%75% Audit Charter77%86%68%76% Audit Plan85%91%85%

IIA Annual Survey Results 8 How frequently is your internal audit function externally assessed to judge compliance with IIA Standards? Quality assurance

IIA Annual Survey Results 8 Top areas of expected internal audit budget and staff increases over the next year Auditing culture

IIA Annual Survey Results 9 Top competencies internal audit needs now and in five years’ time Internal audit competencies

Thomson Reuters GRC State of Internal Audit 2013

survey Surveyed more than 1100 internal audit practitioners in February & March countries IA departments of all sizes from less than 5 to more than 100

18 Current Focus – top 3 areas

19 Future Focus – top 3 areas

20 In your opinion how mature is your organisations risk management function?

21 How much reliance do external auditors place on the work of internal audit?

22 Key challenges for internal audit in year ahead

23 IA view of challenges for their boards Corporate strategy43%52% Strategic level risk management37%47% Legal and regulatory risk31%38% Corporate governance30%35% IT security and risk28% Monitoring19%n/a Global expansion17%15% Capital and liquidity16%n/a Assurance on internal control processes15%13% Fraud and corruption12%8% Follow up on implementation of remedial action11%n/a Process level risk management8%10% Customer outcome8%n/a Other2%n/a

Comparisons Risk maturity Thomson Reuters: 50% reported that their organisation’s risk management function was non-existent, in development or immature. The IIA: 45% of organisations reported that they felt the level of risk maturity within their organisation was at the early stages of implementation, in development or non- existent. Skills and competencies Both surveys show the wide range of skills that internal auditors need which span both technical and business skills. Thomson Reuters commented that internal auditors may need additional training particularly in qualitative areas such as culture and corporate governance.

Further materials IIA Governance and Risk Report State of Internal Audit Effective Internal Audit in the Financial Services Sector Culture, Corporate Governance and the Internal Auditor