Crucial Lessons from the AUDIT TRAIL Richard F. Chambers, CIA, QIAL, CGAP, CCSA, CRMA President and CEO The Institute of Internal Auditors

Seven Crucial Lessons Every Internal Auditor Will Likely Encounter 1.Recognizing the connection between stakeholders and value 2.Building and sustaining relationships 3.Learning to follow the risks 4.Addressing the audit timeliness challenge 5.Unanticipated consequences 6.Facing ethical dilemmas 7.Striving for the “seat at the table” 2

Stakeholders Judge Our Value “Your guys are not meeting my needs” Internal audit stakeholders –Audit committee –Executive management –Operating management –Employees, citizens, taxpayers Common stakeholder concerns –We don’t understand the business –We are not effective communicators –Assurance versus advice –Value for money 3 “Your key stakeholders have the last word on whether you are doing your job well. And they judge an internal audit function not by how well run it is, but by the value it generates for them.” Lessons Learned on the Audit Trail “Your key stakeholders have the last word on whether you are doing your job well. And they judge an internal audit function not by how well run it is, but by the value it generates for them.” Lessons Learned on the Audit Trail

Build and Sustain Relationships We must work where we live Strong relationship acumen –Positive intent –Diplomacy –Foresight –Trustworthiness –Leadership –Empathy Relationship acumen can enhance your value and your career “The President wants to offer you the job” 4 “A confident, courageous CAE who spends time building relationships can negotiate a middle ground that meets the goals of both board and management in the long run.” Lessons Learned on the Audit Trail “A confident, courageous CAE who spends time building relationships can negotiate a middle ground that meets the goals of both board and management in the long run.” Lessons Learned on the Audit Trail

Follow the Risks: Wherever They May Lead You All risks are not “nuclear” The winds of risk shift rapidly Auditing in a “desert storm” Emerging risks in 2014: –Cybersecurity –Cloud computing –Mobile technology –Third-party risks –COSO 2013 –Social media We must continuously assess risks –Formal methods –Risk assessment by walking around –Set your antenna high 5 “I’ve learned we can't take our eye off of this whole concept of enterprise risk. If we focus on just one slice of it, like financial risks, we do so at our peril and at the peril of our company.” Lessons Learned on the Audit Trail “I’ve learned we can't take our eye off of this whole concept of enterprise risk. If we focus on just one slice of it, like financial risks, we do so at our peril and at the peril of our company.” Lessons Learned on the Audit Trail

Better Never Than Late! “That unit does not even exist any more!” Most audits take longer than needed Value of late audits is diminished Achieving timeliness is a journey Each phase of the audit must be re-engineered: –Planning – “a trip without a map” –Field work – “over auditing” –Reporting – “the ultimate challenge” Reporting cycle time: effective strategies –Share internal audit results with client “as you go” –Eliminate or reduce levels of review –Use an editor earlier in the process –Use team writing –Streamline the audit report 6 “Few sources of friction within the auditing department exceed that caused by the process of report writing.” Sawyer’s Guide for Internal Auditors “Few sources of friction within the auditing department exceed that caused by the process of report writing.” Sawyer’s Guide for Internal Auditors

Small Stones Cause Big Waves Trash cans, telephone poles, and the Grand Canyon Audit report users bring their own filters Waste and inefficiency resonate BIG A paneled office and etched glass Reports must be balanced –Stress order of magnitude –Don’t sensationalize –Be prepared for the reaction SETI at home 7 “Sometimes internal audit results just cry out for reaction or publicity. It is the internal auditor’s responsibility to ensure the issues are placed in context.” Lessons Learned on the Audit Trail “Sometimes internal audit results just cry out for reaction or publicity. It is the internal auditor’s responsibility to ensure the issues are placed in context.” Lessons Learned on the Audit Trail

No One Is Immune To Ethical Lapses Beware of your “blind spots” Factors in internal audit ethical lapses –Loyalties to senior executives –Desire to protect the organization –Protection of career opportunities –Conflicts of interest –Disregard of “The Code of Ethics” 7 traits of ethical audit leaders –Honest –Courageous –Accountable –Empathetic –Trustworthy –Respected –Proactive Staff support for computers 8 “I found myself standing at a crossroads. Looking back, I would take the same path again. But doing the right thing doesn’t mean there will be no cost to others, your family, or yourself.” Cynthia Cooper – “Extraordinary Circumstances” “I found myself standing at a crossroads. Looking back, I would take the same path again. But doing the right thing doesn’t mean there will be no cost to others, your family, or yourself.” Cynthia Cooper – “Extraordinary Circumstances”

You Must Secure and Retain A Seat at The Table “Your presence could have a chilling effect” We must understand –Business strategy formulation –How risks are assessed and managed –How management views industry trends Don’t use the seat for “audit leads” A “seat at the table” is the means – not the end Trusted advisors are always welcome at the table! 9 “The process of earning a seat at the table begins long before you can pull up your chair. It starts with you building a trusting relationship with the organization’s board and management.” Lessons Learned on the Audit Trail “The process of earning a seat at the table begins long before you can pull up your chair. It starts with you building a trusting relationship with the organization’s board and management.” Lessons Learned on the Audit Trail

Ascending To The Level of Trusted Advisor

Thank You!