1. www.theiia.org The Global IIA Gerry Cox, MIIA, CIA Chairman of the Board A Vision for the Profession

2. www.theiia.org The Key Initiatives & Challenges International Professional Practices Framework Common Body of Knowledge IIA Strategic Plan

3. www.theiia.org Vision for the Future- The New IPPF

4. www.theiia.org Why Did We Update the PPF? Professional Practices Framework (PPF) concept is still viable, but new elements of guidance are being issued that did not exist at time of the current framework, e.g., –Position Papers –Global Technology Audit Guides Guidance development and approval processes not transparent nor consistent. Inclusion of affiliate guidance within PPF not defined.

5. www.theiia.org What Were We Trying To Achieve? The PPF structure and associated processes ensure that authoritative guidance is current, relevant, timely and internally consistent. To assess the effectiveness of The IIA’s professional guidance structure and recommend improvements. To establish formal processes for the development, review, approval, and issuance of the various types of guidance. To communicate such processes to members and stakeholders. To define education, oversight and monitoring processes to facilitate ongoing development of guidance, consistent with the PPF. So that:

6. www.theiia.org IPPF Exposure Statistics Exposed January 26, 2007 for 90-day period, ending on April 20, 2007. Almost 17,000 downloads. 421 responses, inclusive of individuals and affiliates or organizations. Responses from 48 countries. Received feedback from major affiliates, key stakeholders (IFAC, GAO, ACCA, ALGA), and numerous members.

7. www.theiia.org IPPF Exposure Feedback Feedback very positive, with a supportive response rate greater than 85% for all but four proposed changes: –The inclusion of the Quality Assurance & Improvement Guidance as a new separate element of the Framework –Redefining implementation standards to only encompass assurance and consulting standards –Having varied voting requirements to approve new guidance, determined by the approval body –The recommended review cycles for maintaining the guidance elements Recommended response described on next page.

8. www.theiia.org IPPF Exposure Response Task Force ResponseRationale Eliminate QA guidance as separate element. Guidance maps within Practice Guide element of Framework. Retain original proposal to limit Implementation Standards to assurance and consulting. Responses reinforced preference for ‘principles-based’, not engagement specific standards, which can be addressed in guidance. Defined consistent voting requirements for guidance approval -- 2/3 of the members of the relevant Committee or Board. Given importance of global representation and support for new guidance, simple majority not sufficient. Retained and clarified three year minimum review cycle which could be simply to confirm (but not change) guidance. Existing language contained ambiguity which was clarified.

9. www.theiia.org New IPPF DefinitionStatement of fundamental purpose, nature, and scope of internal auditing. Code of EthicsStatement of principles and expectations governing behavior of individuals and organizations in the conduct of internal auditing. Description of minimum requirements for conduct. Describes behavioral expectations rather than specific activities. International Standards Mandatory requirements consisting of: Statements of basic requirements for professional practice of internal auditing and for evaluating effectiveness of its performance, which are internationally applicable at organizational and individual levels. Principle focused and provide framework for performing and promoting internal auditing. Includes Attribute, Performance and Implementation Standards. Interpretations which clarify terms or concepts within the Statements. Consider both Statements and Interpretations to understand and apply correctly. Position PapersIIA statement to assist a wide range of interested parties, including those not in internal auditing profession, in understanding significant governance, risk or control issues and delineating related roles and responsibilities of internal audit. Practice Advisories Address approach, methodology and considerations, but not detailed processes and procedures. Concise and timely guidance to assist internal auditors in applying Code of Ethics and Standards and promoting good practices. Includes practices relating to: international, country, or industry specific issues; specific types of engagements; and legal or regulatory issues. Practice GuidesDetailed guidance for conducting internal audit activities. Includes detailed processes and procedures, such as tools and techniques, programs, and step-by-step approaches, including examples of deliverables.

10. www.theiia.org When Will the New IPPF be Completed? Fully revised IPPF completed January 2009, and available in core languages of English, Spanish and French. July 2007 – January 2009 –revise Standards (add Interpretations) and re-expose –modify Practice Advisories to meet new description –review IPPF referencing system to include Position Papers and Practice Guides Professional Practices Council will monitor implementation plan and timeline.

11. www.theiia.org Next Steps Obtain Board approval of IPPF. Complete the Implementation Plan. –Develop communications strategy –Assign project manager –Finalize project plan Define and Implement Education and Maintenance Processes. –Committee members –External stakeholders –Members and affiliates

12. www.theiia.org Common Body of Knowledge 2006

13. www.theiia.org CBOK and The Internal Auditing Profession CBOK will help us: –More clearly understand how internal auditing is being practiced around the world –Help us update our professional Standards –Allow us to look closely at the framework of the profession

14. www.theiia.org Previous Studies Study NameYearParticipationResponsesLanguages Common Body of Professional Knowledge 1972United States751 Common Body of Knowledge 1985 United States and Canada 3401 Common Body of Knowledge 1992 United States and Canada 12471 Competency Framework for Internal Auditing 199621 Affiliates1361 Common Body of Knowledge 2006 89 Affiliates 145 Chapters 9,36617

15. www.theiia.org Summary Demographics Participants CAE or equivalent26.5% Audit Managers22.8% Audit Seniors/Supervisors25.2% Audit Staff18.2% Others7.3%

16. www.theiia.org The Standards Comparison of Adequacy of Guidance Provided by The Standards and Compliance with The Standards for All Respondents (Percentages) Standard Perception of Adequacy of The Standards Full Compliance 1000- Purpose + Auth86.263.0 1100- Ind + Obj88.166.9 1200- Due care87.062.9 1300- QAIP77.340.0 2000- Manage IAA83.757.6 2100- Nature of work82.257.5 2200- Engagement Plan83.657.7 2300-Engagement83.859.7 2400- Comm Results85.264.1 2500- Monitoring81.852.6 2600- Resolution Risks76.046.9

17. www.theiia.org The Standards Common Reasons for Not Adhering to The Standards Inadequate Internal Audit Activity (IAA) staff Management does not believe it adds value Compliance is too time consuming Compliance not supported by management Superseded by local/government regulations or standards

18. www.theiia.org Emerging Roles of the IAA The External Environment Differs Globally 61%of IAAs are in countries with laws mandating an IAA and 13% anticipate such laws within the next 3 years 68%of IAAs’ organizations have corporate governance codes and 23% anticipate them in 3 years 71%of IAAs organizations have internal control frameworks and 24% anticipate them in the next 3 years

19. www.theiia.org Action Items for Profession Increased compliance with The Standards Expansion of university level courses in internal auditing Education of post university level employees about internal auditing Increased certification of staff Increased professional development of staff Proactive discussions about the value of internal auditing as a profession and an activity

20. www.theiia.org CBOK – Project Deliverables A Global Summary of the Common Body of Knowledge 2006 –The Preview Edition is for sale now –Anyone who buys the Preview Edition will also receive the complete book when it is released in October 2007 –We anticipate that translation of the complete book into Spanish and French will commence in September 2007

21. www.theiia.org IIA Strategic Plan Planning Ahead for the IIA and the Profession

22. www.theiia.org Where Are We Today? In third year of current 3 year plan Some objectives will be carried over

23. www.theiia.org 2005-07 Strategic Objectives Advocacy –To be recognized as the global voice for the internal audit profession. Globalization –To develop and sustain the internal audit profession globally through appropriate infrastructure, coordination, support and communication. Service –To provide exceptional service to IIA members.

24. www.theiia.org Emerging Themes for New Strategy Elevate and advocate the profession Operate as a global organization External recognition as the voice of the profession who sets the standards Preferred and primary provider of research for and services to the profession

25. www.theiia.org Preferred Future Milestones 1.Internal Auditing is universally recognized as a profession To Accomplish this The IIA: 2.Defines the principles of the profession and assures that the principles are available seamlessly worldwide 3.Assures adherence to professional requirements 4.Is the preferred provider in the research, development and dissemination of knowledge to advance the profession 5.Is seen by its members and operates as one global organization By 2013:

26. www.theiia.org Strategy The Main Recommendations 1.Develop enhancement to the professional designation that builds upon CIA –Develop CIA, with additional specific knowledge, experience and educational requirements –Develop competency and maturity models, and align training strategy and core curriculum to models 2.Develop membership strategy aligned with new professional designation –Introduce new ‘full’ vs. ‘associate’ member categories, and phase in membership requirements over extended time period with selected grandfathering of existing members –Develop membership retention and membership recruitment strategies, including underrepresented specialist groups

27. www.theiia.org Strategy The Main Recommendations 3.Develop multi-faceted assessment processes and phase in over extended time period –Self-assessment tools against competency and maturity models –Self assessment tools for professional designation –Self-reporting mechanisms for members on base membership requirements, and for CIAs on expanded requirements –Selected independent validation processes for those with professional designation 4.Develop structured global research methodology and guidelines 5.Develop recommended training curriculums, and leverage other training providers, as appropriate

28. www.theiia.org Strategy The Main Recommendations 6.Leverage global Knowledge Management (KM) study to implement KM system and process, including ‘virtual portal’ to provide information, products and services in local markets 7.Develop global ‘footprint’ by strategically determining most important expansion areas for the IIA and the profession –Develop service models for serving affiliates at differing maturity levels, leveraging IIA headquarters and mature affiliates as well as regional offices 8.Upon completion of NAB study on feasibility of NA Affiliate, reassess global governance structure and funding model 9.Expand advocacy strategy to encompass member and nonmember practicing internal auditors

29. www.theiia.org Milestones, Outcomes & Strategies 1. Internal Auditing is universally recognized as a profession High preponderance of practitioners are certified and meet professional requirements Value of internal auditing recognized by stakeholders Clearly define value proposition; evaluate implications of internal audit ‘opinion’ on internal controls Develop requirements for the CIA that exceed current level Develop phased membership transition strategy for ‘associate’ vs. ‘full’ members, and develop membership growth and retention strategy Continue advocacy efforts and include practicing internal auditors Continue IAEP educational strategy

30. www.theiia.org Milestones, Outcomes & Strategies 2. Defines the principles of the profession and assures that the principles are available seamlessly worldwide Global current PPF Global communications mechanism to consistently, effectively and efficiently deliver PPF to all members and practitioners Implement IPPF with routine evaluation of standards and guidance vs. professional needs; develop individual vs. company level standards Execute the Translation Strategy including a routine re-evaluation of core languages; develop a cooperative translation process for non-core Develop proactive communication strategy to educate members, nonmembers and stakeholders on principles of profession

31. www.theiia.org Milestones, Outcomes & Strategies 3. Assures adherence to professional requirements Professional requirements for individuals and, separately, for organizations An independent monitoring and validation process to assess adherence by those internal auditors with the professional designation Communicate requirements for new professional designation and develop supporting educational programs Develop self-assessment frameworks for members with and without professional designations Develop disciplinary policy for noncompliance Develop selected independent validation process for those with professional designation

32. www.theiia.org Milestones, Outcomes & Strategies 4. Is the preferred provider in research, development and dissemination of knowledge to advance the profession Effective global knowledge management of IA theory, guidance, best practices, tools and techniques; through global organization, provides real- time information on emerging issues and their implications Develop structured global research methodology, guidance and prioritization process Leverage Knowledge Management study to develop KM system and process, including ‘virtual portal’ for sharing information, products and services Develop competency and maturity models, with customizable training plans Develop global framework and standards for training/services; develop recommended curriculums and leverage other training providers, as appropriate

33. www.theiia.org Milestones, Outcomes & Strategies 5. Is seen by its members and operates as one global organization A global structure/economic model in place to sustain the IIA globally Respective roles, responsibilities, accountabilities of each element are accepted and enforced Products and services are conceived, developed, distributed globally Develop robust global marketing and branding strategy Develop global expansion strategy (‘footprint’) for affiliate expansion or consolidation Develop service models for affiliates at varying maturities; leverage IIA headquarters and mature affiliates as well as regional offices Upon completion of NA Affiliate study, reassess global governance structure and funding model Develop global membership policy, defining principles for all affiliates and the monitoring process

34. www.theiia.org Timeline and Status ActivitiesTimingStatus Draft preferred future state and develop key outcomes March – April 2007Complete Develop discussion materials for broader exposure and input April 2007Complete Solicit broad input, including Global CouncilApril – July 2007Complete Global Board UpdateJuly 14, 2007Complete Refine, map to current strategic plan, identify high level implementation activities July – August 2007 Complete Solicit broad inputSeptember 2007In Progress Refine, discuss with Executive CommitteeOctober 2007Complete Refine, discuss with Global BoardNovember 2007Not Started Refine, approval by Global BoardDecember2007Not Started Develop action steps to implement strategy, including milestones December 2007 – March 2008 Not Started Assign responsibilities for implementationMarch – July 2008Not Started