1. SJ State Operational Auditing BT 852 October 12, 2006 Page 1 San Jose State University October 12, 2006 Internal Audit: A 2006 Perspective Lynn Falbo lfalbo@wrcas.com

2. SJ State Operational Auditing BT 852 October 12, 2006 Page 2 Agenda “Audit” Evolution Working for Multi-national companies Career Opportunities Questions

3. SJ State Operational Auditing BT 852 October 12, 2006 Page 3 “Audit” Evolution” “Audit Generations” 1.Control-Based Auditing 2.Process-Based Auditing 3.Risk-Based Auditing 4.Risk-Management Based Auditing Merging / integration of Financial, Operational, IT focus

4. SJ State Operational Auditing BT 852 October 12, 2006 Page 4 Audit "Generation": One TwoThreeFour Control-Based Process-BasedRisk-BasedRisk Mgmt-Based Objective: Compliance with underlying guidelines Effectiveness and efficiency of a process Effectiveness of controls and procedures to mitigate key risks Effectiveness of risk management activities to achieve objectives and optimize/mitigate risks Approach: Understand guidelines and audit for compliance Compare current process to best practices Identify key business risks and evaluate controls to mitigate the risks Understand objectives, identify related risks, understand tolerance levels, identify performance and risk measures, and assess risk management effectiveness Focus: Identify compliance exceptions and errors Identify gaps between the current process and best practices Identify controls and procedures that are not operating as needed to mitigate the key risks Identify gaps between current and desired risk management effectiveness Testing Approach: Statistical based predictive and substantive tests, with some compliance tests Consulting focused evaluation of current and best practices, with some compliance tests Combination of substantive and compliance tests, focusing only on key risks Combination of substantive and compliance tests, focusing only on key objectives and the related risks Recommendations: Relate exceptions or errors to the relevant guidelines Relate gaps to specific operational objectives Relate exceptions or errors to key risks Relate gaps in risk management effectiveness to underlying risks and key business objectives Audit Generations

5. SJ State Operational Auditing BT 852 October 12, 2006 Page 5 Knowledge about ideal situations Comparison Analysis of Documents Interviews Questionnaires Actual Key Data Structure Processes Interfaces etc. Recommendations constructive future-oriented feasible improving processes and profits Ideal (Better) Strategy Business Policy Law, guidelines State of the Art Customer Surveys etc. Audit Process Methodology are the keys for improvements Understanding the actual status Introduction

6. SJ State Operational Auditing BT 852 October 12, 2006 Page 6 “Audit” Evolution” – Questions Introduction What Generation is represented by previous slide “Audit Process Methodology” model? What Generation best represents the focus of SOX (COSO Internal Control Framework)? What Generation best describes the methodology you were taught? What Generation is predominant in industry today?

7. SJ State Operational Auditing BT 852 October 12, 2006 Page 7 COSO Internal Control Framework

8. SJ State Operational Auditing BT 852 October 12, 2006 Page 8 COSO / Cobit Internal Control Framework

9. SJ State Operational Auditing BT 852 October 12, 2006 Page 9 COSO ERM (Enterprise Risk Management) Framework

10. SJ State Operational Auditing BT 852 October 12, 2006 Page 10

11. SJ State Operational Auditing BT 852 October 12, 2006 Page 11 Agenda “Audit” Evolution Working for Multi-national companies Career Opportunities Questions

12. SJ State Operational Auditing BT 852 October 12, 2006 Page 12 Working for Multi-national companies Unique challenges Culture Management style Philosophy “Global” business model Diversity Organization

13. SJ State Operational Auditing BT 852 October 12, 2006 Page 13 Agenda “Audit” Evolution Working for Multi-national companies Career Opportunities Questions

14. SJ State Operational Auditing BT 852 October 12, 2006 Page 14 Career Opportunities Audit Accounting / Finance SOX Compliance Other…..

15. SJ State Operational Auditing BT 852 October 12, 2006 Page 15 Career Opportunities Auditor for a Day –Exposure to the audit profession –Site visit at local companies –Attendance at the IIA meeting

16. SJ State Operational Auditing BT 852 October 12, 2006 Page 16 Agenda “Audit” Evolution Working for Multi-national companies Career Opportunities Questions