InternalAudit:AddingValue

May31–June3,2011

Lesson1UrtonAnderson,CIA,CCSA,CGAP,CFSA,PhDClarkW.ThompsonJr.,ProfessorinAccountingEducationTheUniversityofTexasatAustinLesson4NanjingAuditUniversity1AgendaLesson1IntroductionTheinternalauditvaluepropositionRiskassessmentandriskmanagementRiskandauditresourceallocationLesson2InternalcontrolMonitoringAuditplanningcaseTheIPPFLesson3CapabilitymaturitymodelsEffectiveComplianceSystemsAssessingthecomplianceandethicsprogramCompliance/ethicscaseLesson4Consultingservices,blendedconsultingengagementsBlendedconsultingcaseCombinedAssurance/AssuranceMappingLesson4NanjingAuditUniversity2

Consultingservices,blendedconsultingengagements

DefinitionofconsultingConsultingvs.AssuranceIndependenceandobjectivityissuesWhyperformconsultingConsultingengagementprocessAllocationofresourcestoconsultingLesson43NanjingAuditUniversityInternalAuditSevicesWhatarewecallingConsultingservicesthesedays?AdvisoryServicesOperationalauditingValue-for-moneyreviewsDuediligencereviewControlself-assessmentfacilitationBlendedEngagementsInsightLesson4NanjingAuditUniversity4ConsultingTherangeofservices,beyondinternalaudit’sassuranceservices,providedtoassistmanagementinmeetingitsobjectives.Thenatureandscopeofworkisspecifiedbyanagreementbetweentheinternalauditorandtheclient.Examplesmayincludefacilitation,processdesign,training,andadvisoryservices.

Lesson4NanjingAuditUniversity5SpecificexamplesofconsultingactivitiesTrainingDuediligenceCostanalysisRiskidentification&assessmentProcessimprovementgroupfacilitationDocumentation&analysisofprocessesFunctionalanalysisExecutionofcustomersatisfactionsurveysEvaluationofproducts&servicesBenchmarkingReview/ParticipationinsystemsdevelopmentFraudinvestigationsLesson4NanjingAuditUniversity6AuditContinuumLesson4NanjingAuditUniversity7Whoisinvolvedintheengagement?Inassuranceengagements?InternalauditAuditeeUserInconsultingengagements?InternalauditClient(theBoard,Seniormanagement,operatingmanagement)Lesson4NanjingAuditUniversity8Whyprovideconsultingservices?AnIAfunctionthatprovidesconsultingisconsideredavaluableresource&canprovidebigpaybackfortheorganizationImprovedrelationsw/operatingmanagementGreaterexposureforstaffEnhancedcareeropportunitiesforstaffLesson4NanjingAuditUniversity9ValueAddedImproveefficiencyandeffectivenessofprocessIncorporatebestpracticesintotheorganizationTrainingopportunitiesforinternalauditorsImprovedrelationsbetweeninternalauditandorganizationalunitsLesson4NanjingAuditUniversity10ValuePropositionLesson4NanjingAuditUniversity11Insight:

Catalyst,Analyses,AssessmentsInternalAuditingisacatalystforimprovinganorganization’seffectivenessandefficiencybyprovidinginsightandrecommendationsbasedonanalysesandassessmentsofdataandbusinessprocesses.

Lesson412NanjingAuditUniversityCatalyst,Analyses,AssessmentsAscatalystforimprovement,evaluatesprocesses,reportsfindingsandrecommendsappropriatecoursesofaction;andadvisesonkeyprojects/initiatives.Throughanalysesofdataandinformation,providesinsightintoprocessimprovements.Throughunderstandingofthebusinessanditsobjectives,assessestheefficiencyandeffectivenessofoperationsandprotectionofassets.Lesson413NanjingAuditUniversity

WhatSTAKEHOLDERSshouldexpectfromyourinternalauditorsVALUEPROPOSITIONOFINTERNALAUDITINGLesson414NanjingAuditUniversityCanIAconsult&beindependent/objectivetoo?YES…buthow?EnsureIAdoesnotassumemanagementresponsibilitiesEnsureinternalauditordoesnotaudithis/herownworkFULLDISCLOSURE:IndependentinfactorappearanceLesson4NanjingAuditUniversity15Standard1130ImpairmentstoIndependenceorObjectivity

Ifindependenceor

objectivity

isimpairedinfactorappearance,thedetailsofthe

impairment

shouldbedisclosedtoappropriateparties.Thenatureofthedisclosurewilldependupontheimpairment.ImplementationStandard1130.A1(AssuranceEngagements)

Internalauditorsmustrefrainfromassessingspecificoperationsforwhichtheywerepreviouslyresponsible.Objectivityispresumedtobeimpairedifaninternalauditorprovidesassuranceservicesforanactivityforwhichtheinternalauditorhadresponsibilitywithinthepreviousyear.

ImplementationStandard1130.A2(AssuranceEngagements)Assurance

engagements

forfunctionsoverwhichthechiefauditexecutivehasresponsibilitymustbeoverseenbyapartyoutsidetheinternalauditactivity.Lesson4NanjingAuditUniversity16Standard1130ImpairmentstoIndependenceorObjectivity

Ifindependenceor

objectivity

isimpairedinfactorappearance,thedetailsofthe

impairment

shouldbedisclosedtoappropriateparties.Thenatureofthedisclosurewilldependupontheimpairment.ImplementationStandard1130.C1(ConsultingEngagements)

Internalauditorsmayprovideconsultingservicesrelatingtooperationsforwhichtheyhadpreviousresponsibilities.ImplementationStandard1130.C2(ConsultingEngagements)

Ifinternalauditorshavepotentialimpairmentstoindependenceorobjectivityrelatingtoproposedconsultingservices,disclosuremustbemadetotheengagementclientpriortoacceptingtheengagement.Lesson4NanjingAuditUniversity17HowcanIAprotect

independence&objectivity?ConsultingservicesdefinedincharterPolicies&procedureslimitingparticipationinconsultingprojectsScreeningprocessforconsultingprojectsSegregationofconsulting&assuranceunitsRotationofauditorsonengagementsUsingoutsideprovidersFulldisclosure(inauditreports)Lesson4NanjingAuditUniversity18ConsultingEngagementProcessLesson4NanjingAuditUniversitySelectionPreparationUnderstand&PlanPerformingEngagementReporting&Follow-up19SelectionManagersrequesttheengagementdirectlyIAshoulddeveloppolicies&proceduresforacceptingnon-IAengagementsIncludeguidanceincharterIsIAcapable/competenttoperformservice?Willtheengagementimpairindependenceinappearanceorfact?Couldathirdpartyperformtheengagementaswell(orbetter)?DoesIAhavetheresources?IsthereconsultingtimeintheannualIAbudget?Lesson4NanjingAuditUniversity20EngagementPreparationIdentifytimeframeforengagementDetermineIA’sroleintheprojectScheduleauditorswithsufficientknowledgeofthearea&experienceNotifytheappropriatemanagersLesson4NanjingAuditUniversity21Understand&PlanDocumentunderstandingof:ObjectivesScopeofworkManagement’sresponsibilityEstablishreporting/communicationplansShouldaprojectmaintained?Lesson4NanjingAuditUniversity22Standard2201.C1Implementation

Standard2201.C1(Consulting

Engagements)

Internalauditorsmustestablishanunderstandingwithconsultingengagementclientsaboutobjectives,scope,respectiveresponsibilities,andotherclientexpectations.Forsignificantengagements,thisunderstandingmustbedocumented.Lesson4NanjingAuditUniversity23PerformingtheengagementIAmustNOTtakeamanagementroleintheproject.ManagementmustberesponsibleforultimatedecisionsDocumentworkinworkpapersExercisedueprofessionalcare(standard1220.c1)needsandexpectationsofclientComplexityandworkneedtoachieveobjectiveCostbenefitofprojectLesson4NanjingAuditUniversity24Standard2300PerformingtheEngagement

Internalauditorsmustidentify,analyze,evaluate,andrecordsufficientinformationtoachievetheengagement'sobjectives.Theseobjectivesaredeterminedduringengagementpreparation&obtainingunderstandingandengagementplanningphasesLesson4NanjingAuditUniversity25ReportingandFollow-upReportingmaytakeplacethroughoutFinalreportisNOTan“auditreport”…noopinionFinalreportisamemoInternalauditorsshouldnotperformassuranceonthatareaforatleast1yearAnyperceivedindependenceissuesshouldbedisclosedLesson4NanjingAuditUniversity26Standards2440.C1&C2Implementation

Standard2440.C1(Consulting

Engagements)

Thechiefauditexecutiveisresponsibleforcommunicatingthefinalresultsofconsultingengagementstoclients.Implementation

Standard2440.C2(Consulting

Engagements)

Duringconsultingengagements,riskmanagement,control,andgovernanceissuesmaybeidentified.

Whenevertheseissuesaresignificanttotheorganization,theymustbecommunicatedtoseniormanagementandtheboard.Lesson4NanjingAuditUniversity27ConsultingarisingDuringAssuranceWorkAnauditareawasselectedbasedonariskassessmentDuringtheopeningconferencethemanageraskstheengagementteamtoextenditswork&considerhowthedeptcouldimprovetheefficiencyoftheorderentry&trackingsystemTheengagementteam&auditmanageragreetoperformthesetasksLesson4NanjingAuditUniversity28ARiskBasedApproachtoResourceAllocationtoConsultingServicesandBlendedEngagementsNeedmethodtotrade-offassuranceandconsultingworkRoleofIAinGovernanceLesson4NanjingAuditUniversity29ModelExternalFactors–.5InternalFactors–.3Other -.2

Factorsrated0-3Lesson4NanjingAuditUniversity30Lesson4NanjingAuditUniversity31Lesson4NanjingAuditUniversity32Lesson4NanjingAuditUniversityRiskScoreAssessment180-300High150-179Medium0-149Low33AsloConsiderPrioritySubjectiveratingassignedHigh,Medium,LowLesson4NanjingAuditUniversity34Lesson4NanjingAuditUniversity35BlendedEngagementExampleLesson4NanjingAuditUniversityClientDataConversion36THANKYOUSUCCESS2023/7/2437可編輯Lesson4NanjingAuditUniversity38Lesson4NanjingAuditUniversity39

Consultingservices,blendedconsultingengagements-case

BUSCorporationSwissCorp–founded1862GlobalbankFullService-Investment,CommercialandRetail(primarilyretailandcorporatecustomers)MarketCap$100BEmployees100,000MissionandStrategyWhatisthestrategyandmissionExerciseHowdoesBUScomparetoothers?SimilarDifferentExerciseWhatarefactorsthatdrivethedifferences?Howdoyouthinkthedifferencesaffectthegrowthstrategy?IAinBUS300auditorsworldwide–40atcorporateWhatisstaffingstrategy?IAinBUS300auditorsworldwide–40atcorporateWhatisstaffingstrategy?Co-sourcing10%ofhourswithtwointernationalfirmsPrimarilyforcoverageinareaswhereBUSdoesnothaveauditstaffLanguageorspecializedskillsScenario1WhichIIAStandardsandPAsaddressconsultingScenario1WhichIIAStandardsandPAsaddress(1)DevelopingariskassessmentprocesstoselectconsultingprojectsWhichIIAStandardsandPAsaddress(1)Developingariskassessmentprocesstoselectconsultingprojects?Standard2010.C1:Thechiefauditexecutiveshouldconsideracceptingproposedconsultingengagementsbasedontheengagement’spotentialtoimprovemanagementofrisks,addvalue,andimprovetheorganization’soperations.Acceptedengagementsmustbeincludedintheplan.Standard2120:Theinternalauditactivitymustevaluatetheeffectivenessandcontributetotheimprovementofriskmanagementprocesses.Standard2120.C1:Duringconsultingengagements,internalauditorsmustaddressriskconsistentwiththeengagement’sobjectivesandbealerttotheexistenceofothersignificantrisks.Standard2120.C3:Whenassistingmanagementinestablishingorimprovingriskmanagementprocesses,internalauditorsmustrefrainfromassuminganymanagementresponsibilitybyactuallymanagingrisks.Determiningappropriatestaffandresourceallocationforconsultingengagements?Developingworkprogramsforconsultingengagements?Definingworkingpaperdocumentationrequirements?Definingconsultingengagementcommunicationrequirements?Lesson4NanjingAuditUniversity54

CombinedAssurance/AssuranceMapping

PracticeAdvisory2050-2-AssuranceMapsOneofthekeyresponsibilitiesoftheboardistogainassurancethatprocessesareoperatingwithintheparametersithasestablishedtoachievethedefinedobjectives.Itisnecessarytodeterminewhetherriskmanagementprocessesareworkingeffectivelyandwhetherkeyorbusiness-criticalrisksarebeingmanagedtoanacceptablelevel.Lesson4NanjingAuditUniversity56SourcesofAssuranceLinemanagementandemployees(managementprovidesassuranceasafirstlineofdefenseovertherisksandcontrolsforwhichtheyareresponsible.)SeniormanagementInternalandexternalauditorsComplianceQualityassuranceRiskmanagementEnvironmentalauditorsWorkplacehealthandsafetyauditorsGovernmentperformanceauditorsFinancialreportingreviewteamsExternalfinancialstatementauditorsOtherexternalassuranceproviders,includingsurveys,specialistreviews(healthandsafety),etc.Lesson4NanjingAuditUniversity57AssuranceNet(PWC)3FundamentalClassesofAssuranceProvidersThosewhoreporttomanagementand/orarepartofmanagement(managementassurance),includingindividualswhoperformcontrolself-assessments,qualityauditors,environmentalauditors,andothermanagement-designatedassurancepersonnel.Thosewhoreporttotheboard,includinginternalaudit,somecasescompliance.Thosewhoreporttoexternalstakeholders(externalauditassurance),whichisaroletraditionallyfulfilledbytheindependent/statutoryauditor.Lesson4NanjingAuditUniversity59AssuranceMapLesson4NanjingAuditUniversity60COMBINEDASSURANCE

KingIIIPrinciple3.5Theauditcommitteeshouldensurethatacombinedassurancemodelisappliedtoprovideacoordinatedapproachtoallassuranceactivities.ImplementingStep1:EstablishingthebusinesscaseStep2:Assurancerealitycheck–whatrisk,sourceofassurance,howStep3:RiskmappingStep4:CombinedassurancedesignStep5:ImplementLesson4NanjingAuditUniversity62AssuranceMap(PWC)LinesofDefenseBaselII-BaselCommitteeonBankingSupervisionLesson4NanjingAuditUniversity64Line1Managementoversight-managementreview,controlself-assessment,andcontinuousmonitoringmechanismsLine2Stafffunctions–Riskmanagement,SOXreview,complianceLine3Independentandobjectiveassurance–IA,EA,ISO,regulatoryauditsandotherindendentreviewsLinesofDefenseLesson4NanjingAuditUniversity65Lesson4NanjingAuditUniversity66HowisassuranceprovidedLesson4NanjingAuditU