Vincent Aceling
What makes an audit department world-class?
August 11th 2008 23:12
Recently, I attended a seminar that was given by a continuing education organization for Accountants and Auditors. One of the courses presented a professional's perspective on the Attributes of a World Class Audit Department. Since the audit function is increasingly an important and necessary function for every corporation, I found the perspectives shared to be quite insightful.
There are four main factors that Internal Audit currently faces: (1) Enterprise Risk Management (ERM), (2) Assurance and Compliance Needs, (3) Demand for Operational Reviews, and (4) Demand for Check and Balance Assurance.
Currently, the biggest challenge is the collective lack of understanding for the risks of the organization. If an audit department does not understand the risks, it cannot properly address them. Auditors should reflect on three main questions to help them overcome this lack of understanding:
1. What are we doing to help identify the risks that an organization is facing?
2. What are we doing to stay on top of the risks that are identified?
3. What are we doing as a department to be visionary?
Alongside audit’s biggest challenge, there will always be a demand for auditors to satisfy the assurance and compliance needs of an organization, as well as the demand for operational reviews and check and balance assurance. Thus, making the role of an auditor multi-facted in nature.
Before the audit department can become world-class, it must address any overriding issues and the challenges stated above, and effectively address the following situations:
* World-class audit departments address Enterprise Risk Management by assigning appropriate individuals in the organization to be accountable and responsible for each of its risks (e.g. SOX, anti-fraud control).
* Risks such as Sarbanes Oxley non-compliance, fraud, and information technology should be embedded in the risk module of the audit department.
* An audit department should effectively reconcile all of its resources’ skills with the organization’s risks, by continuously developing its talent in accordance with the changing risk environment.
* Underdeveloped resources with skills dating five years back, aren’t needed as much today (e.g. SOX-404 testers aren’t exactly in the highest demand), and should continuously be provided with updated training. Continuously developed resources who can address various risks are in demand and will add the most value.
* While audit departments strive to be visionary, routine work must be efficiently maintained; therefore, recruiting the right people is key in facing the challenges of supply and demand. The shifting balance of supply and demand presents a challenge to all audit departments. There is latent, pent-up demand for audit to do things in the organization; and not enough resources to do them.
Now for some examples displayed by 'world-class' audit departments:
* World-class Auditors address business risks by determining how they are going to identify the risks at the inherent and residual levels.
* A world-class audit department impacts change on a proactive basis. Resources must be utilized in a smart, effective manner to proactively impact change where the organization needs it the most.
* Any data that audit receives should be used to sense problems by looking for KPIs, trends, and lead/lag indicators for potential problems in the next six months.
* Becoming a world-class audit department, means becoming a virtual function. No audit department in the world has the core competencies to be world-class without an effective co-sourcing relationship.
>Example: Citigroup has a staff of 1,200 people who they co-source from firms such as the Big 4, Jefferson Wells, or Protiviti. Every year the audit profession is facing a different set of circumstances and auditors must determine if they have a department whose core competencies allow them to address the changing risks. The best way to address the changing risks is to retain flexible resources by leveraging co-sourcing relationships.
* In addition, many organizations can help build, educate or improve the talent existing within the audit department. Audit departments should consider using any external resources as much as possible to provide an unbiased, insightful perspective on the profession.
* Effective communication skills that appropriately persuade and make people change their mindset are needed. Auditors should strive to be the resolver, negotiator, and change agent for their organization. Auditors should constantly ask themselves, “Why would management ever call me?” Below are a few reasons why management would call upon audit:
> One reason is if management inherited a ticking bomb, and they want the world to know what they inherited - before stakeholders place sole blame on management.
> Management will also call upon audit if a trusting relationship is established. For example, a well known, airline company offers a penalty-free audit, if the business thinks its controls are operating effectively. Audit may take a quick peek at the controls and not issue a report, unless it found an issue that widely affects the organization.
> Although presenting the stakeholders with objectivity and facts are essential, auditors should strive to offer a more consultative/partnering relationship; rather than being labeled a fact-checker.
* A world-class audit department makes management react when they had no intention of reacting in an area. Management may not do exactly as suggested, but if they create an action based upon audit’s recommendation, audit succeeds. If management seems to adopt all of audit’s recommendations, there is a chance that audit is being too conservative.
* Audit should make sure that the technology it is using is really helping to identify future risks. Technology is like cholesterol; there is good and bad technology. Bad technology may offer more features or frequency in reporting, but ultimately delivers the same data. Good technology allows audit to identify potential future risks and adds real value.
* World-class audit departments act as a business partner. Audit should determine what it is doing to help its stakeholders achieve their business goals in an honest and ethical manner, with the fewest controls that cover the greatest risks.
> Audit is the business partner, when it is building the skill sets that would be important for their stakeholders, and giving them the tools through continuous monitoring that would help them get to their goals.
* Sometimes auditors should think radically in order to add value to an organization. Most audit departments tend to create the rules that impede their productivity. Audit departments should not be hindered by rules that were established for a different time period. So many people demand audit’s services, and there are so many things audit must achieve that it cannot be hindered by old rules.
* An audit department has four main assets: its people, their time, the tools given to them, and their knowledge. The great departments of audit aren’t those with the most number of certifications. The great audit departments have the people who leverage these four assets the best.
* A world-class audit department gets management to accept ownership of its controls.
* World-class audit departments constantly strive to add real value by considering the cost/benefits of its work and reflecting on what happened last year as a result of its work.
* Great audit departments define an organization’s best practices and get their stakeholders to agree to them and achieve them
* Great audit departments have vision and mission statements that continuously change with the risk environment.
* Finally, a world-class audit department never stops improving. It uses events, training, and conferences to continuously develop its people!
Audit it!
There are four main factors that Internal Audit currently faces: (1) Enterprise Risk Management (ERM), (2) Assurance and Compliance Needs, (3) Demand for Operational Reviews, and (4) Demand for Check and Balance Assurance.
Currently, the biggest challenge is the collective lack of understanding for the risks of the organization. If an audit department does not understand the risks, it cannot properly address them. Auditors should reflect on three main questions to help them overcome this lack of understanding:
1. What are we doing to help identify the risks that an organization is facing?
2. What are we doing to stay on top of the risks that are identified?
3. What are we doing as a department to be visionary?
Alongside audit’s biggest challenge, there will always be a demand for auditors to satisfy the assurance and compliance needs of an organization, as well as the demand for operational reviews and check and balance assurance. Thus, making the role of an auditor multi-facted in nature.
Before the audit department can become world-class, it must address any overriding issues and the challenges stated above, and effectively address the following situations:
* World-class audit departments address Enterprise Risk Management by assigning appropriate individuals in the organization to be accountable and responsible for each of its risks (e.g. SOX, anti-fraud control).
* Risks such as Sarbanes Oxley non-compliance, fraud, and information technology should be embedded in the risk module of the audit department.
* An audit department should effectively reconcile all of its resources’ skills with the organization’s risks, by continuously developing its talent in accordance with the changing risk environment.
* Underdeveloped resources with skills dating five years back, aren’t needed as much today (e.g. SOX-404 testers aren’t exactly in the highest demand), and should continuously be provided with updated training. Continuously developed resources who can address various risks are in demand and will add the most value.
* While audit departments strive to be visionary, routine work must be efficiently maintained; therefore, recruiting the right people is key in facing the challenges of supply and demand. The shifting balance of supply and demand presents a challenge to all audit departments. There is latent, pent-up demand for audit to do things in the organization; and not enough resources to do them.
Now for some examples displayed by 'world-class' audit departments:
* World-class Auditors address business risks by determining how they are going to identify the risks at the inherent and residual levels.
* A world-class audit department impacts change on a proactive basis. Resources must be utilized in a smart, effective manner to proactively impact change where the organization needs it the most.
* Any data that audit receives should be used to sense problems by looking for KPIs, trends, and lead/lag indicators for potential problems in the next six months.
* Becoming a world-class audit department, means becoming a virtual function. No audit department in the world has the core competencies to be world-class without an effective co-sourcing relationship.
>Example: Citigroup has a staff of 1,200 people who they co-source from firms such as the Big 4, Jefferson Wells, or Protiviti. Every year the audit profession is facing a different set of circumstances and auditors must determine if they have a department whose core competencies allow them to address the changing risks. The best way to address the changing risks is to retain flexible resources by leveraging co-sourcing relationships.
* In addition, many organizations can help build, educate or improve the talent existing within the audit department. Audit departments should consider using any external resources as much as possible to provide an unbiased, insightful perspective on the profession.
* Effective communication skills that appropriately persuade and make people change their mindset are needed. Auditors should strive to be the resolver, negotiator, and change agent for their organization. Auditors should constantly ask themselves, “Why would management ever call me?” Below are a few reasons why management would call upon audit:
> One reason is if management inherited a ticking bomb, and they want the world to know what they inherited - before stakeholders place sole blame on management.
> Management will also call upon audit if a trusting relationship is established. For example, a well known, airline company offers a penalty-free audit, if the business thinks its controls are operating effectively. Audit may take a quick peek at the controls and not issue a report, unless it found an issue that widely affects the organization.
> Although presenting the stakeholders with objectivity and facts are essential, auditors should strive to offer a more consultative/partnering relationship; rather than being labeled a fact-checker.
* A world-class audit department makes management react when they had no intention of reacting in an area. Management may not do exactly as suggested, but if they create an action based upon audit’s recommendation, audit succeeds. If management seems to adopt all of audit’s recommendations, there is a chance that audit is being too conservative.
* Audit should make sure that the technology it is using is really helping to identify future risks. Technology is like cholesterol; there is good and bad technology. Bad technology may offer more features or frequency in reporting, but ultimately delivers the same data. Good technology allows audit to identify potential future risks and adds real value.
* World-class audit departments act as a business partner. Audit should determine what it is doing to help its stakeholders achieve their business goals in an honest and ethical manner, with the fewest controls that cover the greatest risks.
> Audit is the business partner, when it is building the skill sets that would be important for their stakeholders, and giving them the tools through continuous monitoring that would help them get to their goals.
* Sometimes auditors should think radically in order to add value to an organization. Most audit departments tend to create the rules that impede their productivity. Audit departments should not be hindered by rules that were established for a different time period. So many people demand audit’s services, and there are so many things audit must achieve that it cannot be hindered by old rules.
* An audit department has four main assets: its people, their time, the tools given to them, and their knowledge. The great departments of audit aren’t those with the most number of certifications. The great audit departments have the people who leverage these four assets the best.
* A world-class audit department gets management to accept ownership of its controls.
* World-class audit departments constantly strive to add real value by considering the cost/benefits of its work and reflecting on what happened last year as a result of its work.
* Great audit departments define an organization’s best practices and get their stakeholders to agree to them and achieve them
* Great audit departments have vision and mission statements that continuously change with the risk environment.
* Finally, a world-class audit department never stops improving. It uses events, training, and conferences to continuously develop its people!
| 35 |
| Vote |
Shared on
Subscribe to this blog
