MARKETING INTERNAL AUDIT

Transcription

1 MARKETING INTERNAL AUDIT PRESENTERS DANNY M. GOLDBERG FOUNDER GOLDSRD CPA, CIA, CISA THE STANDARD IN STAFFING, RECRUITING AND PROFESSIONAL DEVELOPMENT Insert Logo Here FOUNDER, GOLDSRD ( FORMER DIRECTOR OF CORPORATE AUDIT/SOX AT DR PEPPER SNAPPLE GROUP FORMER CAE - TYLER TECHNOLOGIES PUBLISHED AUTHOR (BOOK/ARTICLES) TEXAS A&M UNIVERSITY 97/98 CHAIRMAN OF THE LEADERSHIP COUNCIL OF THE AMERICAN LUNG ASSOCIATION -NORTH TEXAS CALENDAR YEAR 2012 SERVED ON THE AUDIT COMMITTEE OF THE DALLAS INDEPENDENT SCHOOL DISTRICT (CY 2008) CURRENT DALLAS AND FORT WORTH IIA PROGRAMS CO- CHAIR FORMER FORT WORTH IIA BOARD MEMBER ( ) DANNY M. GOLDBERG CURRENT DALLAS IIA BOARD MEMBER IIA NORTH AMERICA LEARNING COMMITTEE MEMBER ( ) CERTIFICATIONS: CPA SINCE 2000 CIA SINCE 2008 CISA SINCE 2008 CGEIT - SINCE 2009 CRISC - SINCE 2011 CRMA SINCE 2011 CCSA SINCE 2007 CGMA SINCE

2 This image cannot currently be displayed. 9/12/2017 PEOPLE-CENTRIC SKILLS Published August 2014 (Wiley Publications) Over 2,500 copies sold - Amazon Rating Coauthored with Manny Rosenfeld Chief Audit Executive with four global F500 Cos. and a global Financial Services organization. First book specific to internal audit communications and personal interactions This is not a reference book! Story book format Character development Fictional Internal Audit Department Fictional Professional Coach/Trainer Situational PROFESSIONAL DEVELOPMENT: NATIONALLY-RECOGNIZED LEADER IN AUDIT AND PEOPLE-CENTRIC SKILLS TRAINING INSTITUTE OF INTERNAL AUDITORS ( IIA ) REGISTRY OF CPE PROVIDERS (ONLY 6 FIRMS IN NORTH AMERICA!) OVER 170 FULL-DAY COURSES ON AUDIT, IT AUDIT, ACCOUNTING, FINANCE, PERSONAL DEVELOPMENT AND PEOPLE-CENTRIC SKILLS REGISTERED WITH NASBA TO OFFER CPE S FOR ALL COURSES IN COURSE CATALOG (LIVE AND WEB-BASED) INTERACTIVE AND EDUCATIONAL COURSES FOR ALL LEVELS EXECUTIVE RECRUITING: UNIQUE APPROACH TO FILLING POSITIONS, INCLUDING PERSONALITY ASSESSMENT FOR CANDIDATE AND ORGANIZATION EXPANSIVE NETWORK OF QUALIFIED CANDIDATES ACTIVELY LOOKING STAFF AUGMENTATION: MARKET LEADER IN LOCATING COST-EFFECTIVE, RECOGNIZED RESOURCES IN ACCOUNTING, FINANCE, AUDIT AND IT ALL REQUESTS FILLED WITHIN 72 HOURS 2

3 MARKETING INTERNAL AUDIT INTERNAL ASSESSMENT What is the perception of IA in your organization? Are new employees, including temporary, given orientation about governance, risk management, compliance (GRC) and its relevance to their roles? Does internal audit tell its story at new employee orientation? At all-hands meetings? At initial meetings of all engagements? Is the Internal Audit brand comparable to Wal-mart or Ford? 3

4 HALLMARKS OF BRANDING Consistency of product and service delivery Always adding value but what is value? Services and deliverables have a distinct and signature look Continuous commitment to quality and excellence Effective communications/marketing plan Always attempting to do more and new things Branding as an internal consultant professionalism! COMMITMENT TO QUALITY & EXCELLENCE Professional certifications On-going training (internal and external) Robust Quality Assurance process Helpful audit reports Clear, concise and focused on assisting management in meeting their objectives 4

5 EFFECTIVE COMMUNICATIONS/MARKETING PLAN Ownership clear Clients and stakeholders needs assessed Appropriate media Web page PowerPoint decks for all occasions Face-to-face meetings SOME MARKETING APPROACHES New employee orientations Management and executive development training Staff profiles on web or in brochure Description of services on web or in brochure Web page with push communications enewsletter Lunch and learn for non-audit staff Debrief management after audit committee meetings Presentation decks for all occasions 5

6 BRANDING AND PROMOTING INTERNAL AUDIT Requires an Internal Audit strategy with an compelling vision, internalized values, and engaging mission Coupled with a marketing and communications plan That tells a story of transformation That acknowledges and debunks the myths THE PAY-OFF Internal Audit will be positioned for greater influence in the organization Value to clients and stakeholders will increase when Internal Audit becomes a change agent within the entity Internal Audit will become a core competency rather than a mandated burden 6

7 THREE PILLARS OF MARKETING INTERNAL AUDIT CONSISTENT MESSAGING DEFINE INTERNAL AUDITING FOCUS ON OBJECTIVES MARKETING PLAN MARKETING SHEET OUTREACH W/ NEW MANAGERS PERIODIC OUTREACH W/MANAGER (TAKE THE PULSE) INTRANET SITE CONTINUOUS EDUCATION ALLEVIATE THE FEAR FOCUS ON VALUE BROWN BAG LUNCHES NEWSLETTERS WITH ISSUES/FINDINGS DON T USE INDEPENDENCE AS AN EXCUSE TRANSPARENCY TRY TO HELP TRY NOT TO HIDE ANYTHING WALK AUDITEES THROUGH ARA POST THE AUDIT PLAN GIVE AUDITEES AUDIT WORK PROGRAM (PATH TO SUCCESS) CONSISTENT MESSAGING 7

8 WHAT IS THE GOAL OF INTERNAL AUDIT (ROOTED IN THE DEFINITION) THE STANDARD IN STAFFING, RECRUITING AND PROFESSIONAL DEVELOPMENT DEFINING INTERNAL AUDIT An independent, objective assurance and consulting activity designed to add value and improve an organization's operations Helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes 8

9 CONTINUOUS EDUCATION (ALSO SEE APPENDIX) TRANSPARENCY 9

10 TRANSPARENCY Transparency Breeds Trust -> Trust Breeds More Effective and Efficient Auditing Empower Auditees to Own the Audit Discuss/Understand Risk Assessment Let Auditee have input/insight Know the Pathway to Success Write Finding/Recommendation with Auditee IMPORTANCE OF COMMUNICATION Relationships break down due to a lack of communication or miscommunication Trust is not built until a relationship is built Remote auditing is less effective due to the lack of face time People don t get over the word audit without knowing the auditor Interpersonal and Communication Skills are valued more in the market today than technical capabilities 10

11 EDUCATING CLIENTS THE STANDARD IN STAFFING, RECRUITING AND PROFESSIONAL DEVELOPMENT TOPICS OF DISCUSSION Biggest challenges Most difficult clients What else? 11

12 GOLD NUGGETS Life is all about relationships Transparently, continuously communicate Learn and learn some more Not everyone understands risks and controls! APPENDIX THE STANDARD IN STAFFING, RECRUITING AND PROFESSIONAL DEVELOPMENT 12

13 APPENDIX A: TRAINING CLIENTS THE STANDARD IN STAFFING, RECRUITING AND PROFESSIONAL DEVELOPMENT INTERNAL CONTROLS: WHY SHOULD YOU CARE? THE STANDARD IN STAFFING, RECRUITING AND PROFESSIONAL DEVELOPMENT 13

14 INTERNAL CONTROL FORMAL DEFINITION Process, effected by an entity s board of directors, management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: Effectiveness and efficiency of operations Reliability of financial reporting Compliance with applicable laws and regulations CONCEPTS/OBJECTIVES Control definition reflects certain fundamental concepts: Internal control is a process. It's a means to an end, not an end in itself Internal control is effected by people. It's not merely policy manuals and forms, but people at every level of an organization Internal control can be expected to provide only reasonable assurance, not absolute assurance, to an entity's management and board 14

15 WHY DO WE HAVE CONTROLS? Designed to provide reasonable assurance regarding the achievement of objectives in the following categories: Effectiveness and efficiency of operations Reliability of financial reporting Compliance with applicable laws and regulations Controls mitigate risks to an acceptable level (deemed by management) to assist in the meeting objectives (e.g. strategic initiatives/business plans) Controls balance risk/reward WANT SOME EXAMPLES? THE STANDARD IN STAFFING, RECRUITING AND PROFESSIONAL DEVELOPMENT 15

16 EVERYDAY INTERNAL CONTROLS Lock-up valuable belongings Keep copies of your tax returns and related support Balance your checkbook Keeping passwords unique and separate Planning Ahead Home and Car Insurance Seat Belts Physical Control of Credit Cards COMPANY X INTERNAL CONTROLS ARE SIMILAR Offices and buildings are locked when unoccupied Computer passwords are periodically changed and should not be written down near the computer Checking management reports and purchase card charges against source documents Locked cash drawers and secure storage for checks Authorizations required for certain activities 16

17 INTERNAL CONTROLS ARE USUALLY PREVENTATIVE OR DETECTIVE Preventative - let s stop an unwanted outcome before it happens Detective - let s find the problem before it grows PREVENTIVE CONTROL TECHNIQUES Designed to verify that only valid transactions are recognized, approved and submitted for processing Preventive = Before processing activity occurs Preventive techniques are likely to be more effective in a strong control environment, when management authorization criteria are well-defined and properly communicated EXAMPLES: Segregation of Duties System integrity and continuity controls, e.g., application design standards, change controls, security controls, systems backup and recovery Physical safeguard and access restriction controls (human, financial, physical and information assets) 17

18 DETECTIVE CONTROL TECHNIQUES Designed to verify that errors and irregularities are discovered and corrected on a timely basis Detection techniques normally are performed after processing has been completed EXAMPLES: Reconciliation of batch balance reports to control logs maintained by originating departments Reconciliation of cycle inventory counts with perpetual records Comparison of reported results with plans and budgets Reconciliation of subsidiary ledger balances with the general ledger Reconciliation of interface amounts exiting one system and entering another Review of on-line access and transaction logs WHAT IF CONTROLS DON T WORK? THE STANDARD IN STAFFING, RECRUITING AND PROFESSIONAL DEVELOPMENT 18

19 WHAT IS THE RISK OF AN INEFFECTIVE CONTROL STRUCTURE? Fraud, Embezzlement and Theft By management, employees, customers, vendors, or the public-atlarge Erroneous Management Decisions Based on erroneous, inadequate or misleading information Statutory Sanctions Penalties arising from failure to comply with regulatory requirements, as well as overt violations Excessive Costs/Deficient Revenues Expenses which could have been avoided, as well as loss of revenues Q: WHO IS RESPONSIBLE FOR INTERNAL CONTROL? THE STANDARD IN STAFFING, RECRUITING AND PROFESSIONAL DEVELOPMENT 19

20 A: EVERYONE!!! MANAGEMENT/DEPARTMENT HEAD Responsible for designing and implementing controls for the areas they are responsible for Responsible for executing policies and procedures throughout their areas of responsibility These responsibilities should come with the authority needed to see that controls are implemented and they should make sure controls are completed (monitor) 20

21 THE ROLE OF THE PROCESS OWNER General Expectations Understand your responsibility for the design, implementation and maintenance of the control structure within your business processes Contribute direction to identify, prioritize and review risks and controls Continue or begin a program of self-assessment and testing to monitor the controls within your processes Immediate Action Items Educate your personnel about these requirements and this effort Reinforce internal focus on controls within your area Surface any risks, concerns or issues promptly to allow adequate attention for correction (don t wait for an audit!) Fix control gaps as soon as possible ROLE OF SENIOR MANAGEMENT/BOARD Oversight Define risk appetite Both are ultimately responsible (annual management certifications) 21

22 OTHER CONSIDERATIONS CONTROLS ARE THERE TO PROTECT YOU AS WELL AS THE COMPANY COST OF A CONTROL SHOULD NOT OUTWEIGH THE BENEFIT Assigning two guards to follow someone around to make sure neither the person nor the other guard takes anything isn t reasonable. Some controls cost little YOU CAN T PICK AND CHOOSE WHICH CONTROLS YOU WANT TO COMPLY WITH If a procedure doesn t seem to make sense or appears unnecessary, check it out with management and get it changed. Don t stop complying until the change is official, you may not have the full picture WHY DON T INTERNAL CONTROLS ALWAYS WORK? Inadequate knowledge of policies or governing regulations. I didn t know that! Inadequate segregation of duties. We trust A who does all of those things. Remember, in general only people we trust can steal from us, we watch the others Inappropriate access to assets. Passwords shared, offices left unlocked, cash not secured... Form over substance You mean I m supposed to do something besides initial it Control override. I know that s the policy, but we do it this way. Just get it done, I don t care how Inherent limitations. People are people and mistakes happen. You can t foresee or eliminate all risk 22

23 GROUP DISCUSSION THE STANDARD IN STAFFING, RECRUITING AND PROFESSIONAL DEVELOPMENT CONTROLS APPLICABLE TO MOST EXERCISE Based on your view of internal controls, what controls apply to all processes regardless of type? THE FOUNDATION OF OUR CONTROLS HOME! 23

24 CONTROLS APPLICABLE TO MOST 1. Documentation/Policies and Procedures 2. Segregation of Duties 3. Physical and Logical Access 4. Review and Reconciliation Controls (Management Oversight) Balance Sheet Reconciliations JE Reviews Variance analysis 5. Tiered Approvals (Authorization/Approval) 24