Institute of Internal Auditors 2018 IIA CHICAGO CHAPTER JOIN NTAC:4UC-11

Transcription

1

2 2018 NORTH AMERICAN PULSE OF INTERNAL AUDIT THE INTERNAL AUDIT TRANSFORMATION IMPERATIVE JOHN WSZELAKI, CIA, CRMA, CFE DIRECTOR, AMERICAN CENTER FOR GOVERNMENT AUDITING THE INSTITUTE OF INTERNAL AUDITORS 2018 NORTH AMERICAN PULSE OF INTERNAL AUDIT The Internal Audit Transformation Imperative Public Sector Focus

3 OVERVIEW About Pulse Topics Agility: Embrace to Confront Disruption Innovation: Pursue Quantum Leaps Talent: Focus on Tomorrow s Risks Board: Move from Oversight to Engagement Risk Insight: Organizational Use of Data Analytics Wrap Up Note: Totals in some exhibits may not equal 100% due to rounding.

4 Demographics

5 ALL RESPONDENT DEMOGRAPHICS Internal Audit Maturity (Self-Assessed) Industry Groupings* Initial Building/infrastructure 4% 18% 19% 30% Finance and insurance Services Number of Responses Performing/integrated Leading/managed Controlling/optimal 14% 27% 37% 25% 26% Industrial Government and education CAEs 552 Organization Type (Number of Responses) Internal Audit Function Size (FTEs) Directors/ senior managers % 23% 27% Total % 6% Publicly traded Public sector Privately held Nonprofit 1 to 3 4 to 9 10 to to or more

6 PUBLIC SECTOR INTERNAL AUDIT POSITION 16% Public Sector Internal Audit Position CAEs % Directors/ senior managers 23 Total 142 CAEs Directors/senior managers

7 YEARS OF INTERNAL AUDIT EXPERIENCE Public Sector CAEs and Directors 37% 42% 22% Less than 10 years 10 to 19 years More than 20 years

8 PUBLIC SECTOR INTERNAL AUDIT FUNCTION SIZE 40% 28% 24% 8% 1 to 3 4 to 9 10 to or more

9 PUBLIC SECTOR TYPES Public Sector Types % Number of Responses State/provincial 43% 61 Local/city/county 30% 42 Federal/national 13% 19 Government-sponsored enterprises 8% 11 None of the above 4% 6 International or multinational 2% 3 Total 100% 142

10 PUBLIC SECTOR INDUSTRY GROUPINGS Public administration 39% Educational services 30% Utilities 8% Other services (except public administration) 7% Finance and insurance 6% Transportation and warehousing 5% Health care and social assistance 4%

11 Agility: Embrace to Confront Disruption

12 CAE CONSIDERS INTERNAL AUDIT TO BE VERY OR EXTREMELY AGILE Nonprofit 50% Privately held 49% Publicly traded 43% Public sector 42% All 45%

13 RELATIONSHIP BETWEEN AGILITY AND CAE EXPERIENCE Internal Audit Considered to Be "Very" or "Extremely" Agile Compared to CAE s Years of Experience 50% 42% 45% 35% 37% 29% 3 years or less 4 to 9 years 10 to 14 years 15 to 19 years 20 to 25 years More than 25 years

14 INTERNAL AUDIT STRATEGIES FOR PREPARING TO RESPOND TO DISRUPTION (PUBLIC SECTOR VS NON-PUBLIC SECTOR) Full or Partial Implementation Meaningful collaboration with other lines of defense 50% 58% Flexible planning/resource allocation 42% 46% Prepared and adaptive (anticipate and react when needed) 36% 46% Assessing the risk of additional future disruption 36% 45% Flexible talent management 29% 38% Public sector Non public sector

15 CHALLENGES TO INTERNAL AUDIT AGILITY Issues Perceived as Roadblocks to Agility Inadequate quantity of internal audit resources. 44% 54% There is a high degree of organizational complexity. 41% 46% Executive management has overly traditional expectations of internal audit. 38% 42% Stakeholders are generally not available for collaboration. 17% 27% Inadequate capabilities of current internal audit personnel. 24% 29% Audit committee has overly traditional expectations of internal audit. 21% 22% Public sector Non-public sector

16 ADDRESSING AGILITY Start With a Change in Mindset Refocus processes Rethink resources Reposition your resources

17 ADDRESSING AGILITY Prepare to Quickly Refocus on Disruptive Risks and Opportunities Risk identification and assessments need to be fluid, timely, and forward focused Concentrate on future risks and what may be obscured Focus on updating your plan and approach as stakeholder expectations and events impact your workload

18 ADDRESSING AGILITY Prioritize Work According to What Matters Most Auditors can audit anything but they should not audit everything Look at highest risk and biggest impact areas Explore new technologies and audit approaches while still being disciplined, systematic, accurate, and timely

19 ADDRESSING AGILITY Break the Mold and Create Teams with the Right Blend of Skills Well-rounded flexible resources bring a variety of competencies that are best able to respond to disruption Top three skills CAE s need are analytical/critical thinking, communication, and business acumen

20 ADDRESSING AGILITY Coordinate with Other Resources in the Organization Internal audit should not operate as an island Consider collaboration with the other lines of defense

21 Innovation: Pursue Quantum Leaps

22 CAE ASSESSMENT OF INTERNAL AUDIT INNOVATION CAEs Who "Strongly Agree the Statement Characterizes Their Internal Audit Function Seeks new ways to improve collaboration within the organization. 45% 47% Seeks new ways to improve communication of results of engagements. 39% 44% Seeks new ways to gather evidential information to support audit work. 34% 43% Challenges the status quo of the internal audit function. 30% 32% Quickly adopts new technologies or processes. 13% 16% Public sector Non-public sector

23 IMPLEMENTATION OF NEW TECHNOLOGY AND IDEAS Implementation Levels Full, Partial, Plans in Place, None Electronic workpapers 52% 22% 8% 18% Internal audit KPIs for stakeholders 20% 26% 23% 32% Data analytics 8% 53% 27% 12% 1% Automation of routine tasks (e.g., robotic process automation) 19% 21% 59% 1% Automation of analysis of audit evidence (artificial intelligence) 14% 14% 71% Full implementation Partial implementation Implementation plans are in place No implementation and no plans to do so

24 ELECTRONIC WORKPAPERS Implementation of Electronic Workpapers Compared to Public Sector Type Federal/national 63% 16% 11% 11% State/provincial 54% 21% 5% 20% Local/city/county 48% 29% 10% 14% Other 45% 15% 15% 25% Full implementation Partial implementation Implementation plans are in place No implementation and no plans to do so

25 INTERNAL AUDIT KPIS FOR STAKEHOLDERS Implementation of KPIs for Stakeholders Compared to Public Sector Type Federal/national 32% 16% 32% 21% State/provincial 20% 21% 18% 41% Local/city/county 12% 33% 26% 29% Other 25% 35% 20% 20% Full implementation Partial implementation Implementation plans are in place No implementation and no plans to do so

26 INTERNAL AUDIT USE OF DATA ANALYTICS Implementation of Data Analytics in the Internal Audit Function Federal/national 16% 47% 26% 11% State/provincial 5% 54% 25% 16% 2% Local/city/county 10% 64% 24% Other 10% 30% 40% 20% Full implementation Partial implementation Implementation plans are in place No implementation and no plans to do so

27 AUTOMATION OF ROUTINE INTERNAL AUDIT TASKS (ROBOTICS) Automation of Routine Internal Audit Tasks (Robotics) Federal/national 11% 16% 74% State/provincial 21% 20% 59% 2% Local/city/county 26% 24% 48% Other 5% 25% 70% Full implementation Partial implementation Implementation plans are in place No implementation and no plans to do so

28 AUTOMATED ANALYSIS OF EVIDENCE (ARTIFICIAL INTELLIGENCE) Automated Analysis of Evidence (Artificial Intelligence) Federal/national 11% 26% 63% State/provincial 13% 11% 75% 2% Local/city/county 19% 14% 64% Other 10% 10% 80% Full implementation Partial implementation Implementation plans are in place No implementation and no plans to do so

29 ADDRESSING INNOVATION Recognize the Need for Self-Assessment and Challenge how Objectives are Being Accomplished Internal auditors need to devote time and effort to challenge themselves and search for opportunities to innovate Give staff time for self-assessment and opportunities to challenge the status quo

30 ADDRESSING INNOVATION Embrace Technological Advances Only 13% of CAE s strongly agree that their internal audit functions are quick to adopt new technologies or processes There has been very little adoption of automated routine audit tasks (robotic process automation or automated analysis of audit evidence a type of artificial intelligence)

31 ADDRESSING INNOVATION Do Not Blame the Failure to Innovate on the Lack of Resources Obtaining more or different resources requires agreement of the audit committee and support of management Need to change the mindset and it only requires a few people or examples to move the bar

32 ADDRESSING INNOVATION Develop and Communicate the Case for Internal Audit to Actively Pursue Innovation Requires investment in time and return on investment through improved effectiveness, efficiency, and agility Specific proposals need to explain why changes in the audit approach and resource management will achieve internal audit s overall objective

33 Talent: Focus on Tomorrow s Risks

34 SUFFICIENT STAFF TO ACHIEVE OBJECTIVES 74% "Somewhat" or "Strongly" Agree That Staff Is Sufficient 64% 59% 46% Publicly traded Privately held Nonprofit Public sector

35 RECRUITING DIFFICULTY PER STAFF LEVEL Level of Difficulty Director 73% 21% 6% Manager 66% 26% 8% Experienced auditor 55% 33% 11% Entry-level auditor 14% 45% 41% Very or extremely difficult Somewhat difficult Not difficult

36 SKILLS FOR WHICH COLLECTIVE COMPETENCY IS NOT ADEQUATE "Strongly" or "Somewhat" Disagree Competency Is Sufficient Cybersecurity and privacy 47% Data mining and analytics 38% Basic IT knowledge 20% Innovative thinking 19% Fraud investigations and/or auditing 16%

37 COMPETENCIES WITH MOST RECRUITING DIFFICULTY "Very" or "Extremely" Difficult Cybersecurity and privacy 80% Data mining and analytics 71% Industry-specific knowledge 59% Innovative thinking 53% Governance and culture 46%

38 ACADEMIC DEGREES PREFERRED IN RECRUITING "Very" or "Extremely" Desirable 67% 78% 72% 75% 46% 42% 20% 24% 25% 10% Accounting or finance IT-related degree Business Operational or technical Communications Public sector Non-public sector

39 RESPONDING TO COMPETENCY GAPS Cosource work to specialist "Very" or "Extremely" Likely 50% 67% Cosource work to normal cosource provider 44% 63% Perform work only to extent of internal competencies 24% 38% Delay work until internal competencies are developed 9% 23% Exclude area from audit plan 7% 11% Public sector Non-public sector

40 ADDRESSING TALENT Make Sure the Risks that Drive Internal Audit s Scope Drive Staff Competencies and Not the Reverse Most CAE s feel they do not have the quantity an/or quality of personnel they believe they need. Most common solution is to co-source work. Altering scope to avoid risk cannot be a long-term strategy

41 ADDRESSING TALENT Develop a Talent Strategy to Ensure the Right Pipeline of Qualified Personnel Look at skills and level of resources needed and develop plan to ensure they are available Limitations to scope should not be part of the strategy Use of co-sourcing resources can be a valid part of a well planned talent strategy

42 ADDRESSING TALENT Engage Stakeholders and Obtain Their Support for Internal Audit s Talent Management Strategy Such a strategy needs to be communicated and approved by executive management and the audit committee

43 ADDRESSING TALENT Start Looking for Candidates with Different Backgrounds Most recruited degrees are accounting and finance followed by IT When looking for analytical/critical thinking, communication, and business acumen consider operational and technical backgrounds

44 ADDRESSING TALENT Reconsider Which Skills are Most Essential for Success Half of the CAE s say data mining/analytics and cybersecurity are only somewhat or not essential skills However they are rated the lowest when evaluating the collective competencies of their function Data analytics can be used as a key enabler for innovation and cybersecurity is a key risk area that needs to be addressed and both these competencies need to be elevated

45 ADDRESSING TALENT Include Future Focused Training and Development Programs Geared Towards Specific Levels of Staff CAE s will not be able to hire their way out of this skills shortage Innovative thinking, communication, technology, and other skills that support innovation and agility are in short supply CAE s need to focus on building these skills among existing staff

46 ADDRESSING TALENT Professional development and nonconventional training opportunities including one-on-one coaching, team coaching, and self directed or high impact learning opportunities wiled influence when attempting to recruit and retain employees Need a supportive culture for professional development Develop specific annual targets and provisions for training to help ensure a high level of collective proficiency

47 Board: Move from Oversight to Engagement

48 CAE MEETS WITH AUDIT COMMITTEE CHAIR WITHOUT MANAGEMENT* Publicly traded 75% 17% 8% Privately held 53% 23% 23% Public sector 54% 18% 29% Nonprofit 42% 42% 17% *Among those with audit committees Strongly agree Somewhat agree Strongly or somewhat disagree

49 AUDIT COMMITTEE INPUT INCLUDED IN INTERNAL AUDIT PLAN Nonprofit 68% 26% 6% Public sector 67% 22% 10% Publicly traded 63% 32% 5% Privately held 58% 39% 3% Strongly agree Somewhat agree Somewhat or strongly disagree *Among those with audit committees

50 AUDIT COMMITTEE APPROVING STAFF AND BUDGETS Privately held 51% 26% 22% Publicly traded 57% 28% 15% Nonprofit 38% 31% 31% Public sector 33% 28% 40% *Among those with audit committees Strongly agree Somewhat agree Strongly or somewhat disagree

51 ADDRESSING BOARD ENGAGEMENT Increase the Audit Committee s Involvement with Internal Audit s Resources and Performance Having audit committee members more involved in reviewing and approving resources and providing direct feedback on performance will enable the committee to better support the work of internal audit

52 ADDRESSING BOARD ENGAGEMENT Improve the Audit Committee s Understanding of the Risks the Organization Faces CAE s need to help audit committee members become more knowledgeable about risk management and internal control systems

53 ADDRESSING BOARD ENGAGEMENT Discuss with the Audit Committee Those Situations Where the CAE Disagrees with Management Relationships with management can vary substantially over time and within the organization CAE s should work to build awareness among audit committee members that the audit committee is the true driver and enabler of internal audit effectiveness The audit committee needs to fully understand internal audit s views on risk, control, resources, and performance and stand with IA on any disputes

54 Risk Insight: Organizational Use of Data Analytics

55 ORGANIZATIONAL MATURITY FOR USE OF DATA ANALYTICS 33% 42% 49% 25% 23% 23% 1% 4% Initial Developing Established Mature Public sector Non-public sector

56 RESIDUAL RISK RELATED TO ORGANIZATION S DATA ANALYTICS Residual Risk Rated as "Extensive" Data completeness 12% 24% Data accuracy 15% 23% Accuracy/integrity of analysis Reporting clarity and usefulness 9% 10% 20% 20% Governance structure for data analytics activities 7% 19% Public sector Non-public sector

57 Internal Audit Management Insights Public Sector

58 FUNCTIONAL REPORTING LINES Federal/national 58% 32% 11% State/provincial 67% 18% 15% Local/city/county 69% 21% 10% Other 80% 5% 15% All 68% 19% 13% Board, audit committee CEO, president, agency head Other executive leadership

59 ADMINISTRATIVE REPORTING LINES Federal/national 58% 11% 5% 26% State/provincial 51% 10% 11% 28% Local/city/county 33% 17% 24% 26% Other 60% 30% 5% 5% All 48% 15% 13% 24% CEO, president, agency head CFO, other financial executive Board, audit committee Other executive leadership

60 ALLOCATION OF AUDIT EFFORT BY RISK AREA Compliance/regulatory (not related to financial reporting) Operational (not included elsewhere) Financial areas other than financial reporting IT (not covered in other choices) Fraud identification and investigation (not covered in other audits) Cyber (prevention and/or recovery) Enterprise risk management programs and related processes Governance and culture Cost/expense reduction or containment Management of third-party relationships Support for external audit Other risk category not listed Financial reporting (including Sarbanes-Oxley testing) 7% 6% 6% 6% 5% 4% 3% 2% 2% 9% 9% 21% 20%

61 STAFFING Staff Size Changes in the Past 12 Months 1 to 3 13% 85% 3% 4 to 9 20% 70% 11% 10 to 24 38% 50% 12% 25 or more 45% 27% 27% Increased Remained the same Decreased

62 SKILL IMPORTANCE FOR INTERNAL AUDIT - OVERVIEW "Most" or "Very" Essential Analytical/critical thinking Communication skills Understanding the audit process Innovative thinking Understanding of professional ethics Persuasion and collaboration Understanding the IPPF Process improvement Business acumen Governance and culture Industry-specific knowledge Internal audit management/supervision Basic IT knowledge Risk management assurance Accounting and finance Data mining and analytics Fraud investigations and/or auditing Cybersecurity and privacy 47% 56% 54% 53% 65% 64% 63% 63% 62% 76% 74% 73% 85% 85% 84% 82% 94% 91%

63 SKILL IMPORTANCE FOR INTERNAL AUDIT TOP 6 "Most" or "Very" Essential (Top 6) Analytical/critical thinking 94% Communication skills 91% Understanding the audit process 85% Innovative thinking 85% Understanding of professional ethics 84% Persuasion and collaboration 82%

64 VIRTUAL SYMPOSIUM JULY 24, 2018 Richard Chambers, President and CEO IIA Challenges and Opportunities in the Public Sector in 2018 and Beyond Janet St. Laurent, Director Center for Excellence, GAO, Keeping Performance Auditing on Track, Tools and Techniques For Facilitating Critical Thinking Theresa Grafenstine, Chairman of Board ISACA, Cyber Security Threats in the Public Sector are you Prepared Jon Rymer, Former Inspector General Department of Defense, Shaping the Tone at the Top from the Audit Perspective

65 QUESTIONS

66 THANK YOU FOR YOUR TIME AND ATTENTION! IIA CHAPTER CHICAGO 58 TH ANNUAL SEMINAR John Wszelaki, CIA, CRMA, CFE Director, American Center or Government Auditing The Institute of Internal Auditors