2018 North American Pulse of Internal Audit. Public Sector Focus. The Internal Audit Transformation Imperative

Transcription

1 2018 North American Pulse of Internal Audit Public Sector Focus The Internal Audit Transformation Imperative

2 Overview About Pulse Topics Agility: Embrace to Confront Disruption Innovation: Pursue Quantum Leaps Talent: Focus on Tomorrow s Risks Board: Move from Oversight to Engagement Risk Insight: Organizational Use of Data Analytics Wrap Up Note: Totals in some exhibits may not equal 100% due to rounding.

3 Demographics

4 All Respondent Demographics Internal Audit Maturity (Self- Assessed) Initial Building/infrastructure 4% 18% 19% Industry Groupings* 30% Finance and insurance Services Number of Responses CAEs 552 Performing/integrated Leading/managed Controlling/optimal 14% 27% 37% 25% 26% Industrial Government and education Directors/ senior managers 84 Total Organization Type (Number of Responses) Internal Audit Function Size (FTEs) 34% 27% 23% % 6% Publicly traded Public sector Privately held Nonprofit 1 to 3 4 to 9 10 to to or more

5 Public Sector Internal Audit Position 16% Public Sector Internal Audit Position CAEs 119 Directors/ senior managers 23 84% Total 142 CAEs Directors/senior managers

6 Years of Internal Audit Experience Public Sector CAEs and Directors 37% 42% 22% Less than 10 years 10 to 19 years More than 20 years

7 Public Sector Internal Audit Function Size 40% 28% 24% 8% 1 to 3 4 to 9 10 to or more

8 Public Sector Types Public Sector Types % Number of Responses State/provincial 43% 61 Local/city/county 30% 42 Federal/national 13% 19 Government-sponsored enterprises 8% 11 None of the above 4% 6 International or multinational 2% 3 Total 100% 142

9 Public Sector Industry Groupings Public administration 39% Educational services 30% Utilities Other services (except public administration) Finance and insurance 8% 7% 6% Transportation and warehousing 5% Health care and social assistance 4%

10 Agility: Embrace to Confront Disruption

11 CAE Considers Internal Audit to Be Very or Extremely Agile Nonprofit 50% Privately held 49% Publicly traded 43% Public sector 42% All 45%

12 Relationship Between Agility and CAE Experience Internal Audit Considered to Be "Very" or "Extremely" Agile Compared to CAE s Years of Experience 50% 42% 45% 35% 37% 29% 3 years or less 4 to 9 years 10 to 14 years 15 to 19 years 20 to 25 years More than 25 years

13 Internal Audit Strategies for Preparing to Respond to Disruption (Public Sector vs Non-Public Sector) Full or Partial Implementation Meaningful collaboration with other lines of defense 50% 58% Flexible planning/resource allocation 42% 46% Prepared and adaptive (anticipate and react when needed) 36% 46% Assessing the risk of additional future disruption 36% 45% Flexible talent management 29% 38% Public sector Non-public sector

14 Challenges to Internal Audit Agility Issues Perceived as Roadblocks to Agility Inadequate quantity of internal audit resources. 44% 54% There is a high degree of organizational complexity. 41% 46% Executive management has overly traditional expectations of internal audit. 38% 42% Stakeholders are generally not available for collaboration. 17% 27% Inadequate capabilities of current internal audit personnel. 24% 29% Audit committee has overly traditional expectations of internal audit. 21% 22% Public sector Non-public sector

15 Addressing Agility Start With a Change in Mindset Refocus processes Rethink resources Reposition your resources

16 Addressing Agility Prepare to Quickly Refocus on Disruptive Risks and Opportunities Risk identification and assessments need to be fluid, timely, and forward focused Concentrate on future risks and what may be obscured Focus on updating your plan and approach as stakeholder expectations and events impact your workload

17 Addressing Agility Prioritize Work According to What Matters Most Auditors can audit anything but they should not audit everything Look at highest risk and biggest impact areas Explore new technologies and audit approaches while still being disciplined, systematic, accurate, and timely

18 Addressing Agility Break the Mold and Create Teams with the Right Blend of Skills Well-rounded flexible resources bring a variety of competencies that are best able to respond to disruption Top three skills CAE s need are analytical/critical thinking, communication, and business acumen

19 Addressing Agility Coordinate with Other Resources in the Organization Internal audit should not operate as an island Consider collaboration with the other lines of defense

20 Innovation: Pursue Quantum Leaps

21 CAE Assessment of Internal Audit Innovation CAEs Who "Strongly Agree the Statement Characterizes Their Internal Audit Function Seeks new ways to improve collaboration within the organization. 45% 47% Seeks new ways to improve communication of results of engagements. 39% 44% Seeks new ways to gather evidential information to support audit work. 34% 43% Challenges the status quo of the internal audit function. 30% 32% Quickly adopts new technologies or processes. 13% 16% Public sector Non-public sector

22 Implementation of New Technology and Ideas Implementation Levels Full, Partial, Plans in Place, None Electronic workpapers 52% 22% 8% 18% Internal audit KPIs for stakeholders 20% 26% 23% 32% Data analytics 8% 53% 27% 12% Automation of routine tasks (e.g., robotic process automation) 1% 19% 21% 59% Automation of analysis of audit evidence (artificial intelligence) 1% 14% 14% 71% Full implementation Partial implementation Implementation plans are in place No implementation and no plans to do so

23 Electronic Workpapers Implementation of Electronic Workpapers Compared to Public Sector Type Federal/national 63% 16% 11% 11% State/provincial 54% 21% 5% 20% Local/city/county 48% 29% 10% 14% Other 45% 15% 15% 25% Full implementation Implementation plans are in place Partial implementation No implementation and no plans to do so

24 Internal Audit KPIs for Stakeholders Implementation of KPIs for Stakeholders Compared to Public Sector Type Federal/national 32% 16% 32% 21% State/provincial 20% 21% 18% 41% Local/city/county 12% 33% 26% 29% Other 25% 35% 20% 20% Full implementation Implementation plans are in place Partial implementation No implementation and no plans to do so

25 Internal Audit Use of Data Analytics Implementation of Data Analytics in the Internal Audit Function Federal/national 16% 47% 26% 11% State/provincial 5% 54% 25% 16% Local/city/county 10% 64% 24% 2% Other 10% 30% 40% 20% Full implementation Implementation plans are in place Partial implementation No implementation and no plans to do so

26 Automation of Routine Internal Audit Tasks (Robotics) Automation of Routine Internal Audit Tasks (Robotics) Federal/national 11% 16% 74% State/provincial 21% 20% 59% Local/city/county 2% 26% 24% 48% Other 5% 25% 70% Full implementation Implementation plans are in place Partial implementation No implementation and no plans to do so

27 Automated Analysis of Evidence (Artificial Intelligence) Automated Analysis of Evidence (Artificial Intelligence) Federal/national 11% 26% 63% State/provincial 13% 11% 75% Local/city/county 2% 19% 14% 64% Other 10% 10% 80% Full implementation Implementation plans are in place Partial implementation No implementation and no plans to do so

28 Addressing Innovation Recognize the Need for Self-Assessment and Challenge how Objectives are Being Accomplished Internal auditors need to devote time and effort to challenge themselves and search for opportunities to innovate Give staff time for self-assessment and opportunities to challenge the status quo

29 Addressing Innovation Embrace Technological Advances Only 13% of CAE s strongly agree that their internal audit functions are quick to adopt new technologies or processes There has been very little adoption of automated routine audit tasks (robotic process automation or automated analysis of audit evidence a type of artificial intelligence)

30 Addressing Innovation Do Not Blame the Failure to Innovate on the Lack of Resources Obtaining more or different resources requires agreement of the audit committee and support of management Need to change the mindset and it only requires a few people or examples to move the bar

31 Addressing Innovation Develop and Communicate the Case for Internal Audit to Actively Pursue Innovation Requires investment in time and return on investment through improved effectiveness, efficiency, and agility Specific proposals need to explain why changes in the audit approach and resource management will achieve internal audit s overall objective

32 Talent: Focus on Tomorrow s Risks

33 Sufficient Staff to Achieve Objectives 74% "Somewhat" or "Strongly" Agree That Staff Is Sufficient 64% 59% 46% Publicly traded Privately held Nonprofit Public sector

34 Recruiting Difficulty per Staff Level Level of Difficulty Director 73% 21% 6% Manager 66% 26% 8% Experienced auditor 55% 33% 11% Entry-level auditor 14% 45% 41% Very or extremely difficult Somewhat difficult Not difficult

35 Skills for Which Collective Competency Is Not Adequate "Strongly" or "Somewhat" Disagree Competency Is Sufficient Cybersecurity and privacy 47% Data mining and analytics 38% Basic IT knowledge 20% Innovative thinking 19% Fraud investigations and/or auditing 16%

36 Competencies with Most Recruiting Difficulty "Very" or "Extremely" Difficult Cybersecurity and privacy 80% Data mining and analytics 71% Industry-specific knowledge 59% Innovative thinking 53% Governance and culture 46%

37 Academic Degrees Preferred in Recruiting "Very" or "Extremely" Desirable 67% 78% 72% 75% 46% 42% 20% 24% 25% 10% Accounting or finance IT-related degree Business Operational or technical Public sector Non-public sector Communications

38 Responding to Competency Gaps "Very" or "Extremely" Likely Cosource work to specialist 50% 67% Cosource work to normal cosource provider 44% 63% Perform work only to extent of internal competencies 24% 38% Delay work until internal competencies are developed Exclude area from audit plan 7% 9% 11% 23% Public sector Non-public sector

39 Addressing Talent Make Sure the Risks that Drive Internal Audit s Scope Drive Staff Competencies and Not the Reverse Most CAE s feel they do not have the quantity an/or quality of personnel they believe they need. Most common solution is to co-source work. Altering scope to avoid risk cannot be a long-term strategy

40 Addressing Talent Develop a Talent Strategy to Ensure the Right Pipeline of Qualified Personnel Look at skills and level of resources needed and develop plan to ensure they are available Limitations to scope should not be part of the strategy Use of co-sourcing resources can be a valid part of a well planned talent strategy

41 Addressing Talent Engage Stakeholders and Obtain Their Support for Internal Audit s Talent Management Strategy Such a strategy needs to be communicated and approved by executive management and the audit committee

42 Addressing Talent Start Looking for Candidates with Different Backgrounds Most recruited degrees are accounting and finance followed by IT When looking for analytical/critical thinking, communication, and business acumen consider operational and technical backgrounds

43 Addressing Talent Reconsider Which Skills are Most Essential for Success Half of the CAE s say data mining/analytics and cybersecurity are only somewhat or not essential skills However they are rated the lowest when evaluating the collective competencies of their function Data analytics can be used as a key enabler for innovation and cybersecurity is a key risk area that needs to be addressed and both these competencies need to be elevated

44 Addressing Talent Include Future Focused Training and Development Programs Geared Towards Specific Levels of Staff CAE s will not be able to hire their way out of this skills shortage Innovative thinking, communication, technology, and other skills that support innovation and agility are in short supply CAE s need to focus on building these skills among existing staff

45 Addressing Talent Professional development and nonconventional training opportunities including one-on-one coaching, team coaching, and self directed or high impact learning opportunities wiled influence when attempting to recruit and retain employees Need a supportive culture for professional development Develop specific annual targets and provisions for training to help ensure a high level of collective proficiency

46 Board: Move from Oversight to Engagement

47 CAE Meets with Audit Committee Chair Without Management* Publicly traded 75% 17% 8% Privately held 53% 23% 23% Public sector 54% 18% 29% Nonprofit 42% 42% 17% Strongly agree Somewhat agree Strongly or somewhat disagree *Among those with audit committees

48 Audit Committee Input Included in Internal Audit Plan Nonprofit 68% 26% 6% Public sector 67% 22% 10% Publicly traded 63% 32% 5% Privately held 58% 39% 3% Strongly agree Somewhat agree Somewhat or strongly disagree *Among those with audit committees

49 Audit Committee Approving Staff and Budgets Privately held 51% 26% 22% Publicly traded 57% 28% 15% Nonprofit 38% 31% 31% Public sector 33% 28% 40% Strongly agree Somewhat agree Strongly or somewhat disagree *Among those with audit committees

50 Addressing Board Engagement Increase the Audit Committee s Involvement with Internal Audit s Resources and Performance Having audit committee members more involved in reviewing and approving resources and providing direct feedback on performance will enable the committee to better support the work of internal audit

51 Addressing Board Engagement Improve the Audit Committee s Understanding of the Risks the Organization Faces CAE s need to help audit committee members become more knowledgeable about risk management and internal control systems

52 Addressing Board Engagement Discuss with the Audit Committee Those Situations Where the CAE Disagrees with Management Relationships with management can vary substantially over time and within the organization CAE s should work to build awareness among audit committee members that the audit committee is the true driver and enabler of internal audit effectiveness The audit committee needs to fully understand internal audit s views on risk, control, resources, and performance and stand with IA on any disputes

53 Risk Insight: Organizational Use of Data Analytics

54 Organizational Maturity for Use of Data Analytics 42% 49% 33% 25% 23% 23% 1% 4% Initial Developing Established Mature Public sector Non-public sector

55 Residual Risk Related to Organization s Data Analytics Residual Risk Rated as "Extensive" Data completeness 12% 24% Data accuracy 15% 23% Accuracy/integrity of analysis 10% 20% Reporting clarity and usefulness 9% 20% Governance structure for data analytics activities 7% 19% Public sector Non-public sector

56 Internal Audit Management Insights Public Sector

57 Functional Reporting Lines Federal/national 58% 32% 11% State/provincial 67% 18% 15% Local/city/county 69% 21% 10% Other 80% 5% 15% All 68% 19% 13% Board, audit committee CEO, president, agency head Other executive leadership

58 Administrative Reporting Lines Federal/national 58% 11% 5% 26% State/provincial 51% 10% 11% 28% Local/city/county 33% 17% 24% 26% Other 60% 30% 5% 5% All 48% 15% 13% 24% CEO, president, agency head Board, audit committee CFO, other financial executive Other executive leadership

59 Allocation of Audit Effort by Risk Area Compliance/regulatory (not related to financial reporting) Operational (not included elsewhere) Financial areas other than financial reporting IT (not covered in other choices) Fraud identification and investigation (not covered in other Cyber (prevention and/or recovery) Enterprise risk management programs and related processes Governance and culture Cost/expense reduction or containment Management of third-party relationships Support for external audit Other risk category not listed Financial reporting (including Sarbanes-Oxley testing) 9% 9% 7% 6% 6% 6% 5% 4% 3% 2% 2% 20% 21%

60 Staffing Staff Size Changes in the Past 12 Months 1 to 3 13% 85% 3% 4 to 9 20% 70% 11% 10 to 24 38% 50% 12% 25 or more 45% 27% 27% Increased Remained the same Decreased

61 Skill Importance for Internal Audit - Overview "Most" or "Very" Essential Analytical/critical thinking Communication skills 91% 94% Understanding the audit process Innovative thinking Understanding of professional ethics Persuasion and collaboration 85% 85% 84% 82% Understanding the IPPF Process improvement Business acumen 74% 73% 76% Governance and culture Industry-specific knowledge Internal audit management/supervision Basic IT knowledge Risk management assurance 65% 64% 63% 63% 62% Accounting and finance Data mining and analytics Fraud investigations and/or auditing 54% 53% 56% Cybersecurity and privacy 47%

62 Skill Importance for Internal Audit Top 6 "Most" or "Very" Essential (Top 6) Analytical/critical thinking 94% Communication skills 91% Understanding the audit process 85% Innovative thinking 85% Understanding of professional ethics 84% Persuasion and collaboration 82%

63 Questions?

64 Public Sector Virtual Symposium Special Rate Go to:

65 Thank you The Institute of Internal Auditors John Wszelaki Director, Public Sector Audit Center