PKF Littlejohn LLP INTERNAL AUDIT EFFECTIVENESS REVIEW INSURANCE

PKF Littlejohn LLP INTERNAL AUDIT EFFECTIVENESS REVIEW INSURANCE

INSURANCE Staying effective in a changing landscape It has never been more important to make sure your internal audit function is operating as effectively as possible, and PKF Littlejohn is here to help you carry out the rigorous review you need. PKF Littlejohn s internal audit survey for 2015 reported that, where internal audit functions have engaged with the regulators over the last 12 months, this has usually been to discuss evaluation and testing of internal audit effectiveness. This shows it is vital to have a robust process in place for assessing internal audit effectiveness one that you can demonstrate to the regulators with confidence. The last few years have seen several changes in internal audit in the financial services sector. Here are three of the main reasons why: The financial crisis This has led to a greater focus on the importance of effective governance, risk management and internal control. Regulators have become more concerned with and more reliant on the effectiveness of internal audit functions. Solvency II The move towards implementing Solvency II has had wide ranging implications for the governance, risk management and internal control of insurers. These include specific requirements for an effective internal audit function. As implementation gets closer, now is the time for insurers to assess whether their internal audit function is fit for purpose for Solvency II. New CIIA and Global IIA guidance In 2013, the Chartered Institute of Internal Auditors issued new guidance for effective internal audit in the financial services sector. This raised the bar for internal audit functions and redefined what it means to be effective. More recently, the Global Institute of Internal Auditors has introduced a new International Professional Practices Framework (IPPF) for internal audit. This recognises the need for the profession to adapt to the speed of global change and risk. The new IPPF provides a strong, flexible framework for internal audit and helps ensure internal audit has what it takes to tackle new and emerging risks and challenges. Why have an effectiveness review? An internal audit effectiveness review will assess whether the internal audit function is capable of responding and adapting to organisational change and risk staying effective and ahead of the game. The International Standards for the Professional Practice of Internal Auditing require an external assessment of the internal audit function at least once every five years. This must be carried out by a qualified, independent assessor or assessment team from outside the organisation. However, there are also many other good reasons to review the internal audit function regularly: To identify improvements to meet best practice. To address any specific issues/ concerns of the Audit Committee. it is vital to have a robust process in place for assessing internal audit effectiveness To help raise the profile and value of internal audit across the business. To give the internal audit function a valuable insight into what it s like to be audited, so it can learn from the experience. 1 INTERNAL AUDIT EFFECTIVENESS REVIEW

The PKF Littlejohn approach We ve developed a six-stage framework, which begins with assessing the overall scope and authority of internal audit setting the tone and providing the core for all internal audit activities. We examine the processes for internal audit planning and execution; the internal audit function s resources; and the way internal audit engages with key stakeholders across the business. Finally, we assess how the Audit Committee oversees the internal audit function. INTERNAL AUDIT EFFECTIVENESS REVIEW OVERSIGHT BY THE AUDIT COMMITTEE PLANNING RESOURCES EXECUTION INTERNAL AUDIT SCOPE AND AUTHORITY Scope and authority ENGAGEMENT Is the scope and authority appropriate for the size and nature of the business? What is the position and standing of the Head of Internal Audit and how does the business as a whole view the internal audit function? Does the internal audit charter clearly define the role and responsibilities of internal audit as well as its independence, objectivity, scope and authority? Is the internal audit charter supported by clear explanations of how internal audit will carry out its functions and interact with key stakeholders? Planning Is there a robust yet flexible planning process that is consistent with the business structure and its current and emerging risks? Is there a suitable process for planning and resourcing difficult areas such as business strategy, culture and tone at the top, key corporate events and insurance technical areas? Is the internal audit plan regularly reviewed and approved? Execution Is there a clearly defined methodology to ensure that internal audits are carried out properly and meet their objectives? Is internal audit planning, execution and reporting documented adequately? Is the accuracy, quality and clarity of internal audit findings properly reviewed and challenged? Is there effective monitoring and reporting on the way internal audit recommendations have been put into place? Resources Is the internal audit function the right size, and does it have the right skills and experience to deliver the internal audit plan? How are the skills of the internal audit function assessed and developed? How is resource planning managed? Are any external resources used or needed? Engaging with key stakeholders How does the internal audit function engage with senior management and the business areas for instance, for keeping up to date with business developments and for informing senior management of internal audit s activities? How does internal audit interact with risk management, compliance and other assurance providers such as external auditors, to ensure an efficient, integrated assurance framework? How does internal audit engage with the regulators? Working with the Audit Committee Is the Audit Committee s role and responsibility for internal audit clearly defined? Is there sufficient engagement with the Audit Committee and reporting of management information? What methods and metrics does the Audit Committee use to assess the independence, activities and effectiveness of internal audit and how are they monitored? Does the Audit Committee provide a sufficient level of challenge over internal audit plans and reports? INTERNAL AUDIT EFFECTIVENESS REVIEW 2

Getting it right for your business We work closely with the Head of Internal Audit and Chair of the Audit Committee to develop a detailed approach, designed to work for your business. Our approach is always tailored, not a tick box exercise. An effective review carried out on these principles adds value to existing internal audit procedures, suggests improvements which are both appropriate and proportionate, and meets the assurance requirements of the Audit Committee. For your business, this might take the form of a full review by PKF Littlejohn. Alternatively, it could be appropriate to carry out a partial review. In this case, the internal audit function carries out its own self-assessment/gap analysis which PKF Littlejohn then reviews and provides feedback. Our report indicates compliance, partial compliance and non-compliance with each area. Unique experience and insights Working with PKF Littlejohn on your internal audit effectiveness review, you ll work closely with senior team members, who bring an exceptional degree of experience and insight to the process. We will benchmark your internal audit function, drawing on extensive experience of both establishing new internal audit functions and working alongside long established functions in the London Market. You will also benefit from unique insights drawn from our definitive surveys of Effective Internal Audit in the London Market in 2014 and 2015. Actions for an effective review Your review will always involve: Thorough examination of key documents (including the internal audit charter, procedures, plans and reports). Questionnaires and/or interviews with the Head of Internal Audit, Audit Committee members, senior management and auditees across the business. Review of internal audit files. Throughout, we work in a collaborative way and provide the support you need right from planning and scoping your review, to carrying out fieldwork, producing draft and final reports and reviewing your improvement plans, and how you put them into practice. you ll work closely with senior team members, who bring an exceptional degree of experience and insight to the process INTERNAL AUDIT EFFECTIVENESS REVIEW 3

INSURANCE Contact us To find out more about establishing your internal audit effectiveness review with our expertise at your side, please contact our team. Philip Alexander T: +44 (0)20 7516 2444 E: palexander@pkf-littlejohn.com Neil Coulson T: + 44 (0)20 7516 2270 E: ncoulson@pkf-littlejohn.com Jessica Wills T: +44 (0)20 7516 2229 E: jwills@pkf-littlejohn.com 4 INTERNAL AUDIT EFFECTIVENESS REVIEW

PKF Littlejohn LLP, 1 Westferry Circus, Canary Wharf, London E14 4HD Tel: +44 (0)20 7516 2200 Fax: +44 (0)20 7516 2400 www.pkf-littlejohn.com This document is prepared as a general guide. No responsibility for loss occasioned to any person acting or refraining from action as a result of any material in this publication can be accepted by the author or publisher. PKF Littlejohn LLP, Chartered Accountants. A list of members names is available at the above address. PKF Littlejohn LLP is a limited liability partnership registered in England and Wales No. 0C342572. Registered office as above. PKF Littlejohn LLP is a member firm of the PKF International Limited family of legally independent firms and does not accept any responsibility or liability for the actions or inactions of any individual member or correspondent firm or firms. PKF International Limited administers a network of legally independent firms which carry on separate business under the PKF Name. PKF International Limited is not responsible for the acts or omissions of individual member firms of the network. September 2015