Internal Audit: Emerging Trends and

Risks for the Future

Cyndi Plamondon, CIA, CCSA, CGAP, CFSA, CRMA, CISA

Vice President, Global Professional Certifications

The Institute of Internal Auditors – Global HQ

Overview

• Emerging global internal audit trends

• Other trends of note

• The outlook ahead

• Key risks facing the profession

2013 Global Survey

Demographics

• Conducted February 2013

– 5th Consecutive year

– 37% $1B or more

– 63% Public/private

companies

• 1700 Responses – 74% internal audit

managers or above

– 63% CAEs

• Geographic Distribution – 33% North America

– 29% Europe

– 17% Latin America

– 9% Asia Pacific

– 9% Africa

Five Key Trends

Emerging in 2013

1 • Elevating Our Stature

2 • Standing Our Ground

3 • Changing Our Game

4 • Doing More With More

5 • Fine Tuning Our Ethical Compass

Elevating Our Stature

Internal Audit’s Stature

• Often reflected by:

– How internal audit is perceived

– How the function is used

– To whom the CAE reports

• Reporting relationships

– Administrative reporting relationship

– Functional reporting relationship

• Has consistently migrated upward over the

past decade Source: The IIA Audit Executive Center

CFO – 21%

Other 14%

Internal Audit Administrative

Reporting Relationships

CEO – 43%

AC – 9%

BOD – 8%

Chief Compliance

Officer– 1.5%

General Council – 3%

Source: “The Pulse of the Profession: © 2013 The IIA Audit Executive Center

Internal Audit Administrative

Reporting Relationships

CEO – 33%

CFO – 37%

CEO – 51%

CFO – 12%

CEO – 56%

CFO – 22%

CEO – 50%

CFO – 13%

Source: “The Pulse of the Profession: © 2013 The IIA Audit Executive Center

CEO – 52%

CFO – 12%

Other 10%

Internal Audit Functional

Reporting Relationships

CEO – 18% Audit Committee –

54%

Full BOD – 12%

Source: “The Pulse of the Profession: © 2013 The IIA Audit Executive Center

Internal Audit Functional

Reporting Relationships

AC – 73%

Full BoD – 3%

CEO – 10%

AC – 37%

Full BoD – 20%

CEO – 28%

AC – 77%

Full BoD – 2%

CEO – 11%

AC – 41%

Full BoD – 21%

CEO – 28%

Source: “The Pulse of the Profession: © 2013 The IIA Audit Executive Center

AC – 62%

Full BoD – 7%

CEO – 21%

Internal Audit Contributes “Significant

Value” to the Organization

• Board members – 79%

• Executive management – 44%

• Less than 50 percent of management believe

internal audit performs well/very well at:

– Promoting quality improvement and innovation

– Leveraging technology

– Delivering cost effective services

– Delivering services with a service oriented team Source: PwC, “Reaching for Greater Heights: Are You Prepared for the Journey,” © 2013 Pricewaterhousecoopers LLP

The Top 5 Adjustments Internal Audit

Needs to Make

Internal Audit’s View

1. Improve risk assessment process

2. Enhance ability to monitor

emerging risks

3. Become more relevant to

achieving our organization’s

business objectives

4. Reduce overall IA function costs

without compromising risk

coverage

5. Identify opportunities for cost

savings in our business

Our Stakeholders’ Views

1. Improve risk assessment

2. Enhance ability to monitor

emerging risks

3. Identify opportunities for cost

savings in business

4. Enhance coverage of identified

key risks

5. Reduce “audit fatigue” on

business

Source: Ernst & Young, Internal Audit Survey: A Survey Conducted by Forbes Insights on Behalf of E&Y, © 2013

Standing Our Ground

Standing Our Ground

• Our stakeholders look to us for: – Objective assurance on risk and controls

– Insight on business risks

– Advise and assistance as warranted

• Stakeholders also look for us to: – Demonstrate courage

– Deliver difficult news when warranted

– Call it like it is

– Not change or conceal results under duress

• Survey indicates we are “standing our ground”

Operating Management 20%

CEO 12%

CFO 12%

Legal or General Counsel 5%

Full Board of Directors 4%

Audit Committee 4%

Chief Risk Officer 4%

Chief Compliance Officer 4%

Source: “The Pulse of the Profession: © 2013 The IIA Audit Executive Center

Have Any of the Following Ever

Attempted to Unduly Influence

an Internal Audit Report?

Report To: Percentage

Audit Committee 52%

CEO 19%

Full Board of Directors 18%

CFO 1%

Legal or General Counsel 1%

Other/Unsure 9%

Source: “The Pulse of the Profession: © 2013 The IIA Audit Executive Center

22% of Respondents Believed

Internal Audit Would Be More

Independent if It Reported to:

Changing Our Game

Changing Our Game

• Rebalancing of internal audit plans has

been ongoing for several years

• Driven by:

• Changing risks and expectations

• Compliance burdens

• Risk Management assurance

• Technology

• Requisite skills must evolve and

broaden to address emerging risks

• Successful CAEs must have prescience:

ability to “see around corners”

Fraud 5% Operational 28%

Financial – 21%

Compliance

14%

Strategic/

Business 5%

Other 11% Risk Mgt

Assurance 7%

IT – 9%

Distribution of Typical Internal

Audit Coverage in 2013

Source: “The Pulse of the Profession: © 2013 The IIA Audit Executive Center

Distribution of Typical Internal

Audit Coverage in 2013

OP - 27%

FIN – 27%*

COMP – 15%

OP - 29%

FIN – 19%

COMP – 13%

OP - 27%

FIN – 19%

COMP – 14%

OP - 31%

FIN – 15%

COMP – 14%

Source: “The Pulse of the Profession: © 2013 The IIA Audit Executive Center

* Inclusive of Sarbanes-Oxley work

OP - 29%

FIN – 18%

COMP – 12%

Risks Seen As Increasing The

Most in the Last Year

• Economic uncertainty

• Regulations and government policies

• IT security/cyber security

• Data privacy

• Government spending and taxation

• Competition

• Commercial market shifts

• Financial markets

Source: PwC, “Reaching for Greater Heights: Are You Prepared for the Journey,” © 2013 Pricewaterhousecoopers LLP

“Perhaps one of the biggest challenges for audit

executives is the ongoing quest to rebalance

traditional internal audit activities and methods

while becoming more strategic in mindset and

progressive in work approach.”

Grant Thornton LLP

Analytical/critical thinking 72%

Communication skills 54%

Risk management assurance 44%

IT (general) 41%

Data mining and analytics 37%

Accounting 33%

Industry-specific knowledge 32%

Business acumen 29%

Source: “The Pulse of the Profession: © 2013 The IIA Audit Executive Center

Requisite Skills For Internal

Auditing Continue to Evolve

Internal Audit Areas of Technical

Knowledge Needing Improvement

• Social media applications

• Recently enacted IIA Standard 1110 –

interpretation of functional reporting

• Recently enacted IIA Standards 2010.A2 and

2410.A1 – audit opinions and conclusions

• GTAG 16 – Data Analysis Technologies

• Recently enacted IIA Standard 2450 – Cloud

Computing

Source: Protiviti “Audit Capabilities and Needs Survey Report,” © 2013 Protiviti, Inc

The Top 10 Risks for 2013 1. Regulatory changes and heightened regulatory scrutiny

2. Current economic conditions

3. Uncertainty surrounding political leadership worldwide

4. Organic growth through customer acquisition/enhancement

5. Succession challenges and the ability to attract and retain top talent

6. Anticipated volatility in global financial markets and currencies will

create challenges

7. Cyber threats

8. Ensuring privacy/identity management and information

security/system protection

9. Resistance to change

10.Existing operations may be unable to meet quality, time-to market,

cost and innovation expectations

Source: Protiviti and North Carolina State University’s ERM Initiative, © 2013 Protiviti, Inc

Doing More With More

Positioned for Success

• Financial crisis impact on

internal audit resources was

swift and noteworthy

• Staffing

• Budgets

• By 2011 more than 40% of

internal audit functions reported

reduced staffing

• After sluggish recovery – 2013 is

poised to be the strongest year

since 2007

The Outlook for Global Internal

Audit Resources is Strong

• Budgets:

• Staffing:

Increase Stable Decrease

Overall 33% 55% 12%

Change from 2012-2013

Increase Stable Decrease

Overall 22% 69% 9%

Change from 2012-2013

Source: “The Pulse of the Profession: © 2013 The IIA Audit Executive Center

The Outlook for Global Internal

Audit Budgets by Region

+39%

- 10%

+48%

- 3%

+47%

- 7%

+19%

- 14%

+47%

- 10%

Source: “The Pulse of the Profession: © 2013 The IIA Audit Executive Center

The Outlook for Global Internal

Audit Staffing by Region

+23%

- 5%

+24%

- 4%

+20%

- 6%

+17%

- 10%

+22%

- 6%

Source: “The Pulse of the Profession: © 2013 The IIA Audit Executive Center

Fine Tuning Our Ethical Compass

Our Self-Perception

We see ourselves as the guardians

of trust in our organizations: Far

more likely to disclose ethical

misconduct than to misbehave

ethically ourselves!

The Reality – Ethical Lapses Are Starting to Take a Toll!

Internal auditor faces

charges in Satyam scandal Central Bureau of Investigation (CBI)

laying new charges against 10

defendants regarding fake invoices,

inflated revenues, unauthorised loans

and attempted cover ups….

32% of CAE’s acknowledge that

they have “discovered or witnessed

unethical actions” within their

internal audit functions!

Source: Survey of 70 CAE’s attending AEC Roundtable – March 17, 2013

The Problem is Not Isolated

The Media Is Starting to “Connect the Dots”

From Some of the Recent Ethics Lapses

“Infernal Audit:

When Internal Auditors Go Bad” How is a company supposed to avoid corrupt payments when the individual

tasked with finding out about corrupt payments (the CAE) and reporting

them to the Board of Directors is himself complicit in the bribery scheme? Source: Forbes.com, “Infernal Audit: When Internal Auditors Go Bad,” Howard Sklar,

February 24, 2012

Ethical Lapses Are

Resulting From:

• Loyalties to other senior executives

• Desire to protect the organization

• Protection of career opportunities

• Conflicts of Interest

• Lack of courage and integrity

• Disregard of “The IIA Code of Ethics”

7 Traits of Ethical Internal

Audit Leaders

• Honest

• Courageous

• Accountable

• Empathetic

• Trustworthy

• Respected

• Proactive

The Ethics Continuum

Beyond Our Traditional Roles?

Other 2013 Trends of Note and the Outlook Ahead

Other Global Trends Worth

Watching in 2013

• Internal audit focus by global Financial

Services regulators

• Response to newly adopted IIA Standards

• Internal audit reporting lines

• Internal audit qualifications

• Increased emphasis on emerging

technology risks

• New listing requirements

Source: The IIA Audit Executive Center

Five Imperatives For the

Remainder of the Decade

Enhancing and

leveraging a continuous

focus on risks

Providing assurance on

risk management effectiveness

Enhancing our

proficiency with data

mining and analytics

Securing a “seat at the table” for

operational and strategic discussions

Solidifying our expertise to address key

risks

Five Strategic Risks That

Could Derail Our Progress

• Failure to concentrate on

high-risk areas: “Where was

internal audit?”

• The emergence of competitive risk, controls and

governance functions that “outperform” us

• Failure to align with expectations of key

internal audit stakeholders

• High-profile failures of internal

auditor integrity

• Failure to embrace professional standards

Questions?

The Institute of Internal Auditors

Cyndi Plamondon, CIA, CGAP, CCSA, CFSA, CRMA, CISA

Vice President, Global Professional Certifications

cyndi.plamondon@theiia.org

© 2013 The Institute of Internal Auditors. All Rights Reserved.

Thank you for your attention!