1. Measuring the Impact of Internal Audit in Uncertain Times IIA Bombay Chapter Research Foundation Project20 November 2012

2. About the IIA Bombay Research Foundation IIA Bombay Chapter has recently launched IIA Bombay Research Foundationwith the objective of being the research arm of The IIA Bombay Chapterconducted by thought leaders in the profession. The Foundation aims to be a driving force for the continuous evolution of theprofession through conducting surveys, publishing research reports coveringthe full spectrum of issues facing the profession and through such otherinitiatives that explore current issues, emerging trends, and future needs. Thisfoundation is led by a committee of IIA Bombay Chapter Mr. Naren Aneja, Mr.Nagesh Pinge, Mr. Anil Bhandari, Mr. Satish Shenoy and Mr. S Bhaskar. IIA Bombay Chapter has identified Verita Management Advisors as its firstresearch partner enabling IIA Bombay Chapter to launch this new initiative.Verita Management Advisors along with IIA Bombay Chapter, has developedthis research document titled Measuring the Impact of Internal Audit inUncertain Times. 3. About the Research Study The research team designed a detailed research cum survey questionnairethat was circulated to 50 Chief Audit Executives (CAEs) of large and mediumsized companies. The research team received replies from 30 participantspredominantly from the Mumbai region. The research team also conducted 5personal interviews with CAEs of leading corporate houses to obtain detailedreplies on the direction of the IA function in uncertain economic times. The research team received responses from varied sectors. 4. IA Value perception is tilted towards reassuranceThe internal auditors job appears to have become one of reassuring senior management and theboard of directors that their business is being run in a manner that satisfactorily deals with the risks itfaces. It is not sufficient that those risks are avoided.Managements and boards are in a highly competitive environment and expect that risks are exploitedso as to maximize shareholder value. Therefore, they expect to have a better ways of fine-tuning theirresponse to specific risks than do their competitors. Bankers want to fine tune their response to creditrisk in the hope that they can offer loans at lower rates of interest to their borrowers withoutcompromising on credit risk cost. Other managements want to game regulations or contractualobligations hoping to steal a march over their competitors.Many companies have developed a (poor) reputation for changing the terms of Competitively wonbids after winning them. Or they sail very close to the legal wind hoping that the regulators gust doesnot overturn their ship. Again, the only protection against disaster that managements and boards ofcompanies that build their business on such practices have is a competent audit. Internal audit isrequired to possess ever greater degrees of expertise in the subjects that it is required to deal with.The days of the general internal auditor are over. - Nawshir Mirza, Independent Director 5. Adding Value To The Audit Committee/ Board Of DirectorsQ 1: In uncertain times how does a modern day IA function add value to the Audit Committee/Board of Directors? 93% of respondents agreed or strongly agreed that the IA function could add value by - Greater level of engagement with stakeholders - Enhance focus on compliances Graph - Closer monitoring of critical processes to isolate outliers - Adopting a leaner approach to audit by focusing on high risk areas Majority of the respondents agreed or strongly agreed on the following additional measures where the IA function could add value by: -Continuous Control Monitoring -Greater use of subject matter experts -Benchmarking of processes /indicators with competition Graph A large majority of respondents disagreed that the IA function could add value by: - Reducing the IA budget - 70% - Reducing internal talent and placing more reliance on outsourced service providers - 63% - Each audit mission to carry a value multiple target - 58% 6. Adding Value To The Audit Committee/ Board Of Directors 7. Adding Value To The Audit Committee/ Board Of Directors 8. Nurturing An Effective IA FunctionQ 2: What are the real differentiators between a performing Internal Audit function and a non-performing one?All the respondents agreed or strongly agreed that following measures are key differentiators between aperforming IA function and a non-performing one:- Building continuous learning mechanisms- Implementation of Internal Audit Function Performance score card- Adopting technology to provide a greater degree of assurance and add to the surveillance capabilitiesMajority of the respondents agreed or strongly agreed on the following additional differentiators:- Managing an appropriate balance between audit requirements and staffing levels- Attract and retain subject matter experts- On-time report delivery- Attract and retain quality service partners- Constant engagement with the chair of audit committee- Successful completion of annual audit calendar- Implementation focus- Automation of audit workflow- Exceed the expectation set by the audit committee 9. Nurturing An Effective IA Function 10. The New Business Risk NormalQ3. What are the new risk factors that you would like to address in an uncertainbusiness environment?Order of Significance on a scale of 1 to 5 where 1 is least significant28 respondents participated in ranking the new risk normal grid. The Top 5 rankings weregiven to the risks:- Rising cost pressures- Frauds- Growing compliance complexities- Liquidity, Lack of business resilience and inability to meet growing customer needs- Lack of innovationThe respondents agreed that business and IA teams should focus their attention on Top 5risk rankings in uncertain economic times. 11. The New Business Risk Normal 12. Measuring the Impact of IA Percentage completion of the annual audit calendar. Red flags identified by the internal audit team as Early warning signals on serious compliance and/ orcontrol violations that would be have dire reputational consequences to the organization. The trend of non-repeat audit observations made by the internal auditor during the year. Assessing howmany known issues have been implemented by the management team. The percentage of audit observations that could be classified as Cost Savings or Revenue Leakageopportunities. This is an effectiveness measure which indicates the element of effective value add by theinternal audit function. The productivity of the internal audit team in terms of available resources, audit per resource efficiency,audit cycle time, etc. The percentage of High Risk/ Key audit observations identified by the internal audit team during the year. The percentage of unimplemented/ uninitiated audit observations during the year. Number and quality of instances highlighted of internal and/ or external benchmarking for standardizationand organizational consistency. Percentage achievement of audit goals, objectives and initiatives during the year. IA acceptability, attention/ perception and satisfaction feedback from the executive management team. IA budget on training, learning and development IA ability to attract and retain talent especially subject matter experts IAs participation in on-going risk assessment projects IAs participation in on-going change management projects IAs participation in control advocacy and continuous improvement programs 13. A Global view on building a world class IA functionOne impact of this soul searching has been that leading companies are taking steps to build a worldclass IA function. They have realized that for IA to truly add business value their horizons must bebroadened to cover the effectiveness of Enterprise Risk Management (ERM). Also as the crisesshowed, there is a high degree of interrelation between various risks and therefore management and IAshould be cognizant of how each risk element impacts the other and the organization as a whole.Limiting the ambit of IA to traditional internal controls assessments focused on compliance, technologyand financial controls is no longer sufficient. A key step toward building a world class internal auditwould be to realign the focus of IA to these two key areas: Strategic Risk Execution RiskFor IA leaders to win the proverbial seat at the table with other C Level executives, it is critical forthem to be aware of the strategic landscape within their respective industries and how theirorganizations strategy is set and executed within that environment. Internal Audits role shouldencompass an assessment of the organization strategy setting and execution processes. For e.g. howdoes the organization deal with the risks of an uncertain business environment? How does theorganization identify and prepare for potential black swan events?The best strategic plans have to be backed by good execution. How often does an IA function getinvolved in assessing the execution risk to the organizations strategy? Execution is after all is whattranslates strategy into actual results. IA should assess practices, processes and controls of theorganizations execution capabilities. Uday Gulvadi, US based senior GRC professional 14. The Lean, Mean and Hungry tribe of Internal Auditors1. CAE recruitment by the Chairman of the Audit Committee and not CEO2. CAE role expanded to include dealing with whistle blower matters3. Internal Benchmarking of best practices followed by SBUs and periodical recognition of best practices in IA knowledge sharing bulletins4. Continuous control advocacy through quarterly knowledge forum meetings5. Aligning the IA function to the Voice of the Customer through CAE induction in the business programs of the company6. CAE participation as an observer in Key Business Review meetings conducted by the CEO7. CAE personally participates in all audit closure meetings to ensure quality and timeliness8. On-time audit reporting at audit closure meetings9. Scoping the audit efforts through a Vital, Essential and Desirable Matrix approach based on core and non-core process bifurcation10. Audit Champions play the lead coordination role to overcome audit delays/ auditee non-cooperation11. Independent Methods team which documents SOPs and process narratives to keep the audit process live tocurrent business realities 15. Thank you