www.pwc.com
Reaching Greater Heights:
Are You Prepared for the
Journey?
2013 State of the Internal Audit
Profession Study
April 18, 2013
© 2013 PricewaterhouseCoopers LLP. All rights reserved.
With you today
Chris Lydon
Internal Audit Director
314 276 2000
christopher.lydon@us.pwc.com
Valerie Caporuscio
Data Assurance Manager
(330) 686-2698
valerie.j.caporuscio@us.pwc.com
PwC
© 2013 PricewaterhouseCoopers LLP. All rights reserved.
April 2013
2
Agenda
• Introductions
• PwC’s 2013 State of the Internal Audit Profession study
- Heart of the matter
- Examining the issues
- The opportunity: defining greater heights
- The path forward
• Data analytics discussion
• Questions and answers
PwC
© 2013 PricewaterhouseCoopers LLP. All rights reserved.
April 2013
3
At a glance
• 9th Annual State of the Internal Audit Profession Study
• Second year where we explored the impact of Internal
Audit from the lens of a stakeholder
• Over 1700 respondents, Audit Committee Chairs, Board,
CEOs, and CFOs, participated including 630 executive
stakeholders
• Over 140 personal executive interviews conducted
• Focus areas included
- Stakeholder’s expectations of IA
- Performance and value of IA’s contribution
- IA’s contributions in emerging risk areas
- Characteristics of IA functions
PwC
© 2013 PricewaterhouseCoopers LLP. All rights reserved.
April 2013
4
Heart of the matter
PwC
© 2013 PricewaterhouseCoopers LLP. All rights reserved.
April 2013
5
Heart of the matter
Stakeholders want more and internal audit can deliver
Internal audit continues to
face challenges
• Stakeholders are not aligned in
their views on internal audit’s
value and performance
• Internal audit’s capabilities are
not keeping up - what was once
leading practices are now the
new floor
Key takeaways
• Alignment must be achieved
amongst stakeholders and
CAEs on internal audit’s role
in the organization, what
internal audit value means and
where internal audit should be
focused
• Internal audit must break the
cycle of inaction and improve
its performance on eight core
attributes
• Internal audit continues to
struggle in maximizing its
contribution, especially in less
traditional areas Internal
audit’s performance is not
Our
research
revealed
keeping
up withhas
– what
was internal audit functions performing at
a high
level
provide
once
leading
is now
the newa distinctively different level of service
floor
April 2013
PwC
© 2013 PricewaterhouseCoopers LLP. All rights reserved.
6
The new floor
PwC
© 2013 PricewaterhouseCoopers LLP. All rights reserved.
April 2013
7
Examining the issues
PwC
© 2013 PricewaterhouseCoopers LLP. All rights reserved.
April 2013
8
Examining the issues
Our survey data revealed the circular nature of the internal audit
challenges
The issues of stakeholder
alignment, a challenged
capability foundation and suboptimal internal audit
contribution are tightly
interwoven
Internal audit must break the cycle of inaction and increase its
capabilities or risk being marginalized in comparison to other risk
functions
PwC
© 2013 PricewaterhouseCoopers LLP. All rights reserved.
April 2013
9
Examining the issues
Stakeholders are not aligned in their views on internal audit’s
value and performance
Value
At the most fundamental
level, stakeholders have
significantly different views
of internal audit value
79% of board members
see significant value,
while only 44% of
management do
Performance
This year’s research
confirms that strong
performance in the eight
core attributes directly
correlates to greater value.
56% of the board ranks
IA performance as
strong, while 37% of
management do
Critical Risks
Stakeholders are not aligned
on critical risks facing the
organization which creates
challenges for internal audit
in addressing those critical
risks
60% of the board
members believe risks
are well managed vs.
52% of management
Board members’ views on value versus performance do not
reconcile – 79% see significant value, yet only 56% view
performance as strong – a 23% difference
PwC
© 2013 PricewaterhouseCoopers LLP. All rights reserved.
April 2013
10
Examining the issues
Internal audit capabilities are not keeping up
How well is internal audit performing in each of the following areas?
Promoting quality improvement and innovation
Leveraging technology (such as automation, data and advanced analytics)
Delivering cost-effective services
Delivering services with a service-oriented team
Engaging in and managing a relationship with stakeholders
Obtaining, training and/or sourcing the right level of talent for audit needs
Aligning scope and audit plan with stakeholder expectations
Focusing on critical risks and issues
0%
20%
40%
60%
80%
100%
Percent of stakeholders who say internal audit is performing well
or very well
Our survey revealed promoting quality improvement, leveraging
technology and obtaining right talent as three key focus areas
PwC
© 2013 PricewaterhouseCoopers LLP. All rights reserved.
April 2013
11
Better integration of technology through data
analytics
Analytics
are widely
viewed as
important
81%
Data analytics are
important to improving the
quantification of issues
Yet few
have
strong
programs
31%
Data analytics are integrated
into the audit process and used
regularly
PwC
85%
Data analytics are important
to strengthening audit
coverage
And most
intend to,
yet lack a
well
developed
plan
© 2013 PricewaterhouseCoopers LLP. All rights reserved.
74%
Data analytics are important
to gaining a better
understanding of risks
71%
Plan to expand use of data
analytics but do not have a well
developed plan
April 2013
12
Examining the issues
Internal audit continues to struggle in maximizing its contribution
in areas outside of its traditional focus
Increased internal audit focus has not translated into greater stakeholder satisfaction
PwC
© 2013 PricewaterhouseCoopers LLP. All rights reserved.
April 2013
13
The opportunity
PwC
© 2013 PricewaterhouseCoopers LLP. All rights reserved.
April 2013
14
The opportunity - defining greater heights
Our survey identified a subset of organizations represented by the
top 5% of the respondent base as “high performing”
Stronger
foundational
capabilities
Integration
with ERM
and other
risk
functions
Coverage of
emerging
risk areas
Higher level
of service
The high performing internal audit functions stood out from their
peers in their contribution and value to the organization
PwC
© 2013 PricewaterhouseCoopers LLP. All rights reserved.
April 2013
15
The opportunity – defining greater heights
Profile of the top 5%
Top 5%
All others
Promoting quality improvement and innovation
67%
41%
Obtaining, training and/or sourcing the right level of talent for audit needs
61%
34%
Leveraging technology
54%
23%
Focusing on critical risks and issues
91%
57%
Engaging in and managing a relationship with stakeholders
82%
51%
Delivering services with a service-oriented team
84%
47%
Delivering cost-effective services
80%
49%
Aligning scope and audit plan with stakeholder expectations
86%
58%
Percent of respondents who responded internal audit is performing well
The top internal audit functions are demonstrating significantly
stronger foundational capabilities
PwC
© 2013 PricewaterhouseCoopers LLP. All rights reserved.
April 2013
16
The opportunity – defining greater heights
Profile of the top 5%
The Organization works together across the various functional areas to
create an integrated view of risk
IA creates an integrated view of risk across the organization
IA is well or extremely well coordinated with ERM
IA is well or extremely well coordinated with other risk groups
IA is involved in emerging risk areas
0%
Top 5%
Others
20%
40%
60%
80%
100%
Percent of respondents who believe internal audit is well aligned
with risk
The high performing internal audit functions have achieved
greater integration with ERM and other risk functions
PwC
© 2013 PricewaterhouseCoopers LLP. All rights reserved.
April 2013
17
The opportunity – defining greater heights
Profile of the top 5%
The top 5% internal audit functions are providing better coverage
of emerging risk areas and achieving stakeholder satisfaction
Top 5%
All others
Top 5%
All others
Commercial market shifts
92%
55%
Government spending and taxation
52%
37%
Competition
90%
67%
IT security/cyber security
88%
54%
Data privacy
94%
56%
Large program risk
77%
43%
Disruptive technologies
71%
40%
Mergers, acquisitions and JVs
74%
47%
Economic uncertainty
77%
53%
New product introductions
82%
51%
Energy and commodity costs/prices
64%
51%
Regulations and government policies
89%
55%
Financial markets
86%
65%
Reputation/brand
92%
66%
Fraud and ethics
92%
63%
Talent and labour
83%
41%
Percent of respondents who responded that each risk area is well managed
PwC
© 2013 PricewaterhouseCoopers LLP. All rights reserved.
April 2013
18
The Opportunity – defining greater heights
Internal audit functions fall across a spectrum of value delivery
PwC
© 2013 PricewaterhouseCoopers LLP. All rights reserved.
April 2013
19
The path forward
PwC
© 2013 PricewaterhouseCoopers LLP. All rights reserved.
April 2013
20
The path forward
Our survey identified need for urgent action on part of
stakeholders and CAEs alike
Audit Committee:
Ask More
• Ask yourself if your
expectations of
internal audit are
high enough
• Ask if critical
business risk
coverage is aligned
with your views on
risk
• Ask if internal audit
has a strategic plan
and resources to
deliver
• Ask if you are
enabling internal
audit to be what it
should be
PwC
Management:
Expect More
• Expect internal audit
to perform at a higher
level and bring more
value
• Expect internal audit
to have a stronger
enterprise-wide risk
assessment process
• Expect internal audit
to deliver value for
the investment but
recognize the need to
invest
• Expect a robust
dialogue with internal
audit and provide
candid feedback
© 2013 PricewaterhouseCoopers LLP. All rights reserved.
CAEs: Deliver More
• Deliver high quality
on foundational areas
• Deliver a strategic
vision that aligns with
stakeholder
expectations
• Deliver value for
investment
• Deliver proactively
April 2013
21
Recap
Our survey data revealed the circular nature of the internal audit
challenges
The issues of stakeholder
alignment, a challenged
capability foundation and suboptimal internal audit
contribution are tightly
interwoven
Internal audit must break the cycle of inaction and increase its
capabilities or risk being marginalized in comparison to other risk
functions
PwC
© 2013 PricewaterhouseCoopers LLP. All rights reserved.
April 2013
22
Data analytics discussion
PwC
© 2013 PricewaterhouseCoopers LLP. All rights reserved.
April 2013
23
Better integration of technology through data
analytics
Analytics
are widely
viewed as
important
81%
Data analytics are
important to improving the
quantification of issues
Yet few
have
strong
programs
31%
Data analytics are integrated
into the audit process and used
regularly
PwC
85%
Data analytics are important
to strengthening audit
coverage
And most
intend to,
yet lack a
well
developed
plan
© 2013 PricewaterhouseCoopers LLP. All rights reserved.
74%
Data analytics are important
to gaining a better
understanding of risks
71%
Plan to expand use of data
analytics but do not have a well
developed plan
April 2013
24
Drivers and value of analytics within internal audit
The risks highlighted as a result of the financial crisis has required organizations to develop a
deeper understanding of the businesses they manage. They cannot simply rely on existing control
structures. They must evaluate transactional activities for patterns, trends and anomalous
behavior.
Drivers
Value
What is creating demand for analytics?
• Pressure on audit groups to audit closer to the
business and a develop a deeper position on risk and
issues.
Why is it so important for organizations to get it
right?
• Deeper business understanding & focus on risk
• Lower existing and future costs
• Regulatory expectations to monitor business
activities are increasing.
• End-to-end testing
• Data is growing exponentially, and the technologies
to analyze the data are maturing rapidly.
• Increased population and control coverage
• Organizations are being forced to do more with less.
• Competitive pressures are forcing organizations to
innovate.
PwC
• Real-time evaluation of controls and data integrity facilitates “what-if” analysis
© 2013 PricewaterhouseCoopers LLP. All rights reserved.
April 2013
25
Data Analytics Maturity Model
There is a broad spectrum of
technology use in current data
analytics programs
Fully Optimized
• Technology enables full
integration into internal
audit workflow
• Business focused
Routinely Leverage
• Core technical competencies
resident within the
department
• Results used for updating
risk assessment throughout
the audit process
Initial Stage
• Creation of data experts to
develop routine data
analysis techniques
• No process for incorporating
into IA methodology
• IA focused
Ad Hoc Analytics
• Occasional, ad-hoc data
Enhancing the use of
technology can assist with
improving the efficiency of the
Internal Audit department.
analysis on certain audits
PwC
© 2013 PricewaterhouseCoopers LLP. All rights reserved.
April 2013
26
Building an effective program
Business view
Analytics increases assurance through improved
population coverage and more intelligent, riskbased sample selection.
Enterprise view
Analytics enables regular, periodic reporting and
accelerates on-going risk identification and
assessment.
2
3
Audit Plan
Analysis of audit plan and coverage
against risks and geography’s and
issues
Audit Planning and Scoping
Risk analysis to confirm understanding
and identify issues within business
operation
1
Risk Assessment
Analytics to compare like metrics
between audit entities to drive risk
identification
4
Auditing
Life Cycle
Control and Outcomes Testing
Analytics to test the operating and
evaluate risk outcomes and quantify
findings
6
Issues Management &
Monitoring
Analytics to re-test and monitor
identified issues and trends
PwC
Reporting
5 Analytics to present risk
insights and articulate audit
findings
© 2013 PricewaterhouseCoopers LLP. All rights reserved.
April 2013
27
Implementing a Strategy – Where to Start?
• Start small in Year 1, working your way towards a larger data
analytics or Continuous Auditing strategy by Year 3
• Along the path, evaluate:
- Resources
- Tools
- Training
• Move from manual use of data analytics tools towards automated
scripting that can be used across business units and time periods,
creating efficiency and repeatability
PwC
© 2013 PricewaterhouseCoopers LLP. All rights reserved.
April 2013
28
Sample Data Analytics Strategy
Year 1
• Select an audit, and execute data analytics on one business process where you will see
immediate results, such as the Purchase-to-Pay cycle
• Communicate benefits to stakeholders to gain support and momentum
Year 2
• Expand data analytic know-how to several other business processes
• Use data analytics to perform scoping activities on individual audits
• Based on results of data analysis, select high risk areas to focus on during audit
• Use data analytics to support findings and quantify issues in the internal audit report
Year 3
• Implement the usage of repeatable data analytics across business units and time
periods to gain efficiencies
• Utilize data analytics in the Risk Assessment process going forward
• Develop a Continuous Auditing strategy going forward
PwC
© 2013 PricewaterhouseCoopers LLP. All rights reserved.
April 2013
29
Internal Audit Process Framework – As Is
Process to utilize results for next year’s Risk Assessment
Utilize information from previous audits for current audits (ad-hoc data analysis not
leveraged project to project). However, informal sharing of information within
group.
ANNUAL
Risk
Assessment
PwC
Fieldwork
Audit Plan
Technology is being
applied here (in
audit management
and data analysis), to
speed up audit
process…
© 2013 PricewaterhouseCoopers LLP. All rights reserved.
Reporting
Wrap-Up
April 2013
30
Internal Audit Process Framework – Future
A technology enabled approach to the internal audit
framework allows for more timely identification of and
response to risks.
ONGOING Risk
Assessment
• Monitor key risks
• Changes in KRIs
indicating change in
risk profile
Continuous
Audit
Program
PwC
Audit Plan
• Monitor results to
change frequency/
scope of planned
audits
Execute
Automated
Script
PERIODIC
Fieldwork
Reporting
• Report changes in
trends to management
Strategic Audit
Exception
Reporting
© 2013 PricewaterhouseCoopers LLP. All rights reserved.
Review
Reports
April 2013
31
Thank you for your participation
The 2013 State of the Internal Audit Profession Study may be found at:
www.pwc.com/us/2013internalauditstudy
E-mail us questions at: 2013SOPIAStudy@us.pwc.com
This document is for general information purposes only and should not be used as a substitute
for consultation with professional advisors.
© 2013 PricewaterhouseCoopers LLP. All rights reserved. PwC refers to the United States
member firm, and may sometimes refer to the PwC network. Each member firm is a separate
legal entity. Please see www.pwc.com/structure for further details.