How Time Flies:
Leadership Insights from a
Career in Internal Oversight
IIA Chapter Event
Olympia WA
9 December 2015
Carman L. Lapointe
Under-Secretary-General for Internal Oversight (Retired),
United Nations Secretariat
carmanly@vacoxmail.com
Overview
• A bit of context—a few examples of
what the UN does
• Internal Oversight in the UN context
• How I got hooked on internal auditing
• Why you should care about it
• Lessons learned on my (long) watch
that might be useful…
All in a day’s work for the UN
•
•
•
•
•
•
•
Feeding 90 million people in 75 countries
Assisting 34 million fleeing refugees
Vaccinating 58% of the world’s children
Monitoring 80 Human Rights treaties
Aiding 12.5 million victims of emergencies
Peacekeeping in 16 operations ($22 million/day)
Plus poverty reduction, maternal health, climate
change and much, much more
UNODC Combats Organized Crime
Human
Trafficking
Money Laundering
Illicit Crop
Replacement
United Nations Landmine Assistance
• 110 Million Landmines in
68 countries, and as
many stockpiled
• 2,000 fatalities or serious
injuries every month
• For every mine cleared,
20 are laid
• Used for terrorism and
denying access to land,
water, roads, utilities
United Nations Peacekeepers at work
• Peacekeeper on Patrol in DRC
Women discussing
Peacekeeping strategies
(UNICEF/DRCongo)
Average # lives lost per
year in first 43 years: 20
Last 10 years: 118
Refugees and Humanitarian Aid
A Somali boy in an IDP
settlement in Mogadishu,
Somalia. Credit: AU/UN
IST/Price
Line-ups
for
UNHCR
services
Emergency Operations in Haiti
Cholera Patient Consultation
9,000 deaths and 800,000 cases
since 2010; 1,000 new cases per
week in 2015 in Haiti
Only 30% have
direct access to
potable water; only
25% to sanitary toilets
Rule of Law and Development projects
Rule of Law:
Monitoring
Conditions in
Women’s
Prison in
South Sudan
Irrigation Project
in development
doubles as fish
farm
The UN is Risky Business…on a grand
scale
• But it all has to be managed and supported too
• Administrative functions related to operations
• $55 Billion pension fund that operates in most
countries and currencies
• In short, the UN faces risks no other organization
would contemplate
• Factor in a governance structure comprised of
193 member governments, all trying to micro
manage by consensus
• New mandates, none dropped, no new funding
Front Office
Under Secretary
General & Assistant
Secretary General
Executive
Office
Internal
Investigations
Inspection &
Auditing
Division
Evaluation
160 Posts (NY,
Geneva, Nairobi,
Peacekeeping
Missions)
90 Posts (NY,
26 Posts in NY
Vienna, Nairobi,
Peacekeeping
16 separate funding sources
Missions)
Annual resources: $50 Million
A Look at the Work of
OIOS in the UN
Internal Audit Results: Non PKO
Overall Ratings for 89
Reports Issued 201314
420
Recommendations
By COSO Control
Component
PKO Investigations Completed
Financial
(Insurance
Fraud)
Sexual
Exploitation
& Abuse
Inspection and Evaluation
• Each evaluation begins with an inception paper
• A program impact pathway (PIP) is developed,
usually for the first time (first deliverable)
• Biennial reviews of self-evaluation capacity
– Scorecards issued in 2013 and 2015
• Approximately 10 evaluations per year
• Peacekeeping moving from location to thematic
evaluations (e.g. protection of civilians, prevention
of Sexual Exploitation and Abuse)
PIPs: Logical pathways to manage risks and
measure success
Inputs
Activities
Outputs
Outcomes
Impacts
Resources we
have, develop
or adopt to do
our work
Things we do
day to day
Products we
produce
Changes we
influence
Long-term
changes
Examples:
Staff, $$$,
procedures,
systems,
standards
Planning,
recruiting,
coordinating,
consulting,
supervising,
QA reviews
Reports,
results, advice,
updates,
summaries,
recommendations
Assurance,
informed
decisionmaking,
awareness
Stronger, more
effective
delivery of all
programmes,
improved lives
Performance targets are set and monitored for each
element; Used in OIOS divisions and for client
programs evaluated.
Legislated Reporting Requirement
Annual Financial Implications of OIOS work
Results for 2013-2014 (US$ millions)
Fraud by external parties
3.3
Fraudulent staff claims, payroll fraud 0.8
Overpayments
4.5
Cost recoveries
5.3
Efficiency gains
0.1
Total
US$13.8 M
Why does internal auditing matter?
•
•
•
•
Accounting versus accountability
Internal auditing (IA) versus external auditing
IA as a leadership development program (CPC)
Learning opportunity for potential candidates
(World Bank guest auditor program)
• Capacity Development as a contribution to the
profession (IIA Capability Model & World Bank)
How I got hooked on internal auditing
• The Kapuskasing “opportunity”
• Export Development Canada role/condition
• Four years of college in night school as single
parent
• Special dispensation to write CIA exam
• Involvement in Ottawa Chapter and at IIA Global
Lesson # 1: It’s never too late to make a career
change; our lives are shaped by our choices
Positioning internal audit
• EDC and its TQM journey
– Internal Audit as workshop facilitators
– Results became basis of risk-based audit plan
• Bank of Canada (Canada’s central bank)
– Basel Committee framework for evaluating internal
controls
• Canada Post (lean)
• IIA CCSA designation developed
Lesson #2: Tailor audit language and processes to
suit your organization
Balancing Advisory and Assurance Roles
• Independence promotes objectivity
• Independence does not require isolation
• Involvement of CAE in strategic forums and
discussions, as observer and advisor
• Assurance results backed by facts and evidence
Lesson #3: Resist isolating the audit function and
ensure role clarity as observer/advisor versus
assurance
Focus audit work strategically
• Align risk-based audit plans to strategic
challenges and emerging issues
• Collaborate with and leverage the work of other
assurance functions (ERM, external auditors)
• Involve internal audit in early phases of key
initiatives, before they become fatal
• Examples: air operations, waste management,
UMOJA
Lesson #4: Don’t start from scratch, leverage
competent, relevant work done by others
Communicate plans and results
effectively
• Pursue risks that resonate with management and
the Board (or Audit Committee)
• Never leave significance to interpretation; use
ratings; follow up according to significance
• Beware of language that implies audit
‘ownership’ of the results (revealed, found, etc)
Lesson # 5 (a): Don’t allow big issues to get lost in
the fog of ‘nitpicking negativity’
# 5 (b): When things go wrong, it isn’t because we
‘found’ it; seek change, not credit for results
Lead by example
• Being accountable for our own results is the best
way to demonstrate commitment & usefulness
• Develop KPIs that are relevant
• Share targets and results @360°
• Share results of regular quality assessments
Lesson # 6: A taste of our own medicine helps us
appreciate the challenges faced by our clients
A taste of
our own
medicine…
OIOS Internal Audit PIP
OIOS Scorecards:
Measuring what matters
Indicator
1. % of audits for which final report is issued within 3
months of exit meeting
 Target 100%
Measurement as of 30 June 2014
15
0
20
40
%
60
2. % of engagements with elapsed time from entry
conference to exit meeting is less than 4 months
 Target 100%
100
80
100
20
40
%
60
3. % of audits for which charged auditor hours do not
exceed the planned budget by more than 10%
 Target 100%

74
0
20
40
%
4. % of total staff days spent on engagements vs. total
available days
 Target 90%
60
80
20
40
60
80
%
5. Staff vacancy rate
 Target 10%


100
13
0
5
10

%
15
To be assessed at end of 2014
Quarterly
Activity
Reports
include
Scorecard:
100
58
0
6. % of internal quality assessments with conclusions
of “generally conforms to IAD audit manual”
 Target 100%

64
0
Activity
80
20
41 KPIs:
IAD – 15
ID – 14
IED – 12
A word on politics (and surviving)
•
•
•
•
Best to follow professional standards, be sure
Brief management and Board (or AC) on strategy
Know where you stand before making a stand
Involve CAE and management in critical issues
early; allow opportunities for action
• Escalate issues as appropriate, and warn mgmt
• Consider incentives for early resolution
Lesson # 6 (a): Bad news easier with a plan in hand
#6 (b): Sometimes it is what it is, nothing you do will
make it easier; accept it & move on
One thought on our future role
• Periodic (annual?) overall opinions on
internal control
• Comparable to external audit opinions
• Requires rigorous planning and professional
execution
• Adequate resources, clear basis and
limitations
Consider stakeholder expectations
Questions and comments
Thank-you!