INSIGHT – Delivering Value to Stakeholders
San Francisco Chapter of the IIA
Tuesday, September 11, 2012
Patricia K. Miller
Former IIA Chairman of the Board
Owner, PKMiller Risk Consulting, LLC
pkmiller100@gmail.com
• Task Force objective to explore what internal auditors
should deliver to their customers – based on growing
expectations in an ever more challenging environment
• In March 2010, the task force delivered its results, and
developed a new Value Proposition for internal
auditing, depicted below
2
BACKGROUND
• Value Proposition Task Force launched in April 2008,
under the leadership of Denny Beran
• IIA Research Foundation (IIARF) decided to develop project
to measure both stakeholder and chief audit executive
(CAE) views of insight delivery and provide guidance to
CAEs to further deliver insight
• IIARF objectives:
 measure clarity and acceptance of definition of insight
 identify approaches and techniques to increase delivery of insight
 practical ideas for CAEs interested in living up to the Value
Proposition
• Research conducted primarily in Australia, Malaysia, The
Netherlands, North America, and South Africa
3
RESEARCH PROJECT
• Extensive reference material available supporting
Assurance and Objectivity categories; very little related to
Insight
RESEARCH OVERVIEW
Executives
19%
Nonprofit, 5%
Board
9%
Internal Audit
72%
PARTICIPATION
• Survey of CAEs and stakeholders yielded 358 responses
Other, 4%
Technology, 6%
Americas, 34%
Africa, 21%
Asia Pacific,
34%
Europe,
9%
Middle East, 2%
Public
Sector/Govern
ment, 24%
Other, 11%
Private/Nonlist
ed, 33%
Financial
Services, 25%
Government,
11%
Services, 19%
Publicly Traded,
35%
Wholesale/Reta
il, 12%
• Selected follow-up interviews with 13 participants
(7 CAEs and 6 Board members and executives)
PKMiller Risk Consulting
LLC
5
Manufacturing,
17%
In General, IA
My IA Delivers
Delivers
Frequently
Delivers
SA/A
SA/A
SA/A
A/F
Internal Audit
90%
72%
81%
66%
Board
86%
77%
79%
61%
Executives
89%
57%
56%
38%
Overall Result
89%
71%
76%
60%
SA/A – Strongly Agree/Agree
A/F – Always/Frequently
Survey also provided potential examples of insight delivery to
illustrate the concept, and asked CAEs and the stakeholders to
evaluate if internal audit should deliver, and if internal audit
actually did deliver, with what frequency…
6
RESEARCH RESULTS
Should Deliver
Judgment in Reporting
Risk Themes
Management Risk Summary
Unmitigated Risk Viewpoint
Executive Performance Feedback
7
ILLUSTRATION OF INSIGHT CONCEPTS
Root Cause and Action Plan
Should
Does
Gap
Root Cause and Action Plan
94%
87%
8%
Judgment in Reporting
93%
87%
6%
Risk Themes
97%
78%
19%
Management Risk Summary
82%
76%
7%
Unmitigated Risk Viewpoint
87%
58%
29%
Executive Performance Feedback
47%
25%
22%
8
SURVEY RESULTS
Internal Audit
Expect
Experience
Gap
Root Cause and Action Plan
91%
85%
6%
Judgment in Reporting
97%
82%
15%
Risk Themes
97%
76%
21%
Management Risk Summary
91%
85%
6%
Unmitigated Risk Viewpoint
91%
64%
27%
Executive Performance Feedback
77%
48%
29%
9
SURVEY RESULTS
Board
Expect
Experience
Gap
Root Cause and Action Plan
92%
61%
32%
Judgment in Reporting
95%
61%
35%
Risk Themes
95%
64%
32%
Management Risk Summary
88%
62%
26%
Unmitigated Risk Viewpoint
89%
55%
34%
Executive Performance Feedback
64%
30%
33%
10
SURVEY RESULTS
Executives
Board
Executives
Should
Does
Gap
Expect Experience
Gap
Expect Experience
Root Cause and Action
Plan
94%
87%
8%
91%
85%
6%
92%
61%
32%
Judgment in Reporting
93%
87%
6%
97%
82%
15%
95%
61%
35%
Risk Themes
97%
78%
19%
97%
76%
21%
95%
64%
32%
Management Risk
Summary
82%
76%
7%
91%
85%
6%
88%
62%
26%
Unmitigated Risk
Viewpoint
87%
58%
29%
91%
64%
27%
89%
55%
34%
Executive Performance
Feedback
47%
25%
22%
77%
48%
29%
64%
30%
33%
11
Gap
SURVEY RESULTS
Internal Audit
LESSONS FOR CAES
• Executive expectations based on new information, new
approaches, or novel enhancements
• IA team with finance and accounting backgrounds vs.
operational or general management experience
• IA lack of business acumen, courage, and/or
leadership
• IA departments who view role as control tester
vs. catalyst for positive change
13
WHY THE GAP?
• Board expectations based on assurance
1. Strong control environment and ‘tone at the top’ in the
organization (62%)
2. Board and management expectations for value delivery
from the internal audit function (59%)
3. CAE reporting relationship that supports independence
of the internal audit function (55%)
4. Highly competent CAE (50%)
5. Internal audit personnel with significant industry and
organizational knowledge (46%)
14
CLOSING THE GAP
Top 5 Enabling Factors
1. Internal audit teams have senior experienced
auditors and subject matter specialists (70%)
2. Providing internal audit viewpoint in assessments
and results reporting (44%)
3. Including significant consultative time in the annual
audit plan (42%)
4. Using data analysis techniques in assessments
and results reporting (42%)
5. Including insight delivery in performance
expectations and evaluations (42%)
15
CLOSING THE GAP
Top 5 Facilitating Approaches
Board
Executives
Internal Audit
1-10
11-25
26+
Control
Control
Stakeholder
Reporting
Reporting
Control
Stakeholder
62%
79%
59%
63%
65%
66%
65%
Environment
Environment
Expectations
Relationship
Relationship
Environment
Expectations
Significant
Stakeholder
Stakeholder
Control
Stakeholder
Control
Control
59%
55%
56%
61%
61% industry/org 61%
58%
Expectations
Expectations
Environment
Expectations
Environment
Environment
knowledge
Significant
Significant
Reporting
Reporting
Control
Stakeholder
Reporting
55%
45% industry/org 50%
60%
58%
55% industry/org 48%
Relationship
Relationship
Environment
Expectations
Relationship
knowledge
knowledge
Significant
Competent
Competent
Competent
Competent
Stakeholder
Competent
50% industry/org 42%
45%
54%
55%
55%
48%
CAE
CAE
CAE
CAE
Expectations
CAE
knowledge
Significant
Significant
Significant
Competent
Reporting
Competent
Reporting
46%
42%
45%
45%
45%
46%
industry/org
industry/org
industry/org 39%
CAE
Relationship
CAE
Relationship
knowledge
knowledge
knowledge
Business
Business
Business
Receptivity to
Receptivity to
Receptivity to
Receptivity to
30%
29%
27%
40%
Management 28% Management 36% Management 41%
IA Processes
IA Processes
IA Processes
IA Processes
Experience
Experience
Experience
Business
Management
Experience
16
KEY FACTORS BY RESPONDENT
All
Board
Executives
Internal Audit
1-10
11-25
26+
KEY APPROACHES BY RESPONDENT
All
Senior-level
Senior-level
Senior-level
Senior-level
Senior-level
Senior-level
Senior-level
70%
73%
68%
71%
68%
80%
71%
Auditors/SMEs
Auditors/SMEs
Auditors/SMEs
Auditors/SMEs
Auditors/SMEs
Auditors/SMEs
Auditors/SMEs
Internal Audit
44%
View
Significant
Consulting
42%
Significant
Consulting
55%
Performance
Internal Audit
Internal Audit
47%
46%
46%
Expectations
View
View
Performance
Internal Audit
Data Analysis
52%
47%
43%
Expectations
View
Techniques
Data Analysis
Data Analysis
Templates/
42%
39%
39%
Techniques
Techniques
Checklists
Performance
42%
Expectations
Tracking
Value
39%
Significant
Consulting
36%
Significant
Consulting
41%
Significant
Consulting
44%
Significant
Consulting
52%
Data Analysis
52%
Techniques
Data Analysis
Internal Audit
48%
50%
Techniques
View
Data Analysis
Benchmarking
Benchmarking
43%
39%
42%
Techniques
Data
Data
Performance
Performance
Performance
37%
40% Tracking Value 36%
40%
Expectations
Expectations
Expectations
Benchmarking
Benchmarking
Benchmarking
Benchmarking
Templates/
Performance
Using Maturity
33%
36%
35%
30%
30%
34%
27%
Data
Data
Data
Data
Checklists
Expectations
Models
Tracking
Value
Tracking
Value
17
Q: The Internal Audit function in my organization actually delivers insight
Agree/Agree
88% Strongly
Agree/Agree
18
CERTIFICATION AS PART OF THE ANSWER!
76% Strongly
Jenitha John, FirstRand Limited, South Africa
• Leveraging IT expertise and data analytics
Jim Molzahn, jcpenney, US
• Communicate IA mission and focus clearly
John Lewis, Safeway, US
• IA activities aligned with stakeholder strategies
Chris Bennecke, Invocare, Australia
• Stakeholder engagement
Jenitha John, FirstRand Limited, South Africa
19
HELPFUL SUGGESTIONS FROM OTHER CAES
• Assessing internal audit performance
• Consider reporting relationships and sufficient
organizational independence
• Align internal audit mission and focus with
agreed expectations
• Refocus internal audit approach to agree
with mission
• Critically assess leadership skills and
communication style
20
CONCLUDING THOUGHTS FOR CAES
• Meet with your key stakeholders — now and
routinely going forward
21
RESEARCH PROJECT NOW AVAILABLE
• Free download to all internal auditors (member or nonmember!)