Increasing the Influence of

Internal Auditing

Dr Sarah Blackburn

Past President, Chartered IIA

Increasing Conformance with the Standards Group, IIA Inc

Increasing Conformance with the Standards

Recent corporate scandals

The Loss of Trust

Companies Governments NGOs

2016 2017 2016 2017 2016 2017

UK 46% 45% 36% 36% 50% 46%

Ireland 43% 41% 32% 32% 49% 43%

Sweden 46% 46% 45% 45% 26% 23%

US 51% 58% 39% 47% 57% 58%

Percentage of people who trust… Source: Edelman Trust

Corporate scandal

Public/media outcry

Demands that ‘something must be

done’

Revision to corporate governance code

With thanks to Simon Thompson

UK

1992: Cadbury Report

1995: Greenbury Report

1998: Hampel Report

1999: Turnbull Report

2003: Higgs Report

2003: Smith Report

2003: Combined Code on Corporate Governance

2008: Revision of Combined Code

2009: Walker Report

2010: UK Corporate Governance Code

2012: Revision of Code

2014: Revision of Code

2016: Revision of Code

2016: Green Paper on Corporate Governance

2017: FRC announces ‘fundamental review’ of Code

Revisions of the corporate code

Rest of the World: • Sarbanes-Oxley

• King I, II, III and IV

• NYSE

• NACD

• The Norwegian Code

of Practice for

Corporate Governance

• Etc. etc. etc.

KPMG, 2017 Global Audit Committee Pulse Survey

Beyond focusing on financial reporting and compliance risks, what steps

can internal audit take to maximize its value to your organization?

27%

42%

49%

53%

56%

Helping to assess/"audit" the culture of theorganisation

Improve talent and expertise in internal auditorganisation

Expand audit plan on effectiveness ofcompany's risk management processes

generally

Maintain flexibility in audit plan to adjust tochanging business and risk conditions

Expand audit plan on key areas of risk (e.g.cyber security and key operational andtechnology risks) and related controls

Voice of the Customer: Stakeholders’ Messages for Internal Audit,

Global IIA, 2015

Should internal audit have a more active

role in an organisation’s strategic risks?

64 %

20 %

16 %

Yes

No

Unsure

Areas for internal audit to address

beyond assurance

Global IIA 1,124 survey respondents, 34% board members; 15% CEO

Beyond assurance

64%

65%

66%

71%

73%

Identify risk management frameworksand practices

Identify known and emerging risk areas

Alert management to emerging issuesand changing scenarios

Facilitate and monitor effective riskmanagement

Consult on business processimprovements

Pulled into more areas of the business, seen as a central driver of business success

Internal audit is seen as ‘go-to’ team who can review, identify and increasingly asked to facilitate business improvements

Senior managers are increasingly looking for assurance that risk has been identified, addressed

Assurance appetite being stoked externally:

Regulatory and business practices e,g. mandatory requirement in public sector; in FS, spurred by financial crisis

But this also means: IA team needs new skills, new understanding and to respond flexibly to new situations

HIAs are more central to the business, this is a new situation, independence is preserved but they are aware of a new proximity to senior management

HIAs are conscious they need to understand both the business and the management dynamic – do they feel fully comfortable in this new position?

Internal audit response

Heads of Internal Audit research results, Bright Penny, March 2017

This is not just internal audit…

… this is professional internal audit.

7 Tenets of Professionalism

1. Set of underlying principles/standards

2. Code of practice

3. Common body of knowledge and research

4. Verified skills/competencies

5. Continuous update of skills

6. Professional network

7. Duty to the public interest

Duty to the public interest

• Playing a role in maintaining economic

stability and development

• Helping organisations to maintain strong

corporate governance

• Helping organisations to protect assets

• Helping to protect jobs

• Helping to regain public trust

Opportunities to create more “Pull”?

Opportunities to create more “Pull”?

“If you go back to the financial crisis, one of the things that we

heard was that when these problems were eventually discovered, it

was often the internal audit function, not an external audit function,

not any other function within a corporation or financial institution,

but it was internal audit who called this out.”

UK Regulator

Chartered IIA Stakeholder Research, interim report, March 2017 - ComRes