11/18/2018

1

TALLAHASSEE CHAPTER

Internal Auditing Overview

Emphasize the Basics, Elevate the StandardsNovember 27, 2018

9:00 a.m. to 9:50 a.m.

Joe Maleszewski, City Auditor

City of Tallahassee

TALLAHASSEE CHAPTER

TALLAHASSEE CHAPTER

Outline

• History

• Definition of IA

• Talent Gap – Pulse….

• Add Value

• Internal v. External

• Three Lines of Defense

• Attributes of good auditor/shop

11/18/2018

2

TALLAHASSEE CHAPTER

Generations

Pre-1980’s

1980’s

1990’s

2000’s

Internal Auditing – A Historical Perspective

TALLAHASSEE CHAPTER

1st

Generation

(Pre 1980’s)

Controls

Start with existing

processes, procedures, and

control activities

Audit for

Compliance

TALLAHASSEE CHAPTER

1st

Generation

2nd

Generation

(Pre 1980’s) (1980’s)

Controls Control Framework

Start with existing

processes, procedures, and

control activities

Start with financial

compliance risks

Audit for

Compliance

Determine controls

that should be in place. Audit for

design, operational

effectiveness, and

compliance

11/18/2018

3

TALLAHASSEE CHAPTER

1st

Generation

2nd

Generation

3rd

Generation

(Pre 1980’s) (1980’s) (1990’s)

Controls Control Framework Risks

Start with existing

processes, procedures, and

control activities

Start with financial

compliance risks

Start with a thorough

understanding of the organization and

associated risks

Audit for

Compliance

Determine controls

that should be in place. Audit for

design, operational

effectiveness, and

compliance

Determine controls

that should be in place. Audit for

design, operational

effectiveness, and

compliance

TALLAHASSEE CHAPTER

1st

Generation

2nd

Generation

3rd

Generation

4th

Generation

(Pre 1980’s) (1980’s) (1990’s) (2000’s)

Controls Control Framework Risks Enterprise-Wide

Risk Management

Start with existing

processes, procedures, and

control activities

Start with financial

compliance risks

Start with a thorough

understanding of the organization and

associated risks

Start with a thorough

understanding of the organization and

associated risks

Audit for

Compliance

Determine controls

that should be in place. Audit for

design, operational

effectiveness, and

compliance

Determine controls

that should be in place. Audit for

design, operational

effectiveness, and

compliance

Determine the risk

management process that should

be in place to

effectively manage

the key risks. Audit for design,

operational,

effectiveness, and

compliance within

each process

TALLAHASSEE CHAPTER

1st

Generation

2nd

Generation

3rd

Generation

4th

Generation

5th

Generation

(Pre 1980’s) (1980’s) (1990’s) (2000’s) (2010 - Present)

Controls Control Framework Risks Enterprise-Wide

Risk Management

Strategic Advisor

Start with existing

processes, procedures, and

control activities

Start with financial

compliance risks

Start with a thorough

understanding of the organization and

associated risks

Start with a thorough

understanding of the organization and

associated risks

Start with a thorough

understanding of the organization and the

environment it which

it lives with a deep

understanding of associated risks

Audit for

Compliance

Determine controls

that should be in place. Audit for

design, operational

effectiveness, and

compliance

Determine controls

that should be in place. Audit for

design, operational

effectiveness, and

compliance

Determine the risk

management process that should

be in place to

effectively manage

the key risks. Audit for design,

operational

effectiveness, and

compliance within

each process

Full range of

assurance and consulting services

to provide hindsight,

insight, and foresight

to management and the board.

11/18/2018

4

TALLAHASSEE CHAPTER

Areas of Focus

• Fraud risk management

• Cyber security risks/threat

• Vendor/third-party risk management

• Enterprise Risk Management

• Revenue Recognition Standard

• Agile risk and compliance

• Auditing corporate culture

• Cloud computing

TALLAHASSEE CHAPTER

Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization's operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.

Definition of Internal Auditing

TALLAHASSEE CHAPTER

Standards

11/18/2018

5

TALLAHASSEE CHAPTER

Results suggest that alignment of

stakeholder expectations, and matching

skills and capabilities to these

expectations, helps internal audit enhance

the value delivered to the organization.

TALLAHASSEE CHAPTER

Trusted

Advisor

(Seat at the Table)

Assurance

Provider

Capable, but

Poorly Aligned

(A Well Kept Secret)

Rela

tio

nsh

ip A

cu

men

Risk, Control & Governance Expertise

Engaged, but

Not Strategic

(A Good Lunch

Partner)

"On internal audit, audit committees are still looking for greater value."2015 Global Audit Committee Survey from KPMG's Audit Committee Institute

TALLAHASSEE CHAPTER

Challenge

“There is no more enduring

challenge for internal auditors

than achieving and maintaining

alignment with the expectations

of our key stakeholders.”

Richard Chambers, President and CEO of the IIA, February 2015

11/18/2018

6

TALLAHASSEE CHAPTER

TALLAHASSEE CHAPTER

Talent Gap

TALLAHASSEE CHAPTER

Embrace Innovation

11/18/2018

7

TALLAHASSEE CHAPTER

Technology Innovation

TALLAHASSEE CHAPTER

Organizational Use of Data

Analytics Techniques

TALLAHASSEE CHAPTER

2018 Audit Plans

11/18/2018

8

TALLAHASSEE CHAPTER

Internal v. External

TALLAHASSEE CHAPTER

Initial Professional Education

Skills/Professional Development

Certification/Licensing

Professional Associations

Code of Ethics

Organizational Certification

Elements of the Profession

TALLAHASSEE CHAPTER

11/18/2018

9

TALLAHASSEE CHAPTER

TALLAHASSEE CHAPTER

TALLAHASSEE CHAPTER

Value

The regard that something

is held to deserve; the

importance, worth, or

usefulness of something.

11/18/2018

10

TALLAHASSEE CHAPTER

Value

• Shareholders

• Senior Management

• Boards of Directors

• Regulatory Authorities

TALLAHASSEE CHAPTER

Whose Job is it?

• Performance Standard 2000 –

Managing the Internal Audit Activity

• The chief audit executive must

effectively manage the internal audit

activity to ensure it adds value to the

organization.

TALLAHASSEE CHAPTER

Factors That Help Add Value

• Deep Knowledge of the Organization

• Courage to Innovate

• Creativity

• Broad Knowledge of Professional

Practices

11/18/2018

11

TALLAHASSEE CHAPTER

TALLAHASSEE CHAPTER

5 Value-adding Characteristics

1. Extensive Staff Expertise

2. A Challenging Work Environment

3. Organizational Alignment

4. Participative, Qualitative, Real-time

Risk Assessment

5. An Array Of Audit Services

TALLAHASSEE CHAPTER

11/18/2018

12

TALLAHASSEE CHAPTER

Relationships

Business

Judgment

Competency

Professional Development

Attributes

Internal Auditors – Adding Value

TALLAHASSEE CHAPTER

TALLAHASSEE CHAPTER

Thank you

Joseph “Joe” K. Maleszewski

Office: (850) 891-8398Mobile: (850) 228-1987

Email: joseph.maleszewski@talgov.comWeb: www.talgov.com/transparency/auditor.aspx