measuring the impact of internal audit in uncertain times report 7th nove… · the institute of...

The Institute of Internal Auditors (IIA), Bombay Chapter Research Partner: VERITA Management Advisors

Measuring the Impact of Internal

Audit in Uncertain Times

November, 2012

The Institute of Internal Auditors (IIA), Bombay Chapter

Index

1. The Institute of Internal Auditors (IIA) and related initiatives……….3

2. Foreword………………………………………………………………….5

3. Research Background…………………………………………………..6

A. Introduction B. Impact of the Global Financial Crisis C. About the Research Initiative

4. Research Findings………………………………………………………10

A. Adding value to the Audit Committee B. Nurturing an effective IA function C. The new business risk normal D. A good internal auditor is a sum of parts E. Aiming in the right direction F. Integrated view at the top is more useful

5. The Lean, Mean and Hungry tribe of Internal Auditors……………..23

6. Acknowledgement……………………………………………………….27


Introduction

1. The Institute of Internal Auditors - India and Bombay

Chapter

The Institute of Internal Auditors-India (IIA-India) is affiliated to its parent body, The Institute of

Internal Auditors, USA (IIA-Inc). IIA-India is a not for profit professional organization dedicated

to the advancement and development of the internal auditing profession in India, in sync with

the highest standards propagated by its parent body. IIA-India was founded about three

decades ago, starting first in Bombay, and soon expanded with the setting up of four additional

chapters-Delhi, Calcutta, Madras and Bangalore. In June 2007, one new Chapter at Hyderabad

has been established. Together, these six Chapters represent IIA-India, which in turn is the

National Affiliate of IIA Inc. Most Chapters have in addition, at least one 'Audit Club' attached to

it (with less than 100 members in each Audit Club), which operate from cities falling within their

respective geographical region. This process facilitates local programs/meetings with minimal

time/cost on the part of the members, given the size and spread of the country. The present

membership strength is more than 5000, which includes members drawn not only from trade,

industry and practice, but also comprises non-accountants, representing multi-disciplinary

professional skills so as to fully meet the diverse business challenges.

IIA Bombay Chapter is taking various initiatives for the continuous evolution and updating the

internal audit profession through various programs like annual conference, Internal Audit

Academy, On-site training, faculty support, etc.

IIA Bombay Chapter has recently launched “IIA Bombay Research Foundation” with the

objective of initially being the research arm of The IIA Bombay Chapter conducted by thought

leaders in the profession.

The Foundation aims to be a driving force for the continuous evolution of the profession through

conducting surveys, publishing research reports covering the full spectrum of issues facing the

profession and through such other initiatives that explore current issues, emerging trends, and

future needs. This foundation is led by a committe of IIA Bombay Chapter – Mr. Naren Aneja,

Mr. Nagesh Pinge, Mr. Anil Bhandari, Mr. Satish Shenoy and Mr. S Bhaskar.

IIA Bombay Chapter has identified “Verita Management Advisors” as its first research partner

enabling IIA Bombay Chapter to launch this new initiative. “Verita Management Advisors” along

with IIA Bombay Chapter, has developed this research document titled “Measuring the Impact of

Internal Audit in Uncertain Times”.


Research Guidance

Mr. S Bhaskar, President of the Institute of Internal Audit, Bombay Chapter an

invitee member of the IIA India Council and also a committee Member of the

ASSOCHAM National Council on Internal Audit & Corporate Fraud.

Mr S.Bhaskar is the Chief Internal Auditor for the Tata Capital Group comprising of

Corporate Finance, Consumer Finance, Housing Finance, Private Equity, Investment Banking,

Broking, Wealth Management, Forex, Travels & International Business. He is a member of the

Ethics Committee , Operations Committee and an invitee member of the Fraud & Operational

Risk Management Committee of Tata Capital Ltd.

Authors

VERITA is a private company registered in India. VERITA is promoted by a young team of

entrepreneurs based at Mumbai. VERITA has a rich talent pool of consultants with diverse

skills and post graduate qualifications. VERITA serves varied businesses in the areas of

business and risk advisory, direct and indirect taxation and process outsourcing.

VERITA operates on a pan-India service execution model with quality business partners. Head

quartered in Mumbai with a network of likeminded business partners across the country under

the VERITA Business Alliance Program (BAP).

Huzeifa Unwala, Board Member Verita Management Advisors (M) 98200 51936 (E) [email protected]

Amit Shah, Director Verita Management Advisors (M) 99202 88031 (E) [email protected]


2. Foreword

Uncertainty is the new normal. It has been fashionable for business leaders to parrot the

unchanging reality of constant change but that mantra has now been replaced by dread of the

unknown. The response to uncertainty has been two-fold. On the one hand business has

become more complicated in its effort to lay off risks: as was the case with bundles of

mortgages, sold to unwary investors. This response has often aggravated the condition rather

than ameliorating it. On the other hand regulators, law makers and the public have sought to

impose greater controls over business, complicating matters still further. No examples are

required of this. At the intersection of all these complexities sits internal audit.

The internal auditor’s job appears to have become one of reassuring senior management and

the board of directors that their business is being run in a manner that satisfactorily deals with

the risks it faces. It is not sufficient that those risks are avoided. Managements and boards are

in a highly competitive environment and expect that risks are exploited so as to maximize

shareholder value. Therefore, they expect to have a better ways of fine-tuning their response to

specific risks than do their competitors. Bankers want to fine tune their response to credit risk in

the hope that they can offer loans at lower rates of interest to their borrowers without

compromising on credit risk cost. Other managements want to game regulations or contractual

obligations hoping to steal a march over their competitors. Many companies have developed a

(poor) reputation for changing the terms of competitively won bids after winning them. Or they

sail very close to the legal wind hoping that the regulator’s gust does not overturn their ship.

Again, the only protection against disaster that managements and boards of companies that

build their business on such practices have is a competent audit. Internal audit is required to

possess ever greater degrees of expertise in the subjects that it is required to deal with. The

days of the general internal auditor are over.

At the same time internal audit’s responsibilities have never been greater for another reason.

Many managements and boards have become very short term in their outlook as the fog of

uncertainty makes peering into the distance difficult. This tendency is exacerbated by the very

short term behaviour of capital providers. But, businesses that do not give due regard to long

term trends and risks run the fundamental risk of perishing. No greater long term risk now exists

than that of climate change. Few, if any, businesses have developed a real programme to deal

with it; most treat it as an opportunity to make more profit. Responsible internal auditors need to

devote attention to this area and to guide managements and boards into strategizing for it.

Businesses that develop a good response to this virtual certainty (assisted by internal audit), will

be the ones that survive into the second half of this century.

Nawshir Mirza.

Date: 29th October, 2012 Mumbai


3. Research Background A. Introduction

The Research Foundation of The Institute of Internal Auditors (IIA), Bombay Chapter

initiated a research study during the period August to October 2012 on the subject of

“Measuring the Impact of Internal Audit in uncertain times” understand how the

purpose is to Chief Audit Executives (CAEs)/ Audit Heads (AHs) of large and medium

sized companies overcome the challenges faced by internal audit functions emanating

from the uncertain business environment and the ever expanding stakeholder

expectations.

In uncertain economic times the existence and significance of investments in non-

customer facing business processes such as Internal Audit are easily questioned

whereas the stress on internal auditors is far greater with ever increasing audit

responsibilities, expanding audit committee expectations and limited resources at the

command of the internal audit teams.

The internal audit function whether fully outsourced, in-sourced or co-sourced can play

a crucial role in assisting the Board and especially the CEO in re-shaping organizational

and process design. An audit function which is independent of any business function is

best placed to question the resources being consumed by each business process

thereby creating value for the stakeholders. The CAEs/ AHs are often asked:

Is the internal audit function meeting the expectation of the Board of Directors?

Is the internal audit function capable of focusing attention on monitoring strategy

and action plans?

Is the internal audit function adding value in the uncertain economic times?

This research study highlights quantitative and qualitative analysis that would assist the

CAEs/ AHs in addressing the above questions. This report aims at capturing and

consolidating the emerging point of view of CAEs/ AHs who liaise with the C level

executives and Audit Committees.


This study reveals preferences of CAEs/ AHs on:

Key measures that add value to various stake holders

Key contributors for shaping the effectiveness and performance of modern day internal audit function especially in the backdrop of uncertain economic times

Top risk factors that need attention of the business and audit teams

The research team interviewed leading CAEs/ AHs to find out the most noteworthy

Internal Audit Practice Framework related code adopted by their IA functions. The

response of CAEs/ AHs was very exciting and the research team could consolidate 15

practice philosophies that encompass auditor independence, audit planning, audit team

knowledge building, audit methodology related and others. This exercise will benefit all

IIA members and assist them in benchmarking specific practices to elevate the standing

of their audit functions.

B. Impact of the Global Financial Crisis

In uncertain economic times business priorities change this creates excessive pressure

resulting in cost cutting and employee layoffs. Global IA surveys indicate that during the

economic crisis and recessionary periods internal audit staff reductions are common

showing a direct impact on the internal audit profession. Further, the surveys indicated

that the internal audit staff reduction was not high amongst the Fortune 500 and large

companies; however, in case of small and medium sized organizations the impact was

significant.

Global IA surveys found that the economic crisis fuelled increased integration between

risk management, compliance and internal audit functions.

To meet the rising cost pressures in uncertain economic times Internal audit functions

adopt special initiatives like trimming the IA budget by reducing travel spends, bringing

in outsourced consultants for routine and specialist audit missions and taking up in-

house IA training initiatives.

Internal audit is vulnerable and at times where the function does not have independent

reporting mechanism it can be the first casualty. Challenging times actually increase the

demands on many internal audit departments as they play special roles in cost

reduction projects.


In our current research study we found that all the CAEs/ AHs were in absolute

agreement on the fact that in stressed times internal controls should be strengthened

and not diluted as employee layoffs in the absence of a control design impact analysis

typically results in control dilutions. This survey initiative received a thumb down on

reduction of IA budgets as a measure of adding value to the Audit Committee in

uncertain times.

C. About the research study

The research team designed a detailed research cum survey questionnaire that was

circulated to 50 CAEs/ AHs of large and medium sized companies. The research team

received replies from 30 participants predominantly from the Mumbai region. The

research team also conducted 5 personal interviews with CAEs/ AHs of leading

corporate houses to obtain detailed replies on the direction of the IA function in

uncertain economic times.

The research team received responses from varied sectors. The names of CAEs/ AHs

and the participating companies have been provided under Acknowledgement section

of this report.

Sector Break up of Respondents


The respondents are categorized into two categories viz., CAEs/ AHs and others. In

certain participating companies the custodian of the IA function was either the Head of

Finance/ Risk/ Compliance.

Respondent Profile


Measuring the Impact of IA in uncertain times

4. Research Findings

A. ADDING VALUE TO THE AUDIT COMMITTEE/ BOARD OF DIRECTORS

Q 1: In uncertain times how does a modern day IA function add value to the Audit Committee/ Board of Directors?

Results:

93% of respondents agreed or strongly agreed that

the IA function could add value by

- Greater level of engagement with stakeholders

- Enhance focus on compliances

- Closer monitoring of critical processes to isolate outliers

- Adopting a leaner approach to audit by focusing on high risk areas

Majority of the respondents agreed or strongly agreed on the following additional measures where the IA function could add value by:

- Continuous Control Monitoring

- Greater use of subject matter experts

- Benchmarking of processes /indicators with competition

A large majority of respondents disagreed that the IA function could add value by:

- Reducing the IA budget - 70%

- Reducing internal talent and placing more reliance on outsourced service providers - 63%

- Each audit mission to carry a value multiple target - 58%


Research Viewpoint

ADDING VALUE TO THE AUDIT COMMITTEE/ BOARD OF DIRECTORS

Deployment of internal audit function demands economic resources in people, process,

technology and other several intangibles that are associated with the internal audit

function. The smaller the entity the higher is the resource constraint in terms of the

organizational ability to implement a meaningful internal audit function. In general

business and executive teams hold a view that the output of internal audit missions

should generate a value multiple of x times the investment made. Measuring the internal

audit performance with such a single-minded and narrow viewpoint contradicts the

inherent responsibility cast on the flock of internal auditors of objectively evaluating the

design and operative effectiveness of the internal control components in an

organization.

This research study reveals that several internal audit functions that operate in a

challenging business environment especially in uncertain times have ensured that the

primary objectives of IA function are well communicated and implemented. It is evident

that in uncertain economic times the yardstick for measuring the IA performance shifts

from Value addition to Value preservation as the management attention is on resource

preservation.

“It is difficult to quantify the benefits of internal audit rather the organization should focus

on extracting the maximum from the internal audit function. A modern day internal audit

function needs to align with the Business Objectives. It must develop an effective “Risk

Based Audit Plan” in consultation with the business teams, judiciously use own

judgment and also obtain approval from the Audit Committee. To strike a fine balance

between apparently conflicting responsibilities it is necessary to deploy the right skill

sets. Internal audit teams should certainly concentrate on “Value Preservation” as its

first line of duty and thereafter think of “Value Additions” in Internal Audit Reporting”.

- Chief Audit Executive, India’s largest automobile company.

Internal Auditors can play an effective role in objectively checking the existence and

functioning of internal control components. The contribution and impact of the internal

audit function which is essentially a monitoring one in an organization’s successful

progress becomes more relevant and critical at those stages when the organization is

most vulnerable to economic uncertainty. In times of economic uncertainty

organizations develop lower risk appetites and the cushion to absorb surprises

completely vanishes.


Research Findings

B. NURTURING AN EFFECTIVE IA FUNCTION

Q 2: What are the real differentiators between a performing Internal Audit function and a non-performing one? Results: All the respondents agreed or strongly agreed that following measures are key differentiators between a performing IA function and a non-performing one:

- Building continuous learning mechanisms

- Implementation of Internal Audit Function – Performance score card

- Adopting technology to provide a greater degree of assurance and add to the surveillance capabilities


Research Viewpoint

NURTURING AN EFFECTIVE IA FUNCTION

Information technology deployment in the audit process has emerged as a key

differentiator as it helps the internal auditor to deal with and analyze huge volumes of

data in a short span of time. It also helps to maintain workflow of audit data and

information in order to keep a track on audit opening, control testing, report delivery,

open audit issues, etc.

Performance measurement of Internal Audit function through performance score card is

another emerging differentiator of an effective Internal Audit function. The performance

scorecard assists the Chief Audit Executive in measuring the value added by IA function

in-terms of cost saving, revenue assurance, compliance, performance efficiency, etc.

Our research team identified several performance oriented key measures that are

currently in vogue and deployed by leading IA functions in the Mumbai region. There

measures are deployed by the Board and Audit Committee members while assessing

the impact and effectiveness of the Internal Audit teams. The key measurements are a

mix of efficiency, effectiveness and management measures such as:

1. Percentage completion of the annual audit calendar.

2. Red flags identified by the internal audit team as “Early warning signals” on serious

compliance and/ or control violations that would be have dire reputational

consequences to the organization.

3. The trend of non-repeat audit observations made by the internal auditor during the

year. Assessing how many known issues have been implemented by the

management team.

Majority of the respondents agreed or strongly agreed on the following additional differentiators:

- Managing an appropriate balance between audit requirements and staffing levels

- Attract and retain subject matter experts

- On-time report delivery

- Attract and retain quality service partners

- Constant engagement with the chair of audit committee

- Successful completion of annual audit calendar

- Implementation focus

- Automation of audit workflow

- Exceed the expectation set by the audit committee


4. The percentage of audit observations that could be classified as “Cost Savings” or

“Revenue Leakage” opportunities. This is an effectiveness measure which indicates

the element of effective value add by the internal audit function.

5. The productivity of the internal audit team in terms of available resources, audit per

resource efficiency, audit cycle time, etc.

6. The percentage of High Risk/ Key audit observations identified by the internal audit

team during the year.

7. The percentage of unimplemented/ uninitiated audit observations during the year.

8. Number and quality of instances highlighted of internal and/ or external

benchmarking for standardization and organizational consistency.

9. Percentage achievement of audit goals, objectives and initiatives during the year.

10. IA acceptability, attention/ perception and satisfaction feedback from the executive

management team.

11. IA budget on training, learning and development

12. IA ability to attract and retain talent especially subject matter experts

13. IA’s participation in on-going risk assessment projects

14. IA’s participation in on-going change management projects

15. IA’s participation in control advocacy and continuous improvement programs

Taking a philosophical view on the ROI of internal audits a Chief Audit Executive of a

large corporate house says “we can look at the year-end Balance Sheet position of the

internal audit contributions as:

Assets = Fixed Assets (IA team members and skills enhancement) + Current

Assets (the benefits given by the IA team to the organization) + Miscellaneous

expenditure (the undelivered commitments of the IA team)

Liabilities = Equity (Confidence levels of the Audit Committee and Board enjoyed

by the IA team) + Share Premium (The perception value of the IA team in eyes of

the auditees and the serious attention bestowed to the IA team by the auditees)

The above equation provides a simplistic but effective ROI mechanism for the IA team”.


Research Findings

C. THE NEW BUSINESS RISK NORMAL

Q3. What are the new risk factors that you would like to address in an uncertain business environment? Order of Significance on a scale of 1 to 5 where 1 is least significant

Results:

28 respondents participated in ranking the new risk normal grid. The Top 5 rankings were given

to the risks: - Rising cost pressures - Frauds - Growing compliance complexities - Liquidity, Lack of business resilience and inability to meet growing customer needs - Lack of innovation

The respondents agreed that business and IA teams should focus their attention on Top 5 risk rankings in uncertain economic times.


Research Viewpoint

THE NEW BUSINESS RISK NORMAL

To obtain a global viewpoint on building a World Class risk based IA function the

research team interviewed Mr. Uday Gulvadi, CPA, CIA, CISA an IA expert with over

two decades of international experience in risk consulting. Mr. Gulvadi has held

leadership positions as Partner and Director within Internal Audit and Risk Management

practice at leading recognized US and international accounting firms. Mr. Gulvadi’s

views are reproduced in a narrative form as under:

Questions have been raised at the role and effectiveness of the Internal Audit function

(IA) in being able to prevent or protect organizations caught up in the financial crises.

Have organizations learnt their lessons from the crises? And what changes have they

brought in as a result?

One impact of this soul searching has been that leading companies are taking steps to

build a world class IA function. They have realized that for IA to truly add business value

their horizons must be broadened to cover the effectiveness of Enterprise Risk

Management (ERM). Also as the crises showed, there is a high degree of interrelation

between various risks and therefore management and IA should be cognizant of how

each risk element impacts the other and the organization as a whole.

Limiting the ambit of IA to traditional internal controls assessments focused on

compliance, technology and financial controls is no longer sufficient. A key step toward

building a world class internal audit would be to realign the focus of IA to these two key

areas:

Strategic Risk

Execution Risk

For IA leaders to win the proverbial “seat at the table” with other C Level executives, it is

critical for them to be aware of the strategic landscape within their respective industries

and how their organization’s strategy is set and executed within that environment.

Internal Audit’s role should encompass an assessment of the organization strategy

setting and execution processes. For e.g. how does the organization deal with the risks

of an uncertain business environment? How does the organization identify and prepare

for potential black swan events?

The best strategic plans have to be backed by good execution. How often does an IA

function get involved in assessing the execution risk to the organization’s strategy?

Execution is after all is what translates strategy into actual results. IA should assess

practices, processes and controls of the organization’s execution capabilities.


Research Findings

D. A GOOD INTERNAL AUDITOR IS A SUM OF PARTS

Q4. What are the key skills required to add value to the Board of Directors/ Audit Committee?

Results: Respondents believed that it was difficult to identify a particular skill as the key for adding value to the Board and Audit Committee; however, the responses can be summarized as:

- Ability to understand the expectation of the Bod/ Audit Committee

- Ability to understand the finer aspects of the business and organization

- Deeper understanding of the risks, processes, company culture and business landscape

- Ability to carry out objective and independent assessment

- Analytical ability to interpret the data and present it in a comprehensive manner

- Ability to understand statutory and legal requirements and assuring the stakeholders about the compliance level

- Ability to observe and report blind spots and the damages caused or likely to be caused

- Subject matter expertise

- Analytical and problem solving skills or efficient use of technology

- Ability of effective communication with Auditee, BOD and Audit Committee

- Ability to manage project team and relationship


Research Viewpoint

A GOOD INTERNAL AUDITOR IS A SUM OF PARTS

The ability of the internal auditor to stay objective, consistent, engaged and sharply

focused on the IA objectives emerged as the key skill expectation of the Board of

Directors/ Audit Committee. It was noted that behavioral skills and competencies take

precedence over technical skills and competencies as the latter can be acquired

through training and experience, however, the former is difficult to acquire.

In the context of ever expanding stakeholder expectations the research team found it

relevant to obtain views of a senior statutory audit professional. A statutory auditor looks

upon the modern day internal audit function to go beyond the call of statutory

requirements enshrined in the CARO 2003. The key elements that the statutory auditors

look upon from an internal auditor are on-going risk assessments including risk

benchmarking, forward looking control reviews and identity risks to minimize surprises.

A senior audit partner from a global accounting firm states “A statutory auditor can

better leverage the benefits of an internal audit if it is proactive, also seeks to identify

risks that could pose problems for the business in future to minimize “potential

surprises”. There has to be a paradigm shift in the focus of internal audit - moving from

annual risk assessment process to taking a more continuous approach to assessing risk

especially considering today’s dynamic business environment.

Risk assessments and audit plans should be updated as often as possible with a

coordinated approach in consultation with the statutory auditors. The process should

also identify emerging risks through effective and regular interaction with executive

management/ key business managers etc. It would also be relevant to watch out for

risks encountered by others in the same industry and benchmark with peers (especially

in the same industry).

Independence of internal auditors/ internal audit system is an essential pre-requisite and

is expected to make it more effective. The function should be allocated higher budgets

and more time should be devoted by those charged with governance to the internal

audit observations. This would add significant value not only to statutory auditors but

also to the stakeholders and those charged with governance”.


Research Findings

E. AIMING IN THE RIGHT DIRECTION

Q5. What is the Value add that the Board of Directors/ Audit Committee are looking at in an uncertain business environment? Results: Respondents provided several interesting propositions, summarized as:

- Guidance and direction to the company to deal with external uncertainties

- Identify bottlenecks/ blockages and give suggestions / recommendation to remove them

- Root cause and risk analysis of the exceptions and recommendation to eliminate / minimize the risk involved

- Innovate processes /approach which may result into cost savings or process efficiencies to the business

- Protection from competition to the extent possible

- Assurance on key business processes

- Early warning signal on risk which would impact the business continuity, stake holder’s trust, reputation, non-compliances, etc.

- Strategic implementation support system


Research Viewpoint

AIMING IN THE RIGHT DIRECTION

The aim of any business is to create, nurture and preserve reputation and profits. In

order to be a truly world class value added function, IA must provide a mirror to the

organization, enabling management to identify long term indicators of value creation or

erosion and changes in competitive positioning. This will ensure that IA fulfills its key

role in enabling management to be effective stewards of long term value preservation

and growth.

“The only things that evolve by themselves in an organisation are disorder, friction, and malperformance.”

- Peter F. Drucker

Internal auditors can play an effective check and balance role in ensuring that the

organisation is protected against disorder, friction and malperformance.

The research team has identified one shining internal audit example that proved to be a

“Top Line Contributor” in the growth story of a company. This case study is selected

from the Logistics sector where the exemplary work of a CAE of a Courier and

Integrated express package distribution company was recognized by the management

team. It is a case study that demonstrates how the internal audit function not only met

but far exceeded the expectations of all the stakeholders.

The CAE was requested to undertake internal audit of the Claim handling process of the

Courier Company. During audit of the claim handling process, the CAE came across

number of cases having disputes with customers on limited liability terms. Customers

were demanding full value of damaged/lost goods against the argument of Company’s

limited liability policy. The Company’s contention was that it recommends insurance to

shippers in case of valuable shipment and as such not liable to pay full value. Some of

the customer feedback showed they accepted such claim settlements reluctantly.

The CAE explored possibilities of finding a solution whereby the Company could

enhance customer satisfaction. The CAE approached few insurance companies, but

there was no ready product available which allowed carrier of the shipment to offer

Insurance of shipment and settlement of claim to be done to the shipper. But one

company desired to work on this solution after taking approval from their Head office

and the Regulator.

Accordingly, a new customised policy was designed by the insurance company which

allowed carrier of the shipment to offer insurance arrangement to its customers across

counters under the customised policy with Insurance Company. The feature was named

http://thinkexist.com/quotation/the_only_things_that_evolve_by_themselves_in_an/167786.html


Freight on Value (FOV). The feature is running very successfully for last four years

which not only enhanced customer satisfaction but also added extra revenue to the top

line of the Company by acquisition of new customers and improved bottom line by way

of service charges for the new offering.

Freight on value (FOV) is product feature primarily designed to remove the hardship

faced by customers in case their valuable shipment gets damaged during transit and

they have to bear the loss as all courier companies operate with limited liability as

defined on the waybill.

Comments from Managing Director of the company:

The Managing Director of the Courier Company added on the service “Since the launch

of the FOV service, our sales teams have been able to offer insightful solutions to the

customers; it also enables customers to make a decision based on factors of reliability

and complete peace of mind. I believe that the FOV service has differentiated us and

advantaged against competition when submitting RFP’s “


Research Findings

F. INTEGRATED VIEW AT THE TOP IS MORE USEFUL

Q6. Is it time that an integrated internal audit is performed to avoid duplication of efforts and audit fatigue? Integrated audit refers to an audit that satisfies the needs of internal audit, fraud risk assessment and technology risks. Results: 90% of respondent agreed that an integrated and comprehensive internal audit is beneficial to cover all aspects like financial audit, process audit, fraud audit, technology audit, etc. This also ensures adequate reporting, avoids duplication of efforts and audit fatigue. However, we cannot entirely rule out the necessity of standalone special audits or fraud risk assessments or technology audits as each organisation and business environment is unique. Further, small organisations generally don’t have subject matter experts to perform and achieve specific objectives of the management in an integrated manner.


5. The Lean, Mean and Hungry tribe of Internal Auditors

During the course of the research study the team interviewed Chief Audit Executives of

leading business houses and observed several notable practices adopted by them.

The depth of the notable practices reveals the high state of maturity of the internal audit

functions and the lean, mean and hungry approach of the Chief Audit Executives.

The research team believes that such notable practices are exemplary in nature and

shall assist the readers of this report in scaling up the maturity of their internal audit

functions to the next level. A compilation of the notable practices is presented in a

summarized manner.

Sr.

No. AREAS NOTABLE PRACTICE

1.

Appointment of

Chief Audit

Executive

Recruitment directly done by the Chair of the Audit Committee. Since the

reporting relationship of the CAE is with the Chair of the Audit Committee there

was no involvement of the CEO or CFO in the recruitment of the CAE.

2.

Dealing with

Whistle Blower

escalations and

protection of

whistle blowers

The Board and Audit Committee expanded the CAE role and responsibility to

include receipt, investigation and initiation of corrective action on whistle blower

complaints by keeping the incident confidential.

3.

Internal

Benchmarking

The internal audit team studies the good practices implemented by the Auditee

department and shares them with other departments through internal

publications and special sections in the Internal Audit Report. The identified gaps

highlighted in a positive manner serve the organisational goal of standardisation

and efficiency in operations. This ensures recognition of good practices and

motivating business teams to embrace good practices.


4.

Control

Advocacy

The Head of audit has developed a quarterly knowledge sharing forum wherein

all key leaders meet and enhance their knowledge base by inviting external

speakers on emerging topics. The Head of Audit takes this opportunity to discuss

developments in the area of internal controls and advocates/ promotes good

control practices.

The internal audit team publishes a quarterly digest called “Beacon”. This digest

shares good control practices, audit issues and other relevant topics with auditee

departments.

5.

Thinking “Out of

the Box”

The CAE analysed the root causes of a particular finding and also envisaged the

needs of the ultimate customer. He recommended an innovative solution of

expanding the current service offering of the company to include an expanded

and bundled insurance cover. This problem solving approach was first rejected

by the Business team; however, on consistent persuasion it was adopted and

has emerged as a BIG VALUE ADD and a top line contributor.

6.

Making the

audit process

“Customer

Facing”

The organisation coached the CAE under the “First Choice” program that was

meant for senior business executives to listen to the Voice of their Customers

and align their business processes with customer needs.

7.

Gathering

business

insights

The CAE is invited in all business review meetings by the CEO as a special

observer to obtain key business insights. This practice assists the CAE in

developing sound understanding of business issues and also provides a one to

one forum with the CEO for the purpose of sharing useful insights.

8.

Staying on

course

The CAE conducts monthly team meetings with a simple rolling agenda:

a. Look back at the month gone by to take corrective actions

b. Review the audit plan for the next month to make relevant adjustments, if

any

c. Hold a knowledge sharing session


9.

Packing a

Punch

The CAE personally participates in all audit closure meetings irrespective of time

and distance challenges. This means that the highest level in the Auditee

department also has to participate and commit to the management action plans.

Such a level of personal attention from CAE ensures quality reporting and timely

completion.

10.

On time

reporting

The Head of Audit has started a new practice of encouraging team members to

issue final audit report prior to exiting the audit site. The audit report is issued

within 2 days from the audit closure.

11.

Balancing Audit

Resources with

Organisational

Audit

Requirements

The Chief of Internal Audit has gradually shifted the audit execution from

functional and department audits to Process Audits. The Process Universe of the

company has been classified into Core & Non Core processes. The

contemporary audit planning approach is to bucket the existing processes into

three categories viz., “Vital, Essential and Desirable”.

The process rating and bucketing is undertaken on the basis of:

Criticality/ Core or Non-Core to business

Risk Profile – High, Medium or Low

Materiality – Impact on financial statements

The coverage of the processes is determined through a fixed criteria:

Vital - All Vital processes to be reviewed during a financial year

Essential – Atleast 50% of Essential processes to be reviewed during a

financial year

Desirable – Atleast 33% of Desirable processes to be reviewed during a

financial year


12.

Overcoming the

Audit

Coordination

Monster

The Internal Audit Department (IAD) has established a unique “Assurance

Champion” initiative at the company. Under this initiative a pool of experienced

line managers are identified from various departments across the organisation

who play the role of Audit Coordinators and act as the bridge between the

auditors and auditees. Each Assurance Champion plays out his assigned

coordination role on the audit mission. Since there is an independent coordinator

the audit project is executed smoothly and in a time bound manner. The

Assurance Champion is rated by the IAD and the Head of Department (HOD)

and suitably recognised and rewarded once a year by the Managing Director.

13.

Setting the

Tone

The Chairman of the Company studies each mail/ request marked to his attention

by the Chief Audit Executive and personally responds to the situation. Where the

mail is an escalation of a control issue the Chairman of the Company calls up the

concerned Auditee department to seek a response thereby demonstrating the

seriousness of the matter.

14.

Audit

Philosophy

The Board Members of the company have set a simple philosophy for the

Internal Audit function to follow that is “Be Proactive on Controls and Partner with

the Business to avoid surprises”. This is executed through proactive involvement

of the Internal Audit function in all major business projects and change

management initiatives – the internal audit team participates by reviewing

controls while the new business initiatives are being implemented.

15.

Process

Alignment

The Internal Audit team has carved out a two member SOP and Authorisation

Design team called the “Methods Team”. This special team continuously studies

the business process changes and updates the SOP documentation thereby

keeping the documents “Live to current business realities”. The Internal Audit

team prior to field work commencement undertakes a process walkthrough using

the SOP and process templates designed by the Methods Team. This practice

aligns the Internal Audit efforts to existing business processes making the

outcome more meaningful.


6. ACKNOWLEDGEMENTS Name of Participating CAEs and Companies The IIA, Bombay Chapter and the research partner VERITA warmly acknowledges the contributions made by the following participants in this research effort.

Sr.No. Company Name Participants

1. Aditya Birla Financial Services A. Dhananjaya

2. Cross Tab Prashant Bhatt

3. Aamby Valley Ltd. Rohit Somani

4. A leading Life Insurance Company Head of Audit

5. Cnergyis Infotech India Pvt Ltd Venkat Balan

6. US based firm Harish Iyer

7. Edel Cap Nikhil Johari

8. Enercon India Ltd. V. Jambunathan

9. Leading manufacturer of Oleochemicals EVP – Corp Audit & Assurance

10. A leading AMC Head of Audit

11. Leading private sector bank Chief Audit Executive

12. Blue Dart Aneel Gambhir

13. L & T Satish Shenoy

14. Gujarat based firm Parag Adhiya

15. A leading ITES/ BPO Head of Audit

16. Leading Financial Service Company Chief Risk Officer

17. Reliance Life Insurance Company Limited Sunder Krishnan

18. Sahara India Group Sushil Gupta

19. A leading General Insurance Company Head of Audit

20. Tata Capital Ltd S. Bhaskar

21. Tata Motors Limited Nagesh Pinge

22. TATA Power Parshuram Date

23. Telavance Inc Uday Gulvadi

24. Union KBC Asset Management Company Private Limited

Padmaja Shirke

25. Leading Telecom player in India Smitesh S Bhosale

26. Voltas Ltd Jyotin Mehta

27. Retail Stock Broker /financial service company

Asst. Vice President

28. A French MNC Head of Finance & Audit

29. Volkswagen Finance Private Limited Gopal Gattani

30. HDFC LIMITED Arjun Gupta


Disclaimer: The material is prepared with due care, however, any reliance should be placed only after consultation with the publication team. The contents of this material are for information purposes only and should not be construed as solicitation or advice in any manner whatsoever. No one should act upon the information provided in this material without appropriate professional advice. While the Institute of Internal Audit (IIA) and its research partner - Verita Management Advisors Pvt. Ltd. (“VERITA”) strives to ensure that the information contained herein is accurate, timely and reliable, we do not make warranties or representations, express or implied, including the warranty of merchantability and fitness for a particular purpose, or assumes any liability or responsibility for the accuracy, completeness, reliability, timeliness or usefulness of the information provided in this material.

This information is not intended to create, and receipt of it does not constitute, an advisor-client relationship. You acknowledge and agree that all proprietary rights in the material shall remain the property of IIA and VERITA. The modification, reproduction, redistribution, disclosure, display and transmission of any information contained herein or deriving commercial use or benefit from the material is strictly prohibited. IIA and VERITA shall accept no liability for any damages, claims or losses of any nature, arising indirectly or directly, from the use of the data or material or otherwise howsoever arising.

Research Partner

Contact Us:

IIA Bombay Chapter

209, Sagar Avenue, 2nd Floor, Above ICICI bank Limited,

SV Road, Andheri (West), Mumbai 400 058

Verita Management Advisors Pvt. Ltd.

441, Kirankunj Society, Bhadran Nagar, SV Road,

Malad (west), Mumbai 400 064

measuring the impact of internal audit in uncertain times report 7th nove… · the institute of...

Documents