The entrepreneurial internal auditor, a new generation, a new posture, a new vision!

 

In some meetings with members of audit committees, from different sectors, a common point that caught my attention was the dissatisfaction of the committee with the results of the audit assessment work.

In a nutshell, the most significant complaints revolved around the reactive attitude of the audit, very concerned with finding mistakes made in the past, often without understanding the root cause, generating innocuous recommendations and with little or no impact on the organization's performance, and also the low cost and benefit ratio of the audit, since it is not clear whether the results delivered bring something positive, savings or process improvement.

I understand the frustration of these directors, but I also understand that the internal audit, often, does not receive the support or necessary guidance for the improvement of their activities.

The audit committee has a share of blame in this process, since, being responsible for the audit activities, it has the obligation to give full support to the audit, in its structure and proficiency, as well as in the approval of the annual plan, including the definition of what will be audited object, the approach of the review and the emphasis that should be given on its scope.

The committee is a supervisory body, but also an advisor and guardian of good practices and quality that must be pursued by the audit team. I will not go into this in more depth, I will leave this topic for reflection in another article.

Let's go back to our central point, what I called “the entrepreneurial auditor”.

You may find this denomination strange, but it was the way found to try to convey the idea of this new posture and new vision that the auditor must conceive and apply in his activities. In order to understand where I want to arrive, I first need to let you know my vision of what is be an entrepreneur means:

“Be an entrepreneur is to do something new, realizing the opportunities, recognizing the risks and adversities. It is the ability to transform, go beyond what is expected, in a creative and resilient way.”

Now we will review the internal audit mission according to the IIA - Institute of Internal Auditors, which says that the internal audit mission is:

To enhance and protect organizational value by providing risk-based and objective assurance, advice, and insight.

 

Once these concepts are understood, we can idealize that the entrepreneurial auditor is the mixture of these two concepts.

Now we need to take into account that the corporate world has undergone profound changes, by significant paradigm disruptions.

Doing business or managing a process is very different than five years ago. Today the market is more globalized, more technological, more innovative, more disruptive and with a strong convergence to the digital, virtual world.

Technology allows borders to be gradually eliminated, opening up a vast market of operation, as well as allowing new players to enter the market only in a virtual way.

This disruptive innovation process is challenging for any corporation, making it significantly essential that the company has a strengthened governance structure, and that governance awareness is the basis for an internal environment that provides greater flexibility and adaptation of management to new market requirements. and competitiveness, without the operation losing its essence.

It is precisely in this boiling environment that the internal auditor, like the other managers, is inserted.

The internal auditor has an important role in promoting ethics and values ​​of conduct so that this culture is not lost during innovation processes. The auditor has the responsibility to contribute to the organization by making intelligent appointments that direct the necessary changes which will make either the processes or the organizational structure more innovative, more effective and more economical.

For this, the internal auditor must have an entrepreneurial vision, knowing and weaving a clear vision of the dynamics of corporate business, understanding the strategic objectives and their relationship with the organization's mission. He also needs to have a clear view of the operating cash flow cycle of the operation so that the strengthening of this cycle is always part of your assessments.

In addition, the entrepreneurial auditor must comprehensively understand the corporate risks present in the organizational and business structure, knowing their exposure, their vulnerabilities, going far beyond just looking at the risks of non-compliance.

The entrepreneurial auditor must perceive the opportunities for improvement, improvement and innovation that exist in business cycles, in operational processes, in aligning the use of resources with an effort to achieve the strategy.

Also, must be proficient in the application of audit standards, in the evaluation methodology, in the audit techniques and procedures and in the use of best management practices.

It must go beyond the trivial, helping management to see the actions that must be taken today so that the corporation remains competitive tomorrow.

Finally, I remembered a conversation with a C-Level of a business unit located in Ireland, some 25 years ago, where, in his view, the audit only served “to count the dead on the battlefield”, and what he needed was to have an audit that would support him in strengthening his actions so that he could win the war, with the fewest casualties possible.

This conversation reflected me a lot, because he was not wrong, we made reviews always looking at the past, and very little, or almost nothing, looking at the future. This conversation made us started to change our scope of work, in a timid but consistent way.

In my walks in the internal audit world, I still see that many auditors continue to “count the dead”, looking for errors and non-conformities in the transactions carried out. Not that it is not relevant to perform compliance assessments, but the auditor must be much more proactive than reactive in order to assist the organization in achieving its objectives.

Being part of a modern, proactive internal audit, with an entrepreneurial, innovative, participatory, collaborative, creative and resilient vision should be a goal for any internal audit professional who wants to have a place in this globalized world, which is increasingly volatile, complex, ambiguous and uncertain.

The decision of where you want to be is yours and nobody else. Only you can decide if you want to keep counting dead, or if you want to be an entrepreneurial auditor.  

So, as Jack Welch said:

Change before you need to do it

 

But Always Be happy!

 

 

 

The three lines of "defense", a new vision!

Yesterday the Institute of Internal Auditors released the new vision of the three lines, and the title caught my attention, as it does not mention the word “defense”, which can be either a mistake or deliberate, demonstrating that the members of each line are not there to defend, but to manage, add value, including the third line,  which makes much more sense to me.

The original model emerged with the publication on September 21, 2010 by FERMA and ECIIA in the Guidance on the 8th EU Company law as a recommendation for implementing the law's requirements for monitoring the effectiveness of the internal control system, internal audit and risk management.

This update model solved an anomaly of the previous model, which demonstrated a duality in the internal audit reporting line, an arrow for senior management, and another for the level of supervision and governance, creating some “noise” about the independence of the internal audit activity, with no much sense

In this new format, it is very clear that the reporting line should only be for the level of supervision and governance (Board and Committee), and the relationship with senior management (President, their directs) is a process of alignment, communication, coordination and collaboration. This point reinforces the importance of independence for the existence of an effective and integrated internal audit to the businesses.

This subject regarding independence is also addressed by principle 5, which objectively describes the independence of the audit in relation to management responsibility, as you may see below:

Principle 5: Third Line Independence

Internal audit´s independence from the responsibilities of management is critical to its objective, authority, and credibility. It is established through: accountability to the governing body; unfettered access to people, resources, and data needed to complete its work; and freedom from bias or interference in the planning and delivery of audit services.

Another relevant subject, in my vision, that this model brings to our understanding to the role of the audit as a consultancy. It was a great confusion created when the definition of the audit was disclosed which includes in its statement that the audit adds value to the organization through assurance and consulting, which unfortunately, here in Brazil, allowed misunderstandings and great debates on this topic.

This new version accommodates this theme when it describes the roles of each of the lines, as we may see below, the role of the audit:

                             Internal Audit

•          Maintains primary accountability to the governing body and independence from the responsibilities of management.
•          Communicates independent and objectives assurance and advice to management and the governing body on the adequacy and effectiveness of governance and risk management (including internal control) to support the achievement of organizational objectives and to promote and facilitate continuous improvement.
•          Reports impairments to Independence and objectivity to the governing body and implements safeguards as required.

 

Observe that it describes “independent and objective assurance and advice”, remembering that objectivity is the auditor's independence in positioning and giving an opinion, based on his competence and proficiency.

I have had that the audit fulfills its role as a consultant, not implementing or executing management activities, but rather, making intelligent notes to management on opportunities for operational improvements to strengthen the efficiency, effectiveness and economy of the risk management process, controls internal and governance.

This model also stresses that independence does not mean isolation, as there must be an interaction between the three lines. The auditors have to be aligned with the organization's strategic and operational needs in order to became a “trusted advisor and strategic partner”.

However, for this to be true, the auditors must go back to basics.

When I say go back to basics, it is that the internal auditors must objectively understand their mission and the definition of what auditing is, essential points that are described in the International Structure of Professional Practices of the IIA. In addition, must be proficient in application of the standards of attributes and performance when carrying out the evaluation and / or consultancy work.

Finally, I believe that some discussions will arise about the model and its application, and this is my contribution to the understanding of this new version of the three-line model.

 

Be happy!

What is the importance of Internal Audit in the organization's governance process?

Somehow, especially after corporate fraud event, this question about the importance, and also, about the effectiveness of internal auditing, becomes more latent and frequent, mainly in relation to the cost and benefit of having the internal audit in the corporation.

Part of this doubt is generated by the auditors themselves, who are stationed in compliance work, or with the archaic view that a good audit is one that finds errors and irregularities, fail to demonstrate objectively and pragmatically the gains generated by the existence of an audit activity. proactive, structured and integrated audit to the business.

To answer the question above, we first need to understand that internal auditing aims to add value to the organization through smart notes on opportunities for improvement, resulting from independent and objective assessments of the performance of operational processes, considering efficiency, effectiveness and economics of risk management, compliance, internal control system and corporate governance.

It is important to note that the internal audit activity does not exist to find errors or irregularities, it is not a control, it is not an ombudsman, nor a provider of opinions, nor is it a inspection unit.

Internal audit is not control, but it is part of the internal control system, as it is the periodic monitoring activity dealt with in the monitoring component of the COSO Internal Controls Structure management good practice paradigm.

It is an activity based on standards and professional practices that guide your organization and the applied evaluation methodology. The auditors' positioning and opinion are based on factual evidence, obtained through audit procedures and techniques, applied in a systematic and disciplined manner, comparing the activity evaluated with the chosen standard of best management practices, thus allowing for quality notes and effective for improving the entity's operational and strategic management process.

Although the internal audit does not have the objective of detecting irregularities, the auditor is proficient in detecting indications of the existence of possible irregularities and, therefore, directing the finding to the competent bodies. He is also proficient in identifying operational vulnerabilities that may contribute to fraud and / or corruption events, suggesting, for responsible management, taking actions to mitigate this vulnerability.

Internal audit is also responsible for the dissemination of corporate ethical values ​​in the day-to-day activities of the organization, including the dissemination of best management practices, thus contributing to the increase of the organization's capacity to achieve its objectives through economic and effective processes.

It is worth remembering that, according to our experience, only with the presence of the audit activity in the organizational structure, possible acts of irregularities are already prevented, as it changes the view of the “rational” attribute, considered in the concept of the fraud triangle.

Finally, an independent, proactive and integrated internal auditing activity is essential for strengthening the corporate governance structure. Furthermore, it should not be seen as a cost center, since through your work, the company will have:

• More aligned, effective and economical operating processes,
• Better understanding of existing risks, resulting in a better mitigation process,
• Minimization of losses arising from possible acts of irregularities.

But for all of this to be a reality, it is essential to have a modern and integrated internal audit with proficient, proactive auditors aligned with the organization's business, guided by the auditing standards and professional practices.

Be happy!

Attention managers, now it is time to turn on “survival mode”!

In this article I would like to deal with the impact of the pandemic in the organizations. The idea is to work with important points and actions which will help the process to corporation survival.  

It is based on an experience that I had managing a business company during an economic crisis with a strong impact in the agricultural sectors here in Brazil.

Certainly, very few professionals and/or corporations were prepared to face the current situation. Covid 19 emerged as a low-probability event, but with a very high impact.

The impact of this event on the global economy is not yet known, but based on the forecasts and what we are experiencing, it will be deep. For sure, in medium-term, it will break with the existing pattern of economic, social and market structure.  Of course, the short-term impacts, due to the halt in business activities, must be the management focus.

We do not know how long all this situation will last, but it will be much longer than companies can endure. Some sectors, will grow at this time, but most companies will suffer a negative impact on their business, for some, the impact will be deadly.

Those corporations that have done their homework by implementing effective corporate governance, based on best management practices, will have a greater chance of survival. Those who have not taken the same care, will possibly not survive.

In some lectures I had already commented that linear companies with a traditional organizational structure had little time to change, because the (physical) world was converging quickly and unequivocally into the virtual world, a world that no longer accepts structured hierarchical organizations from traditional way; then the change would be a matter of time. I imagined that they still had about five years to adapt, however, now, with all this happen, this time, in my view, does not exist anymore.

Now, one topic that should be on the agenda of any corporation, be it large, medium or small, is the short-term survival of the business.

The crucial point, at this moment, is not knowing how long this event will last, and how worse it will be. The problem is not being able to see the possible post-pandemic scenarios, thus making it difficult to take actions in order to direct business.

There are many unanswered questions in the air: Will the economic hubs change? Will global supply and logistics structures be maintained? How will the consumer market behave? And what will be the impacts on the workforce?

Organizations will need to answer these questions in order to start thinking about their structure, the organizational and operational architecture for this new world ahead.

But before that, companies must go through this turbulence, and for that now it is time to start the "survival mode".

At this moment nothing is more important than the maintenance and health of the operational cash. In the short and medium term, it is not the lack of profit that breaks a company, but the lack of cash, which is a fact, either you have money or you have no money.

It is interesting how some experiences are remarkable, and now, providing supporting for some companies in directing the “survival mode”, I remembered the year of 1994, when the advent of the Real Plan (Brazilian economic plan which move from hyperinflation for more stable economy), where the companies that worked in the agricultural sector were severely impacted by freezing the price of agricultural commodities, but with no freezing interest on loans and financing for planting, harvesting and mechanization, which cause a great financial mismatch, and disruption of the economic base of this market.

At this time, I was the financial director of a tractor and harvester company in southern Brazil, and we felt this impact head on, without warning, investing in expanding production capacity. It really was an odd experience in my career.

Imagine being idle for about 160 days, with no sales and no production; leveraged in the financial market, strong delay in accounts receivable, three thousand employees on the payroll and negative R$ 180 million (almost US$ 120 million) in cash. My luck, at this moment, was that I had one of the best teams I have ever had in my entire professional life, composed of highly trained and committed professionals.

I believe that this experience was the closest thing to what I imagine the day-to-day life of companies at this time of pandemic.

When I talk about of "Survival Mode" I may make the analogy with a boat sailing in the middle of a rough sea, with more water entering than the pump has the capacity to expel. In this situation decisions must be quick and oriented to maintain the buoyancy of the vessel for as long as possible.

Well, let's get to it, what I am going to share with you are some actions that helped me a lot in 1994, and perhaps it can help your corporations at the present time.

Are they:

1. Create a crisis management committee, composed in a multifunctional way by the board and specialized managers,

2. Unlike 1994, an eminently economic event, this is an event related to health, so it is important to take actions to preserve the health of employees, especially when there are employees in the risk group. Some will work remotely in the home-office, and others in in the office, but in a controlled way.

3. Fast and objective communication is essential, so I suggest creating a daily meeting to discuss the actions that should be taken to protect the cash. As some fronts are open for the execution of specific actions that must be carried out immediately, such as rational cash advance, extension of accounts payable and banking operations, monitoring the performance of future cash and others.

4. Identifying the essential processes to maintain the operation. It is important in order to decide which process or task can be put on stand-by with low business impact. For projects under implementation, some will need to continue, but others should be put on stand-by. If the organization has specialists in internal controls or internal auditors, they are the appropriate professionals to carry out this survey.

5. Identify the existing possibilities for sales continuity, even in smaller volumes, and make it in line with the logistics process.

6. All this information will help the committee to know in advance what can be shut down, without having a strong impact on the continuity of the organization. The objective is to provide data for decision that can be taken to maintain the organization's survival.

7. In some sectors, the workforce has a large weight in the organization's cash flow, and a quick study should be done to create a phased layoff plan to face the cash shortage. In 1994, we decided to reduce wages at all levels, where higher levels had a higher percentage of reduction than lower levels. This plan was approved in a vote by all employees, without support from the works union, which was contrary to this measure.

The more the company manages to prolong its life, the greater will be the opportunity to have a clearer vision of this post-pandemic new world, which will help managers to take more assertive actions in the definition of a structure, aligned to the needs of this new market.

All efforts must be in the direction of taking the organization to the other side of the storm, with the least possible damage and loss.

In the case I reported above, we managed to take the company up until the moment it was sold to the company that owns the brand, and today this company remains one of the most prominent worldwide companies in the sector.

Unlike other crisis, the retraction will be worldwide, and it will impact all consumer markets, which makes this crisis, at least "special".

Today we are seeing a retraction in supply, but sooner we will also see a retraction in demand, a consequence of the closing of small and medium companies, and also due to massive labor layoff.

The estimated global recession in 2020 is 2.1%, however, it is still unknown how far it can go.

In a risk management process, we must work with at least three scenarios, the worst, the best and the balanced. In crisis management, work with the worst to make decisions and actions, as you may have only one chance to act.

I hope, the professionals and corporations may learn the value to have an effective corporate governance in place, with risk management and internal controls in the culture and management awareness.

At the end,

Be happy!

Curso Intensivo de Controles Internos agora disponível na plataforma de EAD

Inspiring Pepole for Innovation

O curso intensivo para formação de especialistas em controles internos está disponível na platafroma de ensino a distancia da Crossover Business School. Este curso será dividido em sete módulos os quais irão cobrir as oito categorias de conhecimento de nosso CBOK ICI, conhecimento este que todo especialistas certificado CICS deve ser proficiente.

Para mais informações acesse o https://crossoverbusinessschool.com

Atenção gestores, agora é hora de ligar o “modo sobrevivência”!

Neste artigo vou tratar do impacto da pandemia, a qual vivemos, nas organizações, e tecer alguns pontos importantes para a sobrevivência da corporação, baseado em uma experiencia pela qual passei no gerenciamento de uma crise econômica com forte impacto em um dos setores da economia.

Com certeza, pouquíssimos profissionais e/ou corporações estavam preparados para passar pela situação atual. O Covid 19 surgiu como um evento de baixa probabilidade, mas de altíssimo impacto.

O impacto deste evento na economia global ainda não é conhecido, mas com base nos prognósticos e no que estamos vivenciando, ele será profundo, de forma a romper com o padrão existente de estrutura econômica, social e de mercado, além lógico, dos impactos de curto-prazo devido a parada das atividades de negócio.

Não sabemos quanto tempo tudo isto vai durar, mas será por um tempo maior que as empresas podem suportar. Alguns setores, poucos, irão crescer neste momento, mas a maioria das empresas sofrerão um impacto negativo em seus negócios, para algumas, o impacto será mortal.

Aquelas corporações que fizeram sua lição de casa implementando uma efetiva governança corporativa, baseada nas melhores práticas de gestão, terão maior possibilidade de sobrevivência. Já as que não tiveram o mesmo cuidado, possivelmente ficarão pelo caminho.

Em algumas palestras já vinha comentando que as empresas lineares e com estrutura organizacional tradicional, estavam com seus dias contados, pois o mundo (físico) estava convergindo de forma rápida e inequívoca para o mundo virtual, mundo este que não aceita mais organizações hierárquicas estruturadas de forma tradicional; então seria uma questão de tempo. Imaginava que ainda teriam uns cinco anos para se adaptarem, entretanto, agora, com tudo isto, este tempo, ao meu ver, não existe mais.

O ponto agora, e que deve estar na agenda de trabalho de qualquer corporação, seja ela grande, média ou pequena, é a sobrevivência do negócio a curto-prazo.

O ponto crucial, neste momento, é não saber quanto tempo este evento irá durar, e o pior, não conseguir enxergar os possíveis cenários pós-pandemia, dificultando, com isso, ações para o direcionamento dos negócios.

São muitas questões sem resposta: Os polos econômicos se alterarão? As estruturas de suprimentos e de logísticas globais se manterão? Como será o comportamento e atitude do mercado consumidor? E quais são os impactos na força de trabalho?

As organizações precisarão responder estas questões para começar a pensar em sua estrutura, na arquitetura organizacional e operacional para este novo mundo que se avizinha.

Pois bem, mas antes as empresas devem passar por esta turbulência, e agora é hora de ligarem sua operação no “modo sobrevivência”.

Neste momento nada é mais importante do que a manutenção e saúde do caixa operacional. No curto e médio prazo não é a falta de lucro que quebra uma empresa, mas sim a falta de caixa, o qual é um fato, ou você tem dinheiro ou não tem dinheiro.

É interessante como algumas experiências são marcantes, e agora, auxiliando algumas empresas no direcionamento do “modo sobrevivência”, me veio na lembrança, o ano de 1994, quando do advento do Plano Real, onde as empresas que trabalhavam no setor agrícola foram duramente impactadas pelo congelamento do preço das commodities agrícolas, mas sem o congelamento dos juros dos empréstimos e financiamento para o plantio, colheita e mecanização, causando um grande descasamento financeiro, e ruptura da base econômica deste mercado.

Neste momento eu era o diretor financeiro de uma empresa de tratores e colheitadeiras no sul do Brasil, e sentimos este impacto de frente, sem aviso, investindo na ampliação da capacidade produtiva. Realmente foi uma experiencia impar na minha carreira. Imaginem ficar por volta de 160 dias parado, sem vendas e sem produção; alavancado no mercado financeiro, forte atraso no contas a receber, três mil colaboradores na folha e com R$ 180 milhões negativo no caixa. Minha sorte, neste momento, era que contava com uma das melhores equipes que já tive em toda minha vida profissional, composto por profissionais altamente capacitados e comprometidos.

Acredito que esta experiencia foi o ponto mais próximo do que imagino que está sendo o dia-a-dia das empresas neste momento de pandemia.

Quando falo em “Modo Sobrevivência” faço a analogia com um barco navegando no meio de um mar revolto, com água adentrando em maior quantidade que a bomba tem de capacidade de expelir. As decisões devem ser rápidas e orientadas para manter a flutuabilidade da nau por maior tempo possível.

Bom, vamos ao que interessa, o que vou compartilhar são algumas ações que me ajudaram muito em 1994, e que podem ajudar vossas corporações no momento atual.

São elas:

1.     Crie um comitê para a gestão de crise, composto de forma multifuncional pela diretoria e gestores especialistas,

2.     Diferente de 1994, evento eminentemente econômico, este é um evento relacionado com a saúde, então é importante tomar as ações para a preservação da saúde dos colaboradores, principalmente quando existem colaboradores no grupo de riscos. Alguns trabalharão de forma remota em home-office, e outros de forma controlada presencialmente.

3.     Uma comunicação rápida e objetiva é essencial, então sugiro criar uma reunião diária para se discutir as ações que devem ser executadas para a proteção do caixa. Como algumas frentes são abertas para execução de ações pontuais que devem ser executadas imediatamente como antecipação racional de caixa, alongamento do contas a pagar e das operações bancárias, monitoramento do desempenho do caixa futuro e outras.

4.     Identificar os processos imprescindíveis para a manutenção da operação é importante para decisão do que pode ser colocado em stand-by. Isto serve para os projetos em implementação, alguns precisarão continuar outros devem ser colocados em stand-by. Se a organização contar com especialistas em controles internos ou auditores internos, este são os profissionais adequados para realizar este levantamento.

5.     Identificar as possibilidades existentes de continuidade de vendas, mesmo que em volumes menores, alinhando com o processo de logística.

6.     Todas estas informações ajudarão o comitê conhecer antecipadamente o que poderá ser deixado de ser realizado, sem forte impacto na continuidade da organização, para que se possa tomar decisão objetiva para manter a sobrevida da organização.

7.     Em alguns setores a mão de obra tem um peso grande no caixa da organização, e deve ser feito um estudo rápido para criação de um plano de demissão escalonada ao enfrentamento da falta de caixa. Em 1994, decidimos pela redução dos salários em todos os níveis, onde níveis mais altos tiveram um percentual de redução maior, do que os níveis mais baixos. Plano este aprovado em uma votação por todos os funcionários, sem apoio do sindicato, o qual era contrário a esta medida.

Quanto mais a empresa conseguir prolongar sua vida, maior será a oportunidade de ter uma visão mais clara deste novo mundo, pós-pandemia, para tomar ações mais assertivas na definição de uma estrutura alinhada às necessidades deste novo mercado.

Todos os esforços devem ser na direção de levar a organização até o outro lado da tempestade, com menos avarias e perdas possíveis.

No caso que relatei acima, conseguimos levar a empresa até o momento em que foi vendida para a empresa detentora da marca, e hoje continua sendo uma das empresas mais proeminente do setor, de forma mundial.

Diferente de outras crises, a retração será mundial, e impactará todos os mercados consumidores, o que a torna, pelo menos “especial”. Hoje estamos vendo a retração da oferta, mas logo veremos também a retração na demanda, consequência do fechamento de micros e pequenas empresas, e também devido a demissão.

A recessão mundial em 2020 estimada é de 2.1%, entretanto, ainda é uma incógnita até onde ela pode chegar. Em um processo de gerenciamento de riscos devemos trabalhar com pelo menos três cenários, o pessimista, o otimista e o equilibrado. Na gestão de crise, trabalhe com o pior cenário para tomada das decisões e ações, pois pode ser que você tenha apenas uma chance de agir.

Como tudo na vida passa, isto também passará.

Que possamos, nós profissionais, e as corporações tirar lições para o amadurecimento da gestão e da governança.

No final,

Seja Feliz!