Eduardo Person Pardini, CICP

 

In some meetings with members of audit committees, from different sectors, a common point that caught my attention was the dissatisfaction of the committee with the results of the audit assessment work.

In a nutshell, the most significant complaints revolved around the reactive attitude of the audit, very concerned with finding mistakes made in the past, often without understanding the root cause, generating innocuous recommendations and with little or no impact on the organization's performance, and also the low cost and benefit ratio of the audit, since it is not clear whether the results delivered bring something positive, savings or process improvement.

I understand the frustration of these directors, but I also understand that the internal audit, often, does not receive the support or necessary guidance for the improvement of their activities.

The audit committee has a share of blame in this process, since, being responsible for the audit activities, it has the obligation to give full support to the audit, in its structure and proficiency, as well as in the approval of the annual plan, including the definition of what will be audited object, the approach of the review and the emphasis that should be given on its scope.

The committee is a supervisory body, but also an advisor and guardian of good practices and quality that must be pursued by the audit team. I will not go into this in more depth, I will leave this topic for reflection in another article.

Let's go back to our central point, what I called “the entrepreneurial auditor”.

You may find this denomination strange, but it was the way found to try to convey the idea of this new posture and new vision that the auditor must conceive and apply in his activities. In order to understand where I want to arrive, I first need to let you know my vision of what is be an entrepreneur means:

Now we will review the internal audit mission according to the IIA - Institute of Internal Auditors, which says that the internal audit mission is:

 

Once these concepts are understood, we can idealize that the entrepreneurial auditor is the mixture of these two concepts.

Now we need to take into account that the corporate world has undergone profound changes, by significant paradigm disruptions.

Doing business or managing a process is very different than five years ago. Today the market is more globalized, more technological, more innovative, more disruptive and with a strong convergence to the digital, virtual world.

Technology allows borders to be gradually eliminated, opening up a vast market of operation, as well as allowing new players to enter the market only in a virtual way.

This disruptive innovation process is challenging for any corporation, making it significantly essential that the company has a strengthened governance structure, and that governance awareness is the basis for an internal environment that provides greater flexibility and adaptation of management to new market requirements. and competitiveness, without the operation losing its essence.

It is precisely in this boiling environment that the internal auditor, like the other managers, is inserted.

The internal auditor has an important role in promoting ethics and values ​​of conduct so that this culture is not lost during innovation processes. The auditor has the responsibility to contribute to the organization by making intelligent appointments that direct the necessary changes which will make either the processes or the organizational structure more innovative, more effective and more economical.

For this, the internal auditor must have an entrepreneurial vision, knowing and weaving a clear vision of the dynamics of corporate business, understanding the strategic objectives and their relationship with the organization's mission. He also needs to have a clear view of the operating cash flow cycle of the operation so that the strengthening of this cycle is always part of your assessments.

In addition, the entrepreneurial auditor must comprehensively understand the corporate risks present in the organizational and business structure, knowing their exposure, their vulnerabilities, going far beyond just looking at the risks of non-compliance.

The entrepreneurial auditor must perceive the opportunities for improvement, improvement and innovation that exist in business cycles, in operational processes, in aligning the use of resources with an effort to achieve the strategy.

Also, must be proficient in the application of audit standards, in the evaluation methodology, in the audit techniques and procedures and in the use of best management practices.

It must go beyond the trivial, helping management to see the actions that must be taken today so that the corporation remains competitive tomorrow.

Finally, I remembered a conversation with a C-Level of a business unit located in Ireland, some 25 years ago, where, in his view, the audit only served “to count the dead on the battlefield”, and what he needed was to have an audit that would support him in strengthening his actions so that he could win the war, with the fewest casualties possible.

This conversation reflected me a lot, because he was not wrong, we made reviews always looking at the past, and very little, or almost nothing, looking at the future. This conversation made us started to change our scope of work, in a timid but consistent way.

In my walks in the internal audit world, I still see that many auditors continue to “count the dead”, looking for errors and non-conformities in the transactions carried out. Not that it is not relevant to perform compliance assessments, but the auditor must be much more proactive than reactive in order to assist the organization in achieving its objectives.

Being part of a modern, proactive internal audit, with an entrepreneurial, innovative, participatory, collaborative, creative and resilient vision should be a goal for any internal audit professional who wants to have a place in this globalized world, which is increasingly volatile, complex, ambiguous and uncertain.

The decision of where you want to be is yours and nobody else. Only you can decide if you want to keep counting dead, or if you want to be an entrepreneurial auditor.  

So, as Jack Welch said:

 

But Always Be happy!

 

 

 

Yesterday the Institute of Internal Auditors released the new vision of the three lines, and the title caught my attention, as it does not mention the word “defense”, which can be either a mistake or deliberate, demonstrating that the members of each line are not there to defend, but to manage, add value, including the third line,  which makes much more sense to me.

The original model emerged with the publication on September 21, 2010 by FERMA and ECIIA in the Guidance on the 8th EU Company law as a recommendation for implementing the law's requirements for monitoring the effectiveness of the internal control system, internal audit and risk management.

This update model solved an anomaly of the previous model, which demonstrated a duality in the internal audit reporting line, an arrow for senior management, and another for the level of supervision and governance, creating some “noise” about the independence of the internal audit activity, with no much sense

In this new format, it is very clear that the reporting line should only be for the level of supervision and governance (Board and Committee), and the relationship with senior management (President, their directs) is a process of alignment, communication, coordination and collaboration. This point reinforces the importance of independence for the existence of an effective and integrated internal audit to the businesses.

This subject regarding independence is also addressed by principle 5, which objectively describes the independence of the audit in relation to management responsibility, as you may see below:

Another relevant subject, in my vision, that this model brings to our understanding to the role of the audit as a consultancy. It was a great confusion created when the definition of the audit was disclosed which includes in its statement that the audit adds value to the organization through assurance and consulting, which unfortunately, here in Brazil, allowed misunderstandings and great debates on this topic.

This new version accommodates this theme when it describes the roles of each of the lines, as we may see below, the role of the audit:

                             Internal Audit

•          Maintains primary accountability to the governing body and independence from the responsibilities of management.
•          Communicates independent and objectives assurance and advice to management and the governing body on the adequacy and effectiveness of governance and risk management (including internal control) to support the achievement of organizational objectives and to promote and facilitate continuous improvement.
•          Reports impairments to Independence and objectivity to the governing body and implements safeguards as required.

 

Observe that it describes “independent and objective assurance and advice”, remembering that objectivity is the auditor's independence in positioning and giving an opinion, based on his competence and proficiency.

I have had that the audit fulfills its role as a consultant, not implementing or executing management activities, but rather, making intelligent notes to management on opportunities for operational improvements to strengthen the efficiency, effectiveness and economy of the risk management process, controls internal and governance.

This model also stresses that independence does not mean isolation, as there must be an interaction between the three lines. The auditors have to be aligned with the organization's strategic and operational needs in order to became a “trusted advisor and strategic partner”.

However, for this to be true, the auditors must go back to basics.

When I say go back to basics, it is that the internal auditors must objectively understand their mission and the definition of what auditing is, essential points that are described in the International Structure of Professional Practices of the IIA. In addition, must be proficient in application of the standards of attributes and performance when carrying out the evaluation and / or consultancy work.

Finally, I believe that some discussions will arise about the model and its application, and this is my contribution to the understanding of this new version of the three-line model.

 

Be happy!

Somehow, especially after corporate fraud event, this question about the importance, and also, about the effectiveness of internal auditing, becomes more latent and frequent, mainly in relation to the cost and benefit of having the internal audit in the corporation.

Part of this doubt is generated by the auditors themselves, who are stationed in compliance work, or with the archaic view that a good audit is one that finds errors and irregularities, fail to demonstrate objectively and pragmatically the gains generated by the existence of an audit activity. proactive, structured and integrated audit to the business.

To answer the question above, we first need to understand that internal auditing aims to add value to the organization through smart notes on opportunities for improvement, resulting from independent and objective assessments of the performance of operational processes, considering efficiency, effectiveness and economics of risk management, compliance, internal control system and corporate governance.

It is important to note that the internal audit activity does not exist to find errors or irregularities, it is not a control, it is not an ombudsman, nor a provider of opinions, nor is it a inspection unit.

Internal audit is not control, but it is part of the internal control system, as it is the periodic monitoring activity dealt with in the monitoring component of the COSO Internal Controls Structure management good practice paradigm.

It is an activity based on standards and professional practices that guide your organization and the applied evaluation methodology. The auditors' positioning and opinion are based on factual evidence, obtained through audit procedures and techniques, applied in a systematic and disciplined manner, comparing the activity evaluated with the chosen standard of best management practices, thus allowing for quality notes and effective for improving the entity's operational and strategic management process.

Although the internal audit does not have the objective of detecting irregularities, the auditor is proficient in detecting indications of the existence of possible irregularities and, therefore, directing the finding to the competent bodies. He is also proficient in identifying operational vulnerabilities that may contribute to fraud and / or corruption events, suggesting, for responsible management, taking actions to mitigate this vulnerability.

Internal audit is also responsible for the dissemination of corporate ethical values ​​in the day-to-day activities of the organization, including the dissemination of best management practices, thus contributing to the increase of the organization's capacity to achieve its objectives through economic and effective processes.

It is worth remembering that, according to our experience, only with the presence of the audit activity in the organizational structure, possible acts of irregularities are already prevented, as it changes the view of the “rational” attribute, considered in the concept of the fraud triangle.

Finally, an independent, proactive and integrated internal auditing activity is essential for strengthening the corporate governance structure. Furthermore, it should not be seen as a cost center, since through your work, the company will have:

• More aligned, effective and economical operating processes,
• Better understanding of existing risks, resulting in a better mitigation process,
• Minimization of losses arising from possible acts of irregularities.

But for all of this to be a reality, it is essential to have a modern and integrated internal audit with proficient, proactive auditors aligned with the organization's business, guided by the auditing standards and professional practices.

Be happy!

O curso intensivo para formação de especialistas em controles internos está disponível na platafroma de ensino a distancia da Crossover Business School. Este curso será dividido em sete módulos os quais irão cobrir as oito categorias de conhecimento de nosso CBOK ICI, conhecimento este que todo especialistas certificado CICS deve ser proficiente.

Para mais informações acesse o https://crossoverbusinessschool.com