Courage: The Foundation of Objectivity in Auditing – Are You Prepared?

 Auditing is an essential pillar of corporate governance, requiring professionals to commit fully to objectivity. Objectivity represents the auditor's independence in expressing their opinion without being influenced by external forces or personal conflicts. However, this objectivity cannot be sustained without a fundamental component: courage. When conducting their work, auditors must be prepared to face challenges, resist external pressures, and communicate their conclusions with unwavering ethics and transparency.

Courage and Independence: Inseparable in Auditing

An auditor’s independence goes beyond rules and regulations. It manifests in a resolute stance against attempts at influence and manipulation. In many instances, auditors encounter conflicting interests that seek to mitigate or even conceal critical information. In this scenario, courage becomes the anchor that ensures a rigorous and impartial assessment, protecting stakeholders and safeguarding the integrity of financial reports.

According to Domain II of the Global Auditing Standards, objectivity and courage are fundamental ethical principles for auditors. This domain establishes that auditors must maintain independent thinking and demonstrate resilience in the face of challenges that could compromise their professional integrity. Thus, courage becomes an essential element in ensuring that professional judgment is exercised freely and impartially.

Facing Pressures and Ethical Dilemmas

Internal and external pressures can arise from various directions, from managers attempting to downplay irregularities to clients seeking to influence opinions. Without the necessary courage to resist these pressures, audit objectivity is undermined. Therefore, auditors must align their ethical stance with emotional resilience, ensuring that their work remains uncompromised by adverse circumstances.

Transparent Communication: A Reflection of Courage

Courage is not limited to resisting pressures; it also manifests in the clarity and firmness with which auditors communicate their findings. Audit reports often contain sensitive information that may be uncomfortable for those involved. However, truth and transparency must always prevail, regardless of potential retaliation or dissatisfaction from the audited parties.

Building a Culture of Courage in Auditing

To strengthen objectivity in auditing, organizations must foster a culture of courage. Continuous training, institutional support, and guidelines that protect auditors from retaliation are fundamental elements of this process. Furthermore, audit leadership must set an example, demonstrating that ethics and truth are non-negotiable values.

Final Reflection

Complete objectivity in auditing can only exist when accompanied by courage. The auditor who stands firm in their ethical and professional principles significantly contributes to the reliability and transparency of governance processes, even if this stance may cost them adversaries or even their job.

Therefore, it is important for you to reflect: How is your objectivity? How do you escalate your findings or opinions? Are you prepared to face the challenges that auditing imposes and maintain your unwavering integrity?

Remember: ethics and truth are non-negotiable values.

Be happy!

 

Por que os programas de compliance falham?

 

Como acontece com outras práticas de governança, o programa de compliance, para ser efetivo, requer que os pilares que irão sustentá-lo, no tempo e espaço, estejam presentes.

Vejamos alguns pontos com os quais normalmente me deparo nas corporações:

• Encontro programas de compliance que se restringem apenas na existência de políticas de integridade, que é importante, mas não o suficiente.
• Também, me confronto com programas muito bem elaborados e formalizados em políticas e procedimentos, entretanto, infelizmente, este programa fica somente no papel.
• Me deparo com áreas de compliance que sua atividade se resume na execução de controle, por meio do preenchimento de checklist, passando a ser, neste caso, parte da primeira linha de gestão, perdendo sua identidade de área especialista de segunda linha de gestão.

Não quero dizer com isto, que contar com um bom programa de integridade, ou ter um processo adequadamente formalizado, ou realizar um monitoramento independente não seja importante. Sim é importante, mas é preciso é que tudo isto faça parte de um processo mais amplo, estruturado e integrado.

Gosto sempre de lembrar que compliance é na realidade “atitude”.

É a atitude que todos, que façam parte ou se relacionam com a corporação, executem suas atividades, ações e decisões dentro dos valores morais e éticos da organização, amparado pelos requisitos legais, sejam eles oriundos de legislação externa, do país, estado, munícipio ou do órgão regulador, sem exceção.

Outro ponto importante que devemos considerar é que se o objetivo é ter uma corporação onde suas atividades sejam amparadas pelos seus valores morais e éticos, dentro dos requisitos legais, temos o “risco” de isto não acontecer.  

Se compreendemos que não estar em compliance é um risco, precisamos gerenciá-lo por meio de um processo estruturado para a identificação dos riscos e seus fatores, avaliando sua magnitude e no final, tratando-o de forma a manter o fator de risco alinhado ao apetite a risco da organização, que neste caso deve ser zero, por motivos óbvios.

Agora, considerando que se não todos, uma boa parte dos fatores de riscos tem sua origem em fatores internos, podemos dizer que o seu tratamento será por meio da implementação de um sistema de controle interno, o qual é formado por ações, formalizadas em políticas e procedimentos, para a mitigação da probabilidade do evento de riscos se materializar.

Então, até aqui, podemos compreender que um programa de compliance para ser efetivo necessita estar amparado por um processo integrado para o gerenciamento dos fatores de riscos, o qual por sua vez, necessita de um eficaz sistema de controles internos.

Mas tudo isto, ainda não é suficiente para que o programa de compliance realmente funcione apropriadamente. É importante que os três pilares basilares estejam presentes. Os pilares são:

1.   Cultura – A organização precisa ter um conjunto de valores e crenças apropriados para influenciar e alinhar a atitude e o comportamento de todos colaboradores, prestadores, terceiros aos requisitos de compliance.

2.   Consciência – A cultura prepara o caminho, mas é importante contar com gestores, colaboradores, prestadores e terceiros que conscientemente acreditem, se comprometam, e que, apoiado pelos valores morais da organização e pelas melhores práticas de gestão, exemplifiquem e exerçam suas atividades dentro dos requisitos de compliance,

3.   Formalização – Para a manutenção da qualidade e entendimento das atividades, estrutura, processos e monitoramento é necessário a existência de um conjunto de documentos como: políticas, procedimentos, código de conduta, instruções de trabalho e outros. Esta documentação, uma vez atualizada e amplamente divulgadas, permite a equalização e alinhamento das atividades e operações, independentemente de qual ciclo de negócio ela pertencer.

Posso, sem medo de errar, dizer que o grande desafio para a implementação de um efetivo programa de compliance é com certeza trabalhar os dois primeiros pilares: cultura e consciência.

Os órgãos de governança, a alta e a média gestão têm papel importante nestes quesitos. Eles têm a responsabilidade de definir os valores, promover um ambiente propicio para a aplicação das melhores práticas de gestão, exemplificando estes valores em seu discurso, posicionamento, ações e em suas decisões.

Logicamente, tudo isto exige uma mudança mental e comportamental de todos os envolvidos, principalmente dos níveis de gestão e tomadores de decisão. Um programa estruturado de capacitação gerencial em governança, compliance e nas práticas de gestão tende a reduzir a resistência à mudança, mas o comprometimento incondicional aos requisitos de compliance, pelos membros dos órgãos de governança, será essencial para o amadurecimento da gestão em relação ao compliance e melhores práticas de gestão.

Cada linha de gestão deve conhecer claramente suas responsabilidades, de forma transparente, não podendo haver dúvidas, de forma que possam prestar conta, para quem os elegeu, sobre toda e qualquer materialização do risco de compliance e/ou violação aos valores morais da organização.

Temas estes que devem fazer parte da agenda do presidente, do conselho de administração e do comitê estatutário de auditoria.

Para finalizar, os programas de compliance que falham são aqueles, que por algum motivo, não contam, de forma equilibrada, com os três pilares: Cultura, Consciência e Formalização

Então: Reflita, inove, mude e no final

Seja feliz!

Assessment Test - Control, Compliance & Substantive

 

Hi!

As you may know, one of my goals as a professional is to inspire people to innovate, thus helping to develop their knowledge, improving their skills.

For this, one of the ways I use is the creation of specialist figures, like the one above.

• When we are carrying out an evaluation of the process and the internal control system, whether by the internal controls area, or by the internal audit, it is very important that the definition of the procedures and techniques used are aligned with the nature of the evaluation, whether it is an evaluation performance, compliance, and/or accounting.

• The choice of which test to apply in gathering the evidence needed to issue an opinion must also take into account the scope and object of what is being evaluated.

• In this figure, the three types of existing tests and the attributes for their applicability are described, according to my understanding.

• You will usually find substantive and compliance tests in the existing bibliography, considering compliance to be the test that applies in the validation of control or else in the assessment of legal compliance.

• I segregate this test into two: control test, which is used to test the effectiveness of the control and compliance test, which is used to assess whether the activity and/or product of the process was performed in accordance with legal requirements.

I hope that this understanding and this figure is useful for your professional activities, and I am available for any doubts that may exist. Enjoy and follow us on Instagram, Linkedin, Facebook, and the TV Crossover Brazil channel on Youtube.

Be happy,

Eduardo Person Pardini

Internal controls, the responsibility of everyone!

Questioning who is responsible for internal controls is a common and recurring situation in the corporate world. When the company has an area of ​​internal controls, it is attempted to wrongly attribute this responsibility to it.

Why does this happen?

In my opinion, this behavior is a consequence of the lack of maturity in the management process in relation to good practices, in line with the fragility of a university that does not properly teach managers.

This weakness is evident when, managers and other professionals, relate internal controls to bureaucracy and / or “plastering” the business process. They fail to see and associate that internal control is a response to the action of mitigating a risk factor, which results in increasing the company's ability to achieve its strategic objectives.

The maturity of governance involves the improvement of the internal environment through the strengthening of the culture in the use of good management practices and the consolidation of awareness of risks and controls.

An essential point for this to happen is the correct addressing of the responsibility of each person within the organization in relation to the internal control system.

The model of the three management lines helps us to demonstrate these responsibilities, and was the basis for the construction of the diagram that I prepared to facilitate this understanding.

Let's see:

1. Governance Structure - I include here the Board and statutory committees, which are responsible for promoting the appropriate environment for the culture development and awareness of risks and controls. In addition, they must be committed to good management practices, supervising and monitoring the application of these concepts by the executive and operational management, following up on the implementation and improvement of internal controls.

2. Executive and Operational Management - In this case, executive management is the president and his directs, while operational management is the managers below the executive management line. The responsibility lies in exemplifying the commitment to internal controls, and in defining, implementing, executing and supervising the internal control system in order to keep operational risks within acceptable limits, as defined by the corporate risk appetite. This first line of management are the “owners” of risks and control, with no exception.

3. Specialists - Responsible for supporting the executive and operational management, first line, to apply the best management practices for the modeling, implementation, maintenance and improvement of the process and its internal control system integrated with the corporate risk management structure. This group includes specialists in internal controls, specialists in risk management, compliance and governance. They are the second line of management.

4. Internal audit - It is an independent and objective activity, usually reporting to the governance structure, with the objective of adding value, through the application and execution of an independent and objective evaluation on the internal control, risk management and corporate governance systems.

As you may see, every single person within an organization, without exception, has explicit responsibilities regarding internal controls, either in their design, implementation, execution or in their quality.

However, the greatest responsibility is left to the executive management (president and its directs) which must promote the properly environment, based in the ethics and best practices, in order to create the culture where all managers and employees recognize their responsibility for the existence of high quality internal control system.

I would like conclude this article with this quote:

“The great enemy of truth is often not the lie - deliberate, contrived and dishonest - but the myth - persistent, persuasive and unrealistic” J.F.Kennedy

 

Always, be happy!

Approach 4.0 for Internal Controls Specialist

 

The internal controls specialist, especially those with CICS - Certified Internal Control Specialist certification, cannot be supporting actors, they need to be protagonists, leading the dissemination and application of the best management practice structures in their organization, supporting management in this process structural changes, allowing the company to maintain its competitive advantage.

For this, internal control professionals must innovate their approach in the activities of modeling, implementation or evaluation of operational processes, risk management and internal control system.

Having a more holistic view of the company, aligning the market, strategy and operation, is a fundamental requirement for the specialist. He needs to see and understand the meaning of the "parts" in the "whole" business, making sense throughout the operation's ecosystem.

In addition to all the technical and managerial training that this professional must have, he needs to include, in his activities, new structured models, breaking paradigms and expanding his coverage and vision beyond the controls

Thinking about encouraging some reflections and also contributing to these changes, I describe in the diagram, some attributes, which I consider essential, and which should be part of this approach which I called, for lack of creativity, as 4.0, alluding to the fourth industrial revolution that focuses on increased efficiency and productivity using physical cyber systems, automation, IOT, cloud and others.

Let's take a look in these attributes:

1. Evaluation of the organizational structure based on a business vision, so that it can promote the alignment of the capital applied in the operational organization with the planned strategic return,

2. Application of structured and disciplined methodology to evaluate processes and activities, considering the inclusion of agile principles and values,

3. Add a review of the performance of the governance, compliance and integrity program as a requirement in the processes, tasks and environment assessment and validation programs,

4. Use of data science techniques and tools in its processes for surveying and testing the efficiency and effectiveness of the internal control system, such as for database validation and information security,

5. Strengthen the vision of strategic and operational risks inherent to the corporation, paying special attention to the emerging risks, whether in the management of data processing technology applied to operational processes, in innovation, in the market, or in other dimensions that may impact the organization's ability not to achieve its mission,

6. Identify the best management practices that can be considered as paradigms for improving performance and innovation, promoting them in the structure, strengthening the control environment and perfecting the fundamentals of corporate governance, risk management, internal control systems, compliance and / or other related activities.

As you may see, the adoption of these attributes, in the activity of internal controls, requires a change of “mindset”, not only of the professionals of internal controls, but also of the management, at all levels.

Every change generates reaction and resistance, so that in order to be successful they must be planned, including in this plan a robust process of sensitizing the structure for the promotion and justification of awareness and culture of efficiency, risks and controls, mitigating the risk of not being successful in this change.

I end this article with a phrase that always helps me when I'm making some excuse for not changing, which is:

"Change is the law of life, those who look only to the past, or to the present will be forgotten in the future" J.F Kennedy

 Be Happy!