Topic: Trends and Changes in the Internal Audit Function Thursday 10 th November, 2016

1. Topic: Trends and Changes in the Internal Audit FunctionThursday 10th November, 2016 Institute of Certified Public Accountants of Kenya (ICPAK)-Annual Internal Audit Conference Theme: Internal As an Enable of Business Willis O. Okwacho Office of the Internal Auditor-General The National Treasury

2. Proposed Internal Audit Standards Change “The demands on internal audit are evolving rapidly, and The IIA is working diligently to make sure the Standards and IPPF reflect that evolution,” said IIA President and CEO Richard F. Chambers, CIA, QIAL, CGAP, CCSA, CRMA. “We indicated last year that the changes to the IPPF would require related updates to the Standards. The comment period on these proposed changes is the first step toward completing that update.” ALTAMONTE SPRINGS, Fla. (Feb. 1, 2016) 

3. 5 Global Trends in Internal Auditing • Be attuned to upcoming regulatory changes • Advocate for mandatory internal audit in publicly traded companies • Be wary of internal auditing’s expanding scope of work • Invest in talent management • Step out of their "comfort zones"​

4. Trends worth watching and addressing • Enhanced Internal Audit Sta​​tur​​e Is Driving Global Growth • Stakeholders Are Deriving Value but still Want to see us raise the bar • New Risks Such as Brexit are reinforcing the need t​​o "Audit at the Speed of Risk" • The Profession is increasingly at the epicenter of corporate scandals • Demands for new skills are creating talent risks

5. The Role of Internal Audit • The role of internal audit within an organization has undergone dramatic changes in the recent years. Today, audit activities are considered as tools for value addition in form of assurer, assessor and advisor. An optimally managed internal audit can prove to be the best tool for designing key strategies and making pragmatic business decisions. • According to survey reports, the senior executives and audit committees indicate that their internal audit function has an important role to play in their overall risk management efforts, and in achieving business objectives. • They have the potential to move it to a higher value-added model, functioning as an increasingly valuable resource, trusted advisor and consultant to key stakeholders.

6. Value Proposition of Internal Auditing

7. Oganisation of Governance

8. What is internal audit? • The role of internal audit is to provide independent assurance that an organisation's risk management, governance and internal control processes are operating effectively.

9. What do internal auditors do? • We have a professional duty to provide an unbiased and objective view. We must be independent from the operations we evaluate and report to the highest level in an organisation: senior managers and governors. Typically this is the board of directors or the board of trustees, the accounting officer or the audit committee.

10. What is its value to the Organisation? • Internal auditors help organisations to succeed. • We do this through a combination of assurance and consulting. • The assurance part of our work involves telling managers and governors how well the systems and processes designed to keep the organisation on track are working. • Then, we offer consulting help to improve those systems and processes where necessary.

11. The Changing Role of Internal Auditors • Every organisation knows that its internal auditing function is the lifeblood of its compliance program.  • Some organisations carry that to an extreme by placing the overall compliance function in the auditing department.  As we all know, that is a mistake.

12. The Changing Role of Internal Auditors • Auditing plays a critical role in every compliance program.  Why?  • For obvious reasons, internal auditors usually are the first to uncover improper payments.  • Historically, internal auditors have adhered to a “materiality” standard when conducting internal audits.  That has changed, and will continue to change, in response to aggressive Ethics and Anti-Corruption enforcement. 

13. The Changing Role of Internal Auditors • Internal auditors are now applying a “blended” approach which includes not only “materiality” but extends to risks such as bribery, fraud and other financial misconduct.  It is a welcome development.  • Petty cash funds which usually escaped any review are now regularly included in internal audit reviews.  • Also, internal auditors are now employing more sophisticated sampling techniques to try and identify trends and potential risks without conducting burdensome and time consuming audits of entire divisions of organizations.

14. The Changing Role of Internal Auditors • Internal auditors are becoming even more skilled in conducting interviews of organisation personnel.  • The old model of auditors discovering a problem and turning it over to compliance or legal professionals is fading.  • In reality, auditors may uncover a financial problem and conduct an all important initial interview of a manager or employee to try and get an explanation.  This initial discussion can be critical to the organisation’s response to the problem.  

15. Challenges Facing Internal Auditors in their Changing Role • Internal auditors are usually skilled in conducting these interviews.  They have evidence of a problem and they need an explanation.  • It is hard to lie to an auditor when the numbers are staring an employee in the face.  • It is no coincidence that internal auditors are usually the ones to identify and uncover an illegal bribery scheme.  The internal auditing profession has embraced its new role, and done so with professionalism and diligence. • In most cases, the manager and employee will deny any wrongdoing.  That is not unusual.  The initial explanation, however, usually becomes important as the first step in eventually breaking down the cover story and finding out the truth of what occurred. 

16. Three Trends To Watch • A lot more change on the way: With a patchy return to growth, and some economies facing recession companies will have to work hard to keep pace with pressure from investors to produce revenue growth and, in turn, are likely to pass some of the pressure on to their own employees. It is also likely to cause senior managers to launch a raft of big and disruptive “change initiatives” which are tough for employees and pose new and different risks.

17. Three Trends To Watch • Leaner operations will bring more regulatory and reputational risk: As companies strive for leaner operations, they rely more heavily on third parties, joint ventures, and sourcing important inputs from a single company. This increases exposure to risks outside the company (like a spike in commodity prices that might hurt an important supplier). It also diminishes risk oversight, as companies must rely on the risk management (and compliance) capabilities of third parties, which may not meet the same standards.

18. Three Trends To Watch • Digitization means ever more information risk: For many years, only technology firms based their innovation and growth plans on IT. But now firms from all industries, even traditional ones like utilities and retailers, use information and digital technologies to adopt their business models and create new business opportunities.

19. Four Ways Internal Audit Should Respond To support the business properly and provide assurance over an ever-growing risk universe, Internal Audit should do four things. • First, find efficiencies in their traditional work through the use of data analytics or automation.  • Second, acquire the skills to provide assurance over these types of risks, either through internal development of skills (e.g., in technical areas) or by coordinating with other assurance groups, such as information security and data privacy. • Third, alter the cadence and nature of assurance activities, moving from retrospective reviews of static processes to reviews of processes in flux. • Fourth, given the greater interconnectedness and complexity of risks, Internal Audit must also adapt their risk assessments to draw the causal relationships between risks and their causes.

20. Conclusion • Given the limited resources available to internal auditors in an organisation, the selection and design of an audit program must be carefully executed against an overlay of priorities and risks.  • Priorities have to be set based on these risks, while recognizing the importance of audits to identify important trends in operations.

21. The End Thank you for your attention willis.okwachow@gmail.com 0722720335