Presentation by Dr. Rainer Lenz at the 2019 Annual Conference of the European Commission's Internal Audit Service about the Added Value of Internal Audit

1. WORK STREAM:
ENSURING THE RIGHT ORGANISATION, PROCESSES, SKILLS
AND TECHNOLOGY:
HOW DO (INTERNAL) AUDITORS HAVE TO ADAPT THEIR
WORKING METHODS TO DELIVER AND ADD VALUE
Dr. Rainer Lenz
19 November 2019
The Internal Audit Service (IAS) of the European Commissions annual international conference in Brussels on 27 November 2019.

2. MY THREE KEY MESSAGES:
SWIMMING IN THE ORGANISATION
INTERNAL AUDIT AS AN ENABLER OF
LEARNING AND CHANGE
FARMER
2

4. My profile and background in IA since 2007
Role CAE CAE CAE
Industry Pharma Ceramics Commercial
Vehicle Supplier
Years 2007 - 2013 2014 - 2018 Since 2018
Revenue € bn 2.0 (2012) 0.8 (2017) 1.3 (2018)
Employees 10,000 8,000 4,500
Footprint Global Global Global
# Plants > 20 > 10 > 20
# Legal entities > 50 > 50 > 40
Lenz, R. (2013), Insights into the effectiveness of internal audit: a multi-method and multi-perspective study,
Université catholique de Louvain - Louvain School of Management Research Institute, Doctoral Thesis 01|2013,
https://bit.ly/2r0WObY
PracticePhD
33 3FTE
IAF

5. BENCHMARKING DATA STAFFING & PRODUCTIVITY
 Benchmarking, N = 12
 Industry peer-group
 Huge spread
 Staffing/headcount
 Productivity
 IA is contextually bound
Input Output
5

6. RELATIONSHIPS, PROCESSES & POSITIONING MATTER
(1) Relationships matter: Metaphor “Swimming in the organisation“
(2) Processes matter: Internal Audit as an enabler of learning and
change
(3) Positioning and self-image matter: Farmer as suggested new
metaphor
6

7. Having lunch on your own  Swim in the Organization
7
Three types of auditors:
from behind-the-scenes player to key actor in the governance arena

8. MICRO FACTORS MATTER MOST
WHEN DETERMINING IA EFFECTIVENESS
Lenz,R.andHahn,U.(2015),Asynthesisofempiricalinternalauditeffectivenessliteraturepointingtonewresearchopportunities,
ManagerialAuditingJournal,Vol.30No.1,5-33,http://www.emeraldinsight.com/toc/maj/30/1
8
IA relationships

9. LITMUS TEST ASSESSING IA EFFECTIVENESS (PART 1 OF 2)
What would Senior Management say about you (CAE)
and your team?
What would the Board of Directors say about you (CAE)
and your team?
9

10. LITMUS TEST ASSESSING IA EFFECTIVENESS (PART 2 OF 2)
(+) Interpersonal factors
Shared goals
Shared knowledge
Mutual respect
(-) Interpersonal factors
Functional goals
Exclusive knowledge
Disrespect
(+) Communication
Frequent
Timely
Problem-solving
(-) Communication
Infrequent
Delayed
Finger-pointing
Lenz,R.(2013),Insightsintotheeffectivenessofinternalaudit:amulti-methodandmulti-perspectivestudy,
UniversitécatholiquedeLouvain-LouvainSchoolofManagementResearchInstitute,
DoctoralThesis01|2013,https://bit.ly/2r0WObY
10

11. PROCESSES MATTER
(1) Relationships matter: Metaphor “Swimming in the organisation“
(2) Internal Audit as an enabler of learning and change
(3) Positioning and self-image matter: Farmer as suggested new
metaphor
11

12. FOUR BARRIERS TO LEARNING & CHANGE
12

13. A GLIMPSE INTO MY INTERNAL AUDIT PRACTICE:
13
What a difference a year makes!
Audit cycle & positioning
Key processes: “IA is risk-based or useless!“
Audit work, from kick-off to reporting
Rating of issues and grading the overall report
Corporate Audit Satisfaction Survey
“Nothing‘s good unless you do it“

14. WHAT A DIFFERENCE A YEAR MAKES!
Lenz,R.(2015),InternalAuditorsaschangeagents:whatadifferenceayearmakes!TheOpenAuditor,Edition3,September
http://www.kppsearch.com/news/the-open-auditor-edition-3/
Positioning and processes impact relevance and productivity of IAF
14

15. KEY PROCESSES: “IA IS RISK-BASED OR USELESS!“
ImproveMonitoringAudit workAudit PlanRisk Assessment
• Draft for
review and
approval by
the Board
• Flexible
• Room for ad-
hoc requests
• Quantitative +
Qualitative
• Questionnaire
based
• Input Mgm.
• Input Board
• Prior years IA
• Critical sites
• Change
• EBITDA/Assets
• Other
• Regular follow-
up
• Mgm reporting
• Board
reporting
• Engagement
letter (scope,
schedule)
• Opening
meeting
• Closing
meeting
• IA reports out
promptly
• Findings rated
• Report graded
• CIA/QIAL
• IA staff having
/ pursuing IA
qualification
• Networking
within IIA &
among
academics
• Training and
continuous
learning
15

16. AUDIT WORK, FROM KICK-OFF TO REPORTING
IA report
Closing
(Standard)
Opening
(Standard)
Checklist
Engagement
letter (kick-off
memo)
• Use as
applicable
• Consider self-
assessment
controls
certification
checklists
• Typically sent
min. 4 weeks
prior to IA
• Mgm. is
contacted
seeking to
obtain input /
pointers for
particular
areas to be
investigated
• Friday
• Issues 100%
agreed as the
rule, incl.
remediating
actions,
owners and
timelines
• Some reports
may last 2-3
months à 3
• Travel on
Sunday (often)
• Start Monday
morning early
• Meet local
Mgm team to
frame the
audit program
• Individual
findings rated
A-D (E)
• Overall report
graded
S(atisfactory),
M(arginally
Deficient) or
D(eficient)
• < 2 weeks
reports get out
Standard protocol
c. 4 weeks + 1 week fieldwork  Final report, signed
16

17. RATING OF ISSUES AND GRADING THE AUDIT REPORT
Audit Report (Type 1: Assurance, Type 2: Advisory)
Audit Engagement and Scope
Executive Summary
Overall Grading
Details of Audit Findings and Observations
 Risk / ID #
 Audit Finding / Observations
 Risk / Impact
 Action / Recommendation
 Responsible
 Due Date
Signatures
17

18. CORPORATE AUDIT SERVICES SATISFACTION SURVEY
Strongly
Agree Agree
Neither
Agree nor
Disagree Disagree
Strongly
Disagree
No Basis to
Respond
1 2 3 4 5 6
1. I was pleased with Audit Services:
a. Knowledge 34 28 1 1 1,5
b. Professionalism 51 11 2 1,2
c. Communication 42 19 3 1,4
2. Audit Services respected my existing workload: 38 22 3 1 1,5
3. The objectives, purpose, and scope were
clearly communicated to me: 42 18 4 1,4
4. Communication of results and status was
timely and adequate: 45 18 1 1,3
5. My business concerns and perspective were
adequately considered: 34 27 3 1,5
6. The action items made business sense: 31 31 1 1 1,624
7. Overall, this audit provided value to me: 37 24 3 1,5
8. I consider Villeroy & Boch Audit Services to be a
valuable business partner: 43 20 1 1,3
Templateoriginatesfrom:Pforsichetal.(2006),Establishinganeffectiveinternalauditdepartment,
StrategicFinance,Vol.87No.10,pp.22-29
18

19. “NOTHING‘S GOOD UNLESS YOU DO IT“
Board reporting
January 2018
2017:
10 overdue issues;
3% of total A&B issues
19

20. POSITIONING MATTERS
(1) Relationships matter: Metaphor “Swimming in the organisation“
(2) Processes matter: Internal Audit as an enabler of learning and
change
(3) Positioning and self-image matter: Farmer as suggested new
metaphor
20

21. FARMER AS SUGGESTED NEW METAPHOR
FOR AUDITORS
21
Source:Sarens,G.,Lenz,R.&Decaux,L.(2016),
InsightsIntoSelf-ImagesofInternalAuditors,EDPACS,54:4,1-18

22. MY THREE KEY MESSAGES:
SWIMMING IN THE ORGANISATION
INTERNAL AUDIT AS AN ENABLER OF
LEARNING AND CHANGE
FARMER
22