The document discusses the evolving role of internal auditing functions. It covers positioning internal audit in an organization through strategic partnerships with business and benchmarking the internal audit function. It also discusses risk-based audit approaches and governance processes, focusing on the roles of various stakeholders. The document advocates for internal audit to act as a strategic partner by providing quality assurance on critical risks. It outlines how internal auditing has shifted from traditional transaction-based approaches to more modern risk-based approaches.

1. Debashis Gupta
Evolving Role of Internal
Auditing function
Debashis Gupta
Senior Vice President - Internal Audit
Max Healthcare

2. Positioning of Internal Audit in an organization
Strategic partnership with business
Benchmarking the internal audit function
Risk-based audit approach
Governance Processes - Roles of stakeholders
Content
Governance Processes - Roles of stakeholders

3. Positioning of Internal Audit in an organization
Strategic partnership with business
Benchmarking the internal audit function
Risk-based audit approach
Governance Processes - Roles of stakeholders
Content
Governance Processes - Roles of stakeholders

4. Where is the internal auditor?
Source: IIA Global Pulse Report
2013
‘The internal audit function should be positioned so that the board (of directors)
has confidence that the internal audit function will perform its duties with
impartiality and not be unduly influenced by managers of day-to-day operations’.
- The Interagency Policy Statement on the Internal Audit Function and its Outsourcing
(issued jointly by the Federal Reserve, FDIC, OCC, and OTS)
4

5. IA positioning in the organization
Some indicators/enablers:
• Time spent at the Board meetings and Calls received from the CEO/ Chairman
of the Audit Committee
• Participation in new business activities/ projects/ validation of business plans
• IA reports are action oriented, identify internal best practices and risk rated• IA reports are action oriented, identify internal best practices and risk rated
• Quality of talent that the IA function carries
For IA leaders to win the proverbial “seat at the table” with other C Level
executives, it is critical for them to be aware of the strategic landscape within
their respective industries and how their organization’s strategy is set and
executed within that environment. Internal Audit’s role should encompass an
assessment of the organization strategy setting and execution processes. For
e.g. how does the organization deal with the risks of an uncertain business
environment?
5

6. Positioning of Internal Audit in an organization
Strategic partnership with business
Benchmarking the internal audit function
Risk-based audit approach
Governance Processes - Roles of stakeholders
Content
Governance Processes - Roles of stakeholders

7. Role of Internal audit
Internal Audit should ideally act as a strategic partner to business, by
providing quality assurance on various critical risks that are crucial to
achieving organization goals. Does this happen (always)?
Some perspectives:
1. In organizations of a certain size and governance environment, basic
controls are ‘built into DNA’.
In many organizations outside this circle, IA may not get ‘wind beneath2. In many organizations outside this circle, IA may not get ‘wind beneath
sails’ (or ‘seat at table’).
3. Managements today have a range of options to obtain value added
‘consulting’ part of IA role.

8. Traditional Internal Auditing
.
•Initially the objective of internal audit was to prepare the organization for
external audits
.
•Auditors collect and analyze audit evidence and form opinions pertaining
to internal controls as well as reliability of the information provided by
management.
.
•Focused only on transactions and fault finding.
Policing role
.
•Silo approach to audit , with only process being focused rather than
having a wider management overview.
.
•Manual vouching with standard tick and tie method being used.
.
•High costs and significant time delays associated with information
collection, processing, and reporting.
Focus on
financial audit
Manual work
papers

9. Modern Internal Auditing
.
•Internal auditing has changed from being transaction based
to risk based.
.
•Ensure that Governance, risk management and compliance
is an integral part of enterprise risk methodology
.
•Smarter use of technology in fields of continuous control
monitoring , Audit management, Data analytics
Internal audit has changed
from a Traditional auditing
role, with a charter of
protecting enterprise value,
to that of an internalFocus on
Strategic
function
.
•Move towards continuous auditing and continuous
monitoring
.
•Makes internal audit a strategic unit of business
.
•Challenge the status quo for business performance
improvement
to that of an internal
consultant, with increasing
pressure for the
organization to
enhance shareholder value.
Focus on
overall
business
processes
Use of
technology

10. Evolution of Internal audit…
Stakeholder expectations:
• Value protection/value destruction prevention (only 20% of value
destruction in business is due to financial & compliance issues,
20% due to operational issues, and a full 60% is due to
strategic/business issues*)
• *^Review of JV, M&A, BCM, prog./change mgt.
• Integrated assurance*, GRC & investigate fraud
• ‘Consumable’ reports*,stakeholder management
• Independence, insight & objectivity*
• Facilitate process strengthening e.g. CCM, CSA
* PwC study ^ KPMG survey

11. Future of Internal audit
Deliverables (focus on USP…)
• Audit ‘at the speed of business’ – CA/CRCA
• Economic realities*, trends*, sustainability^
• IT* (incl. cloud, mobile devices, social media)^
• Governance focus – assurance maturity scale
• Efficiency, effectiveness, performance review
• Environment, health & safety (EHS),‘green’ audit
• Deal with generational change (stakeholders)
* PwC study ^ KPMG survey # IIA survey

12. Future of Internal audit…
Communication (the message…)
• ‘Consumable’ reports*
• ‘Risk treatment’ vs. simple ‘Recommendations’
• Emerging issues and ‘control themes’ to mgt.
• Respect Committee/Sr. Mgt. time constraints
• Responsiveness to ‘hot buttons’
• Partnership (with mgt.) & ownership (of issues)
• Build ‘circles of influence’ (e.g. focus groups)
* PwC study

13. Future of Internal audit…
Enablers (what will get us there…)
• IT and analytical tools & skills, workflow/process automation* –
enhance coverage & quality stds.
• Constant risk focus, objectivity
Right mix of internal & co-sourced/specialists*• Right mix of internal & co-sourced/specialists*
• Diversified resource base (+ domain & soft skills)
• Active team management (spl. focus – Gen. Y)
• Knowledge management, 360o, metrics, QAR
* PwC study

14. Cloud computing
Social Media
Cyber security
Emerging Technology related risks – A
snapshot
Mobile devices & BYOD ( Bring your own device )

15. Positioning of Internal Audit in an organization
Strategic partnership with business
Benchmarking the internal audit function
Risk-based audit approach
Governance Processes - Roles of stakeholders
Content
Governance Processes - Roles of stakeholders

16. Benchmarking the Internal Audit function
Context: characteristics of a modern Internal Audit function:
• Global perspective
• Business acumen
• Risk-based orientation
• Governance expertise
• Technologically adept (CAATS, Flowcharting, Risk Mapping Tools, ...)• Technologically adept (CAATS, Flowcharting, Risk Mapping Tools, ...)
• Creative thinking and problem solving
• Strong ethical compass
• Outstanding recruiter, manager and developer of talent
• Superb communicator (Written & Oral communication, Presentation)
• Relationship expert (Interpersonal skills)
• Unquestioned leadership ability
• Impactful presence
• Collaborative

17. Benchmarking Internal Audit
USING IIA GUIDELINES

18. Positioning of Internal Audit in an organization
Strategic partnership with business
Benchmarking the internal audit function
Risk-based audit approach
Governance Processes - Roles of stakeholders
Content
Governance Processes - Roles of stakeholders

19. Evolution of Internal audit
• Compliance-focus to Control-focus
• Control-focus to Risk based audit (RBA)
• RBA to objective-centric (risk cumulative), enterprise-wide focus
• Risk/objective-based to Performance-centric
• Ideal path – along the maturity scale as per IIA:
Internal auditing is an independent, objective assurance and
consulting activity designed to add value and improve an
organisation’s operations. It helps an organisation accomplish
its objectives by bringing a systematic, disciplined approach to
evaluate and improve the effectiveness of risk management,
control, and governance processes.
The Institute of Internal Auditors

20. Shifting Focus of Internal Audit
20th Century
Internal audit
model
Controls assurance
based on cyclical
Today’s typical
internal audit
model
Controls
assurance based
on
The risk-centric
internal audit
model of tomorrow
Assurance on the
effectiveness
of risk
management in
based on cyclical
or routine audit
plans
on
risk-based
internal audit
plan
management in
addition
to controls
assurance

21. Risk convergence today
Internal Audit Compliance Risk Management
Internal
Audits
Cost
New
regulation
Anti
New Product
development
Cost
efficiency
Anti
Fraud
Privacy
Business
• Lack of co-ordination
• Competition for attention
• Risks falling through cracks
• Duplication of efforts

22. • Using a standard framework
How this is being overcome by organizations
Internal Audit Compliance Risk Management
Objective setting Risk ID Control ID
Deficiency
managementmanagement
Business
• Creating structure across/within functions, businesses and regulatory
requirements
• Aligning with regulatory expectations
• Choose the right place to start: new and developing functions, union of
similar silos, areas ripe with duplication, integrated/related environments

23. Positioning of Internal Audit in an organization
Strategic partnership with business
Benchmarking the internal audit function
Risk-based audit approach
Governance Processes - Roles of stakeholders
Content
Governance Processes - Roles of stakeholders

24. Governance – Role of diverse stakeholders
The inter-relationship of Internal Audit with the Governance
processes touches the roles of a wide variety of stakeholders –
Board, Audit Committee, CEO, CFO and other members of top
management.management.

25. Governance – Role of diverse stakeholders

26. Governance
Role of Internal Audit in Corporate Governance
(IIA-RMIT Univ. study)
• Establish & maintain direct reporting by CAE to board or AC.
• Facilitation process for CAEs to work with NEDs & audit committee
• Internal audit should have a clear set of published audit objectives
• Specific benchmarks & standards for governance processes
• Ongoing communication amongst CEO, AC, CFO and CAE

27. Governance
Audit of Corporate Governance needs to address:
• activities of the Board and its committees,
• timeliness and quality of information they receive;
• organization structure and staffing of the enterprise;
• process for establishing, communicating and cascading• process for establishing, communicating and cascading
organizational strategies throughout the organization

28. THANK YOU