This document summarizes the key discussion points from a Group Internal Audit Workshop on the future of internal audit. It discusses: 1. The history of internal audit, from ancient times focusing on governance and ethics, to the modern era where it evolved from an inspection to a more risk-based and compliance focused function. 2. The changing context which drove these evolutions, such as increasing organizational complexity, scandals, and regulations like Sarbanes-Oxley. 3. How internal audit continues to evolve, from a control focus to a more risk-based and performance-centric approach, in order to keep up with stakeholder demands and the speed of business. 4. The future of

1. GROUP INTERNAL AUDIT WORKSHOP
Sep. 6, 2012

2. Future of Internal Audit
Debashis Gupta
Sep. 6, 2012

3. Discussion points
1. Relevance of internal audit
2. A bit of history
3. Context for changing face of internal audit
4. Evolution
5. What does the future hold?

4. Discussion points
1. Relevance of internal audit
2. A bit of history
3. Context for changing face of internal audit
4. Evolution
5. What does the future hold?

5. Is Internal audit relevant?
Some perspectives:
1. In organizations of a certain size and governance
environment, basic controls are ‘built into DNA’.
2. In many organizations outside this circle, IA may
not get ‘wind beneath sails’ (or ‘seat at table’).
3. Managements today have a range of options to
obtain value added ‘consulting’ part of IA role.
4. Even on core role, Internal Audit hardly cited as
‘potentially culpable’ in investigations into
corporate frauds/scandals over the decade…
Thoughts??

6. Discussion points
1. Relevance of internal audit
2. A bit of history
3. Context for changing face of internal audit
4. Evolution
5. What does the future hold?

7. History of Internal audit
Ancient (India):
 Chanakya (aka Kautilya) touched upon the
concept of auditing in ‘Arthaniti’ (370 BC)!
 Birbal reportedly provided Akbar with an
‘independent view’ and facts/evidence on many
complex issues, incl. on governance (1528 AD) !!
Upto 1940 or so (‘Inspection’ mode):
 Substantive, focus on recount/re-performance
 Assist external auditor with tests/tasks

8. History of Internal audit…
1940s to 1980s (‘compliance’ mode):
 Institute of Internal Auditors (IIA) estd. (1941)
 ‘Modern Internal Auditing’ – Victor Brink (1942)
 Focus on compliance with policies & controls
 Tentative start with operational auditing
1990s (‘control focused’ mode):
 COSO ‘Internal Control–Integrated F/work’ (92)*
 Focus on controls & control environment
 Start of integration of risk into internal audit
* Currently under revision

9. History of Internal audit…
Late 1990s - 2002 (‘risk based auditing’):
 Increasing integration of risk into audits
 COSO ‘Ent. Risk Mgt. – Integrated Framework’*
2003 - …2006 (the ‘SOX years’):
 Sarbanes-Oxley Act (2004)
 Focus on internal controls on fin. rptg. (ICFR)
…2007 – 2008 (return to risk?):
 Focus on entity and process-level controls
 Integration of risk mitigation/risk treatments
* A bit late in the day (2004), post SOX…

10. History of Internal audit…
2009 - … :
 Return of focus on basic controls (financial
services/other industries)
 Any clear roadmap??
Thoughts…

11. Discussion points
1. Relevance of internal audit
2. A bit of history
3. Context for changing face of internal audit
4. Evolution
5. What does the future hold?

12. Context of Internal audit
Ancient:
 Mostly individual businesses
 Governance, ethics,…
Upto 1940 or so (‘Inspection’ mode IA):
 Simple structure of organizations
 Few big-time frauds (like Charles Ponzi – 1919)
1940s to 1980s (‘compliance’ mode IA):
 Bigger/more complex/far-flung organizations
 Need to ensure (uniform) controls

13. Context of Internal audit…
1990s (‘control focused’ IA):
 Junk bonds fraud by Mike Milken (1989)
 BCCI scandal (1991)
 US political campaign finance reforms & FCPA
 Treadway Commission (sponsored by AICPA,
AAA, FEI, IIA & IMA) (succeeded by COSO)
2000 - 2002 (‘risk based auditing’):
 Companies/IA ‘got a handle’ on controls?
 Appreciation of the link between controls & risk

14. Context of Internal audit…
2003 - …2006 (the ‘SOX years’):
 Dotcom bubble burst (2001)
 Plethora of accounting/financial reporting
frauds – LTCM, Enron, WorldCom, Parmalat,
HealthSouth,…
…2007 – 2008 (return to risk based IA):
 Few big-time frauds?
 ‘SOX fever’ wearing off/ possible fatigue/
resentment on SOX focus??

15. Context of Internal audit…
2009 - … :
 Subprime meltdown – Lehman, Bear Stearns,
Countrywide, Merrill, AIG, WaMu, Wachovia,
RBS, HBOS, Northern Rock,…
 Financial reporting frauds - Satyam, Olympus,...
 ‘Market-linked’ – UBS (Adoboli*), LIBOR,…
 Good ol’ money frauds/Ponzi schemes –
Madoff, MF Global, PFG, ZeekRewards,…
 Regulatory tangles – HSBC, StanChart, GS,…
 Will it ever end? (hint: No!)
* In the footsteps of Nick Leeson who brought down Barings in 1995

16. Context of Internal audit…
Learning:
 Internal audit is perceived to be more reactive
(to business/economic environment) than
proactive, and that too at a slow pace.
 Is lack of mandate or management/regulatory
support the issue, or competency gap?
Thoughts…

17. Discussion points
1. Relevance of internal audit
2. A bit of history
3. Context for changing face of internal audit
4. Evolution
5. What does the future hold?

18. Evolution of Internal audit
 Compliance-focus to Control-focus
 Control-focus to Risk based audit (RBA)
 RBA to objective-centric (risk cumulative),
enterprise-wide focus
 Risk/objective-based to Performance-centric
 Ideal path – along the maturity scale as per IIA:
Internal auditing is an independent, objective assurance and consulting
activity designed to add value and improve an organisation’s operations. It
helps an organisation accomplish its objectives by bringing a systematic,
disciplined approach to evaluate and improve the effectiveness of risk
management, control, and governance processes.
The Institute of Internal Auditors

19. Evolution of Internal audit…
Stakeholder demands:
 Value protection/value destruction prevention
(only 20% of value destruction in business is due to financial
& compliance issues, 20% due to operational issues, and a
full 60% is due to strategic/business issues*)
 *^Review of JV, M&A & Business continuity
 *Integrated assurance & ‘consumable’ reports
 Independence, insight & objectivity*
 Facilitate process strengthening e.g. CSA, CCM
* PwC study’12 ^ KPMG survey’12

20. Discussion points
1. Relevance of internal audit
2. A bit of history
3. Context for changing face of internal audit
4. Evolution
5. What does the future hold?

21. Future of Internal audit
 Audit ‘at the speed of business’ – CA/CRCA
 Program management*^, change management#
 Economic realities*, trends*, sustainability^
 ^IT*, cloud, mobile devices, social media
 Increasing governance focus – assurance scale
 *Workflow automation and IT, analytical tools &
skills, to enhance coverage & quality standards
 Diversified resource base – a judicious mixture
of in house & co-sourced/specialist auditors*
* PwC study’12 ^ KPMG survey’12 # IIA survey’12

22. QUESTIONS…

23. Thank You