The document discusses challenges faced by internal audit teams in a multinational context, particularly at Nasdaq, including regulatory complexity, cultural differences, and language barriers. It emphasizes the need for collaboration and understanding among global teams to effectively address these challenges, utilizing tools like data analytics. Key takeaways include forming diverse project teams, participating in each other's cultures, and developing consistent audit practices across jurisdictions.

1. 5/21/2019
1
Challenges of Auditing
in a Multinational
Corporation
Lenny Block
VP Internal Audit
Nasdaq Inc.
About Jim Kaplan, CIA, CFE
 President and Founder of AuditNet®,
the global resource for auditors
(available on iOS, Android and
Windows devices)
 Auditor, Web Site Guru,
 Internet for Auditors Pioneer
 IIA Bradford Cadmus Memorial Award
Recipient
 Local Government Auditor’s Lifetime
Award
 Author of “The Auditor’s Guide to
Internet Resources” 2nd Edition
Page 2
1
2

2. 5/21/2019
2
ABOUT AUDITNET® LLC
• AuditNet®, the global resource for auditors, serves the global audit
community as the primary resource for Web-based auditing content. As the first online
audit portal, AuditNet® has been at the forefront of websites dedicated to promoting the
use of audit technology.
• Available on the Web, iPad, iPhone, Windows and Android devices and
features:
• Over 3,000 Reusable Templates, Audit Programs, Questionnaires, and
Control Matrices
• Webinars focusing on fraud, data analytics, IT audit, and internal audit
with free CPE for subscribers and site license users.
• Audit guides, manuals, and books on audit basics and using audit
technology
• LinkedIn Networking Groups
• Monthly Newsletters with Expert Guest Columnists
• Surveys on timely topics for internal auditors
Introductions
Page 3
HOUSEKEEPING
This webinar and its material are the property of AuditNet® and its Webinar partners.
Unauthorized usage or recording of this webinar or any of its material is strictly forbidden.
• If you logged in with another individual’s confirmation email you will not receive CPE as
the confirmation login is linked to a specific individual
• This Webinar is not eligible for viewing in a group setting. You must be logged in with
your unique join link.
• We are recording the webinar and you will be provided access to that recording after the
webinar. Downloading or otherwise duplicating the webinar recording is expressly
prohibited.
• You must attend the entire Webinar to receive CPE (no partial CPE will be awarded).
• If you meet the criteria for earning CPE you will receive a link via email to download your
certificate. The official email for CPE will be issued via NoReply@gensend.io and it is
important to white list this address. It is from this email that your CPE credit will be sent.
There is a processing fee to have your CPE credit regenerated post event.
• Submit questions via the chat box on your screen and we will answer them either during
or at the conclusion.
• You must answer the survey questions after the Webinar or before downloading your
certificate.
3
4

3. 5/21/2019
3
IMPORTANT INFORMATION
REGARDING CPE!
• WEBINAR ATTENDEES - If you attend the entire Webinar, and meet the eligibility criteria,
you will receive an email with the link to download your CPE certificate. The official email for
CPE will be issued via NoReply@gensend.io and it is important to white list this address. It is
from this email that your CPE credit will be sent. There is a processing fee to have your CPE
credit regenerated post event.
• We cannot manually generate a CPE certificate as these are handled by our 3rd party
provider. We highly recommend that you work with your IT department to identify and correct
any email delivery issues prior to attending the Webinar. Issues would include blocks or spam
filters in your email system or a firewall that will redirect or not allow delivery of this email from
Gensend.io
• We are not responsible for any connection, audio or other computer related issues. You must
have pop-ups enabled on you computer otherwise you will not be able to answer the polling
questions which occur approximately every 20 minutes. We suggest that if you have any
pressing issues to see to that you do so immediately after a polling question.
The views expressed by the presenters do not necessarily represent the views,
positions, or opinions of AuditNet® LLC. These materials, and the oral presentation
accompanying them, are for educational purposes only and do not constitute
accounting or legal advice or create an accountant-client relationship.
While AuditNet® makes every effort to ensure information is accurate and complete,
AuditNet® makes no representations, guarantees, or warranties as to the accuracy or
completeness of the information provided via this presentation. AuditNet® specifically
disclaims all liability for any claims or damages that may result from the information
contained in this presentation, including any websites maintained by third parties and
linked to the AuditNet® website.
Any mention of commercial products is for information only; it does not imply
recommendation or endorsement by AuditNet® LLC
5
6

4. 5/21/2019
4
Presenter
Lenny Block
VP Internal Audit,
Nasdaq
A Little About Me
• VP of Internal Audit, responsible for the U.S. Business Audit Team
• My team performs internal audits to help ensure regulatory
compliance, operational effectiveness and financial reporting
integrity for Nasdaq entities
• Responsible for Internal Audit’s Data Analytics (CaseWare IDEA)
and Continuous Monitoring
• Prior to Nasdaq: Senior level positions with technology consulting
organizations providing program leadership, system analysis and
business process expertise
7
8

5. 5/21/2019
5
A Little About Me
• CPA, CIA, Bachelor of Accounting, Masters of Information Systems
Technology
• Adjunct Faculty – Southern New Hampshire University
• Ocean Isle Beach, NC via Washington, DC
• Husband, father and avid sports fan (Ice Hockey, Golf, Tennis,
Pickleball)
Nasdaq: More Than a Stock Exchange
• Multiple exchanges and clearing houses, domestic and international
o Nasdaq, Boston, Philadelphia, Stockholm, Helsinki, Copenhagen, Iceland
• Listing venue for publicly traded companies
o Multiple asset classes (equities, options, commodities)
• Global Information Services
o Global Data Products
o Index Products
• Market Technology
o Trading and Data Solutions to Exchanges, alternative-trading venues, banks
and securities brokers
9
10

6. 5/21/2019
6
Nasdaq: Internal Audit
• 22 Auditors - New York, Maryland, Philadelphia, Stockholm, Vilnius
• Through acquisitions and relocations, Nasdaq is a
multinational group
Are We Tolerant of
Other Cultures ?
11
12

7. 5/21/2019
7
Does This Happen at Your Organization?
Does This Happen at Your Organization?
• Are we true partners
with our audit
co-workers in different
cultures?
13
14

8. 5/21/2019
8
Have We TRULY LISTENED
to the Challenges our
Co-Workers Face Within Their
Country?
Internal Audit Teams Outside the U.S.
Challenges Audit Teams Outside the U.S. Face:
• Report results to multiple regulators
• Process data in and from multiple countries
• Nasdaq has regulators – the SEC, CFTC, DOJ, etc.
• What regulations do non-U.S. Internal Auditors face?
15
16

9. 5/21/2019
9
Internal Audit Teams Outside the U.S.
Regulations Non-U.S. Internal Audit Teams Face:
• Compliance Plans and Reports submitted to the Nordic and Baltic
Regulators
• Compliance Plans and Compliance Reports submitted to the Nordic
Boards
• Report to Estonian FSA on a special review
• Finnish FSA approval process of new regulations
• Report received by the Danish FSA on their current reviews
• Norwegian FSA reviews
• Latvian FSA reviews
Internal Audit Teams Outside the U.S.
Regulations Non-U.S. Internal Audit Teams also Face:
• MiFID II – Regulatory reporting Compliance
• Member On-boarding (Nordic and Baltic regulators)
• Regulatory requirements for on-boarding and recurring reviews
against EU and local legislation
17
18

10. 5/21/2019
10
External Challenges and Events
• Regulatory Uncertainty and Heightened Scrutiny – Creates risk
• Sanctions – Compliance has become more complex because
- Sanctions have been increasingly used to advance national interests
- Sanctions programs are more complex
- Greater conflicts between US and European sanctions programs
• U.S. Foreign Corrupt Practices Act/UK Bribery Act – Anti-corruption
compliance is a top white-collar law enforcement priority
• Cyber Security – A top priority for regulators and the source of new
compliance requirements
• Data Privacy – Compliance to European General Data Protection
External Challenges and Events
• MiFID II – Regulation that increases transparency across EU financial
markets and standardizes the regulatory disclosures for particular
markets
• Brexit – Continued uncertainty creates risk
• Members relocating from the UK to EU27 countries
• Employees and tax law changes
• Contracts rely on UK law or involve processing personal data in the UK
• Cloud Computing – Increased regulator scrutiny and related
requirements
• Nordic Governance Structure and Alignment – Keep current for
regulated entities
19
20

11. 5/21/2019
11
Internal Challenges Within the Organization
• Regulatory rule books widely vary among countries
• Foreign Currency Translation
• IFRS vs. GAAP
• Different external audit teams in multiple countries (i.e. SOX)
• Holidays and vacations
• Local regulatory restrictions on bank accounts
• Legal entities and intercompany transactions
• Welcome to Sweden…
Internal Challenges Within Internal Audit
• Language
• Verbal and written
• Cultural tendencies
• Challenging a superior is not common practice
• Audit skepticism is important
• Holidays and vacations (Again !!)
• Scheduling meetings / Time differences
• Work life balance
• Competition for talent
21
22

12. 5/21/2019
12
Internal Challenges Within the Organization
• Think about what we have to
overcome
What are You Doing to Address Challenges?
• Why hockey?
• More on that later…
23
24

13. 5/21/2019
13
Are We Tolerant of
Other Cultures ?
Nasdaq Areas of Focus…
• Evidence is available to satisfy regulators
• Multi-Country Board Reporting
• Delivering a consistent audit message across the organization
• Developing a universal language – Everyone understands
25
26

14. 5/21/2019
14
Evidence is Available to Satisfy Regulators
• Each regulator wants to see coverage for their country
o Can create administrative nightmares dealing with varied combinations
Meeting the Challenge:
• Sampling Considerations
o Thresholds vs. Risk Levels; Patterns vs Transactions
• One scope, multiple reports
o Ratings by Legal Entity – Regulators want to see ratings for their countries
o Issues and by Legal Entity
Multi-Country Board Reporting
Regulated Legal entities have their board packages
• U.S. and non-U.S. board reporting want different things
o For example: We don’t include some financial audits for U.S. regulators
but European regulators often want them
• Hard to keep current with an audit plan that is dynamic
27
28

15. 5/21/2019
15
Multi-Country Board Reporting
Meeting the Challenge:
• Start with Risk Assessment and the Yearly Audit Plan
• Legal Entity Tagging
• Cannot compile board packages effectively, if you try to do on the fly!
• Templates are the necessity
• Legal Entities and the associated “CC” list for scope memos and reports
• Quality Control of Audit reports, Scope memo and Board Packages
• Do not underestimate the time and resources this takes
Multi-Country Board Reporting
Sounds simple, but can become quite complicated
Business EVP SVP VP Head of Business BU CFO LE LE CEO
Area 1 EVP1
SVP1 BUCFO1
SVP2
SVP3
VP 1 Nasdaq Nordic Ltd LE CEO1
Nasdaq Stockholm AB LE CEO2
Nasdaq Helsinki Ltd. LE CEO3
Nasdaq Copenhagen AS LE CEO4
VP2 Nasdaq Clearing AB LE CEO5
VP3
Nasdaq Oslo ASA LE CEO6
VP4 SE Nasdaq Vilnius LE CEO7
Vilnius Services UAB (NAVS) LE CEO8
Nasdaq Riga AS LE CEO9
Nasdaq Tallinn AS LE CEO10
SE NCSD LE CEO11
Nasdaq Iceland hf LE CEO12
Nasdaq Iceland CSD hf LE CEO13
VP5 Nasdaq Broker Services AB LE CEO14
29
30

16. 5/21/2019
16
Delivering a Consistent Audit Message
English is a Second Language (or third or fourth) to Many
• The skills international team mates have may be taken for granted
• Internal Audit deliverables are in English
• Report Writing – Difficult to prepare consistent reports because
writing styles differ so much
Delivering a Consistent Audit Message
Meeting the Challenge:
• Joint Risk Assessments – Teams don’t sit in on only auditees from their
countries
• Form international teams for the projects
• Staff Meetings (Weekly and Monthly)
• Yearly Off-Site Meeting
• Standards and Templates
• Training conducted by same instructor for U.S. and Non-U.S. auditors
o Everyone hears the same message
31
32

17. 5/21/2019
17
Delivering a Consistent Audit Message
• Partake in the each audit teams’
culture (Glogg and Bun Day)
• Have auditors work in other
countries
o Build relationships with their
teammates
o Better understand the
cultural differences between
the other country’s auditees
Developing a Universal Language
Everyone Understands
33
34

18. 5/21/2019
18
The Game
TJ Oshie - US Alex Ovechkin - Russia Nick Backstrom - Sweden
Delivering a Consistent Audit Message
Communication Through Data
• A successful audit is tied to
understanding the business
Case Study: Cash Collateral Payment
Processing
• Collaborated with Sweden
• Colleague understood the business
• I had some understanding of the business,
but extensive knowledge of data analytics
• TOGETHER, with IDEA as our common tool,
we became better while achieving audit objectives
35
36

19. 5/21/2019
19
Internal Audit - Data Analytics – Universal Language
Win – Win
• Now I understand the business
• My colleague reinforced and strengthened her knowledge of
data analytics as a powerful audit tool
• Data analytics is a great vehicle for multinational audit teams
Other Multi-Country Efforts Using Data Analytics
• Fraud Assessments
• Collections
• Payroll
• Teams included auditors from Sweden, U.S. and Lithuania
37
38

20. 5/21/2019
20
Let’s Put This Into Action
Key Takeaways:
• Team up auditors from different international locations
o Find a project you can execute together using data analytics
• Partake in the other audit teams’ culture
• Joint Risk Meetings – teams should not sit on only auditees from
their countries
• Sampling Considerations:
o Thresholds versus Risk Levels
o Patterns versus transactions
o Remember regulators care about their countries
• Templates Board Reporting packages (They will make your life easier)
39
40

21. 5/21/2019
21
Multinational Internal Audit Teams Must Remember
• Be tolerant
• Understand challenges Internal Audit teams face outside the U.S.
o Remember all those regulators they have to deal with?
• Your way of performing audits is not the ONLY way
Multinational Internal Audit Teams Must Remember
We need each other and work better together!
41
42

22. 5/21/2019
22
Thank you!
Questions?
Contact Us:
connect@caseware.com
www.idea.caseware.com
43