26
The contents of this presentation are confidential. Copyright © 2019 Workiva. How to Use Technology to Revamp the 5 Phases of Internal Audit
The contents of this presentation are confidential. Copyright © 2019 Workiva.
How to Use Technology to Revamp the 5 Phases of Internal Audit
Questions
Qualifying for CPE
Agenda
• Introduction
• Learning objectives
• Internal audit definition
• Internal audit methodology
• Questions
Introductions — Today’s Presenters
Ernest AnunciacionDirector of Product Marketing
Dana WilliamsSenior Product Marketing Manager
Learning Objectives
• Establish a fundamental baseline definition of internal audit activity and overall methodology
• Identify key activities and where manually administrative parts of the process exists for automation
• Highlight common pain points in the process and improvement opportunities by leveraging technology
• Learn tactics for minimizing the amount of redundancies throughout the internal audit process
Definition of Internal Audit
According to the Institute of Internal Auditors (IIA):“Internal auditing is an independent, objective assurance and
consulting activity designed to add value and improve an organization's operations. It helps an organization accomplish its
objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and
governance processes.”
GOAL: To become trusted business advisors
CPE Question #1
Which of the following best describes your role in Internal Audit?
A. Staff/Lead Auditor
B. Audit Manager/Director
C. Vice President/Chief Audit Executive
D. Other
Internal Audit Methodology
Data requestsand collection
Planning andscoping
Fieldworkand testing
Conclusionand reporting
Follow-upand monitoring
Internal Audit Methodology — Objectives by Phase
Data requestsand collection
Assess risks. Develop, confirm and document the audit plan and engagement scope, approach and objectives.
Data requestsand collection
Planning andscoping
Fieldworkand testing
Conclusionand reporting
Follow-upand monitoring
Internal Audit Methodology — Objectives by Phase
Planning andscoping
Fieldworkand testing
Conclusionand reporting
Follow-upand monitoring
Data requestsand collection
Assess risks. Develop, confirm and document the audit plan and engagement scope, approach and objectives.
Create data request lists, request evidence, document "as-is" processes, validate controls, and draft test plans or audit programs.
Data requestsand collection
Planning andscoping
Fieldworkand testing
Conclusionand reporting
Follow-upand monitoring
Internal Audit Methodology — Objectives by PhaseAssess risks. Develop, confirm and document the audit plan and engagement scope, approach and objectives.
Create data request lists, request evidence, document "as-is" processes, validate controls, and draft test plans or audit programs.
Assess design and effectiveness of process and controls. Validate observations with business owners.
Planning andscoping
Fieldworkand testing
Data requestsand collection
Data requestsand collection
Planning andscoping
Fieldworkand testing
Conclusionand reporting
Follow-upand monitoring
Internal Audit Methodology — Objectives by PhaseAssess risks. Develop, confirm and document the audit plan and engagement scope, approach and objectives.
Assess design and effectiveness of process and controls. Validate observations with business owners.
Create data request lists, request evidence, document "as-is" processes, validate controls, and draft test plans or audit programs.
Develop and prioritize recommendations. Report audit
results and recommendations.
Data requestsand collection
Planning andscoping
Fieldworkand testing
Conclusionand reporting
Follow-upand monitoring
Internal Audit Methodology — Objectives by PhaseAssess risks. Develop, confirm and document the audit plan and engagement scope, approach and objectives.
Assess design and effectiveness of process and controls. Validate observations with business owners.
Create data request lists, request evidence, document "as-is" processes, validate controls, and draft test plans or audit programs.
Develop and prioritize recommendations. Report audit
results and recommendations.
Review prior audit findings and track management's progress
against agreed-upon remediation plans. Monitor and reassess risks.
Data requestsand collection
Planning andscoping
Fieldworkand testing
Conclusionand reporting
Follow-upand monitoring
CPE Question #2
On average, how many audits do you perform on an annual basis?
A. 1–10
B. 11–30
C. 31–50
D. 51–100
E. 100+
Planning and ScopingKey activities
• Research, research, research, and more research• Interview stakeholders• Perform risk assessment• Establish audit plan• Develop project plan:
• Schedule • Timelines • Resource allocation• Budgets
• Draft engagement memos• Conduct kickoff meetings
Pain points
• Lack of resources•Time consuming
meetings, emails, and interviews•Documenting risk
assessment•Aggregating results• Lack of collaboration•Version/change control•Data inconsistency
Opportunities
•Risk library•Control library• Survey tools•Certification tools•Project management•Collaboration tools via
the cloud
Data Requests and CollectionKey activities
• Conduct detailed interviews with risk and control owners• Develop "as-is" process
documentation • Design audit program
guide and test plans • Develop and submit
documentation requests• Sign off on audit program
guide and test plans
Pain points
•Time consuming emails, waiting for data, and approval process•Wrong data or
documents•Creating from scratch:
•Program guides •Testing plans•Other workpapers
Opportunities
• Linking workpapers•Narratives• Flow charts•Risk & control
matrix•Audit templates•PBC requests•Automated workflow
•Notifications• Status dashboards
Fieldwork and TestingKey activities
• Execute audit based on program guide• Complete testing plans:
• Test of design• Test of operating
effectiveness• Identify, validate and risk
rate observations• Root cause analysis• Conduct status meetings
with stakeholders• Draft final audit report
Pain points
• Lack of status visibility• Lack of collaboration:
•Review/coaching•Population & samples•Manual markups•Rigid data structures• Iterating observations:
• Internal audit management•Audit clients
•Documenting issues
Opportunities
•PBC requests tied to testing forms• Sample size calculators•Evidence markup•Electronic annotations•Workflow•Tailored testing forms•Repeatable templates• Issues management
systems
CPE Question #3
How many people are on your internal audit team?
A. 10 or less
B. 11–20
C. 21–50
D. 50+
Conclusion and ReportingKey activities
• Gather management responses to audit issues• Finalize audit report• Conduct closing meeting
with audit stakeholders• Issue final audit report• Close audit file • Gather client feedback•Quality Assurance Review
(QAR)
Pain points
•Version/change control• Lack of collaboration•Ensuring data accuracy
and consistency• Finalizing workpapers• Lack of visibility•Reconciling to IIA
standards
Opportunities
•Audit lockdown•Automated reporting•Automated
notifications• Import/export
workpapers• Survey tools
Follow-Up and MonitoringKey activities
•Monitor issue status• Follow up on open audit
findings• Re-perform audit• Communicate status with
key stakeholders• Draft and finalize audit
committee reports• Update risk assessments
Pain points
• Lack of visibility• Lack of workflow• Lack of collaboration•Time-consuming
Opportunities
• Issues management system•Aging reports•Automated
notifications•Workflow
CPE Question #4
What primary technology solution is used to support your methodology?
A. Desktop applications (e.g., Microsoft Office®, Google DocsTM)
A. Audit-specific software (e.g., TeamMate, AuditBoard, MKInsight)
B. Data analytics software (e.g., ACL, IDEA, Tableau®)
C. GRC applications (e.g., Archer®, Bwise, MetricStreamTM)
Microsoft Office is a registered trademark of Microsoft Corporation in the United States and/or other countries. Google Docs is a trademark of Google Inc. Archer is a registered trademark of EMC Corporation in the United States and other countries. MetricStreamEnterprise Governance Risk Compliance Platform is a trademark of MetricStream.
Conclusion
People Process Technology
The contents of this presentation are confidential. Copyright © 2019 Workiva.
Thank [email protected]
