“True” Value of Internal Audit a nd Development of “Capable” I nternal Auditor Keizo Tsuchiya President Japan Registration Organization for Corporate Social Responsibility
IRCA Forum 2013
ⓒ 2013 J CSR. All Rights Reserved.
2013/06/23
Significant Interest in Internal Audit Amount of Information Uploaded to the Internet
Importance of Internal Audit: 1,210,000 hits
Credibility of Internal Audit:
Value of Internal Audit: 1,500,000 hits
Effectiveness of Internal Audit:
1,260,000 hits 1,860,000 hits
Are they a large number or small number? Corporate Value ： 1,260,000 hits (the same as “Credibility of Internal Audit”)
Computer Virus (including virus) ： 889,000 hits, which is far less than the above ！ ！
Akashiya Sanma ： 1,850,000 hits
Search results of “Yahoo! JAPAN“ on May 5, 2013
ⓒ 2013 J CSR. All Rights Reserved.
Value of Internal Audit
â“’ 2013 J CSR. All Rights Reserved.
Value of Internal Audit
Cost vs. Effectiveness (Value)
Calculate internal audit costs
Annual cost of training to develop internal auditors or use of external personnel as internal auditor
Mandays of internal audit
Mandays for audit planning, Mandays for audit execution (auditors/auditees), Mandays for analysis/ wrap-up and reporting
Example ： An organization with 200 employees and 10 Departments to be audited 5 internal auditors (appointed from different Departments in the organization) 3 internal audit teams (including 1 observer) Pre-audit training: 1 day （ by an external tutor)
5 mandays + Tutor fee
Preparation for internal audit (Collection of information and preparation of internal audit plan): 1 day/team (6 mandays in total) ） Internal audit: 3 days
Mandays on the auditor side: ６ mandays Mandays on the auditee side: 6 mandays
Analysis/Wrap-up: 1 day/team (6 mandays in total) Reporting: 0.5 day/team (3 mandays in total) Total mandays + External tutor fee and all other expenses: 1.3 million yen
ⓒ 2013 J CSR. All Rights Reserved.
Value of Internal audit
Effectiveness (Value)
Level of usefulness of information acquired by internal audit
Level of usefulness for top management ・・ How well does internal audit report meet expectatio ns of top management?
Example:
Internal Audit Report
Nonconformity: Record of xxx training was not kept in Department Y.
Summary: 3 concerns and 8 opportunities for improvement
It was found that training records were not kept in some
Departments; e.g. Study session about accidents taking
place in competitors.
Interesting information
was delivered
Not interested
100 80 60 40 20 0 (%)
Value of internal audit for top management:
1.3 million yen x 30% ＝ 390,000 yen ⓒ 2013 J CSR. All Rights Reserved.
Value of Internal Audit
Value to provide top management with useful information
Matured
Acceptable
Audit results containing more Valuable information that top than 80 ％ of information that management can use as useful top management wanted Value: 1.04M ～ 1.3M yen Audit results containing 60%~80 ％ of information that top management wanted Value: 780,000 ～ 1.04M yen
information Less valuable information that top management can use just as reference
Limited quality of internal audit that may overlook risks of accidents and miss opportunities for improvement in operations Not Audit results containing less than 80% of information collected in Established 20% of information that top internal audit is extremely low Immature
Audit results containing 20%~60 ％ of information that top management wanted Value: 260,000 ～ 780,000 yen
management wanted Value: 0 ～ 260,000 yen
in value for the use of business ⓒ 2013 J CSR. All Rights Reserved. management.
Value of Internal Audit
Internal audit must contribute to achievement of objectives and targets of an organization.
Internal audit must appropriately report changes in risks relating to manag ement of an organization.
Internal audit must satisfy expectations of top management in correctly re porting current status of an organization.
Internal audit is not a means for certification, but an effective means to im plement a management system.
Internal audit is also an activity to demonstrate validity of autonomous ma nagement of an organization.
Valid in terms of customer (public) expectations, competitiveness and efficiency ⇒ Internal audit also provides useful information for communication with the third party.
Internal audit is a professional work, but anyone can conduct it if he/she is familiar with an organization. It is not difficult to create value. It is necess ary, however, to appoint those who are highly ethical and trusted.
⇒ Enhance quality of assessment ！ Enhance quality of analysis and evaluation ！ ⓒ 2013 J CSR. All Rights Reserved.
Development of Internal Auditor ~ A Means to Directly Enhance Value of Internal Audit ~
â“’ 2013 J CSR. All Rights Reserved.
How to Develop Internal Auditor?
The quickest way is to have a candidate internal auditor experience a good internal au dit.
But opportunities to practice internal audits are limited in number. ⇒ The limited opportunities must be effectively organized.
To organize a good internal audit → To put in place the four conditions: Condition 1 ： Top management’s support and commitment to the public, people and business Condition 2 ： Training of internal auditors Condition 3 ： Cooperation of Departments to be audited Condition 4 ： Establish PDCA of internal audit which facilitates development of internal auditors
Utilizing the limited opportunities of internal audit effectively, an organization, based on the above conditions, encourages a candidate internal auditor to experience a good and successful internal audit.
ⓒ 2013 J CSR. All Rights Reserved.
Conditions to Organize a Good Internal Audit Condition １： Top management’s support and com mitment to the public, people and business Organization in which internal audit makes a valuable contribution
Organization in which internal audit does not make a valuable contribution
Top management recognizes benefits of internal audit and actively supports internal audit.
Top management is not interested in internal audit.
Top management commits to
Top management does not address problems.
address all the problems.
Top management does not distort Top management disguises facts the truth. Good internal auditors are developed as internal audit is respected as precious information source. Internal audit will become effective in providing information that top
Top management approach to internal audit accelerates departments’ uncooperative response to internal audit. When being appointed as internal ⓒ 2013 J CSR. All Rights Reserved.
Conditions to Organize a Good Internal Audit
Condition ２： Training of internal auditors
Participate in practical training
Lectures, no matter how much they are, do not yield a positive effect.
Practical training is essential to develop a good internal auditor.
Understand a practical image of internal audit
How to conduct interview
Audit trail
Collection of evidences
Respond to information obtained in internal audit to deepen understanding about intern al audit
Workload has increased suddenly ・・・ What would you assess?
The organizational structure has ben changed ・・・ What would you assess?
Customer requirements have been changed ・・・ What would you assess?
Processes have been changed ・・・ What would you assess?
ⓒ 2013 J CSR. All Rights Reserved.
Conditions to Organize a Good Internal Audit
Condition 3 ： Cooperation of Departments to be audited
Internal auditor must make maximum use of limited opport unities of internal audit and identify “key to success.”
It is important for an internal auditor to improve his/her ow n ability and brush up auditing skills, but Condition 3 helps h im/her compensate for the lack of the skills.
Make it a priority to give an internal audit “successful exp erience”
Enjoying delicious dishes is essential for a cook to develop his/her skills.
Cooperation of Departments to be audited
Actively participate in identification of problems Provide sufficient information on both positive and negative facts Trust internal auditors ⓒ 2013 J CSR. All Rights Reserved.
Conditions to Organize a Good Internal Audit
Condition 4 ： Establish PDCA of internal audit which faci litates development of internal auditors
Plan － Preparation of internal audit
Do － Execution of internal audit ⇐ Carry out internal audit based on Conditions １ ~ ４・・ (Wishing for success) － Analysis/reporting of internal audit results
Check － Evaluation of quality of internal audit
Act
－ Feedback of the evaluation results leads to development of capable internal auditors
ⓒ 2013 J CSR. All Rights Reserved.
Preparation of Internal Audit
(Essential to Enhance Effectiveness of Internal Audit)
Preliminary information collection
Understand objectives of the internal audit ・・・ (Support of top m anagement)
Define information that needs to be collected from Departments to be audited and relevant Departments in order to satisfy the internal audit objectives
Changes, targets, processes/procedures, events (incidents/acciden ts, what is done well/what is not done well/what is concerned), ch allenges ・・・（ Cooperation of Departments to be audited ）
Organize preliminary information so as to make it useful in internal audit
Identification of key processes
Sub-processes, conditions, criteria, qualification and training which affect the k ey processes
Risks and expected problems
What needs to be assessed?
What will be sampled and how much samples will be taken?
What information needs to be extracted?
ⓒ 2013 J CSR. All Rights Reserved.
Analysis/Reporting of Internal Audit Results
Try to produce an internal audit report to have people say “Go od Job!!”
Analyze internal audit results as much as possible and examin e the analysis results
Example of Analysis:
Internal audit results generally have the following two aspects:
1.
Management system (procedures and rules ）
2.
Performance (degree of achievement of targets ）
.Analyze
and examine the results based on the combination of the a bove two aspects:
A)
Rules are strictly observed and targets are achieved.
B)
Rules are strictly observed but targets are not achieved.
C)
Although rules are not observed, targets are achieved.
D)
Rules are not observed and targets are not achieved. ⓒ 2013 J CSR. All Rights Reserved.
Example of Analysis: A)
Rules are strictly observed and targets are achieved.
B)
Rules are strictly observed but targets are not achieved.
C)
Although rules are not observed, targets are achieved
D)
Rules are not observed and targets are not achieved.
Targets Achieved
Targets not Achieved
C) ＋ α possible cases ：
A) ＋ α possible cases ：
D) ＋ α possible cases ：
B) ＋ α possible cases ：
1.May not have achieved targets if rules were observed 2.May have set too easy targets 3.May disregard rules 4.May turn to “D” when some specific conditions are added
1.May have achieved targets if rules were observed 2.May not have achieved targets even if rules were observed 3.May have set too aggressive targets compared with capability 4.May have problems in awareness 5.May have problems in equipment capability
Rules Violated
1.May be able to find more effective processes 2.May have set too easy targets 3.May turn to B, C or D when some specific conditions are added
1.May have flaws in rules 2.May have set too aggressive targets compared with capability 3.May have problems in equipment capability 4.May have problems in willingness to achieve targets 5.May turn to A when some specific conditions are added
Rules Observed ⓒ 2013 J CSR. All Rights Reserved.
Reporting of Internal Audit Results
Report isolated failure of achievement or violation as a deficiency
Also report magnitude of impacts
Top management understands a need to take initiative; e.g. allocation of res ources.
Also report those areas focused in the internal audit
Top management becomes aware of need for prioritization.
Also report analysis results
Top management does not pay attention ／ It is Departments that are expect ed to address such deficiency ／ It is not necessary to report each one of suc h deficiency
Top management understands credibility of the results and problems in the process to derive conclusion.
Also report considerations on risks
The report helps top management develop a next strategy. d Job!!”
→ “Goo
Drill down and Sort out ⓒ 2013 J CSR. All Rights Reserved.
Evaluation of Quality of Internal Audit Self-Evaluation
Quality of preparation
Was preliminary information acquired effectively?
Was the organized preliminary information useful?
Were key processes identified correctly?
Were risks to an organization identified properly?
Was practical image of internal audit useful? ：
Quality of internal audit
Was progress of target achievement in audited Departments assessed?
Was degree of process maturity assessed?
Were strength and weakness of an organization assessed?
Was sufficient assessment conducted to meet the objective of the internal audit?
Was cooperation of audited Departments sufficient? ：
Quality of analysis/reporting
Was the information obtained in the internal audit analyzed based on facts to identify relevance and risks?
Was the internal audit report compiled in a way to effectively communicate what needs to be communicated? ： ⓒ 2013 J CSR. All Rights Reserved.
Evaluation of Quality of Internal Audit
Evaluation of internal audit by audited Departments → Questionnai re survey, etc.
Internal audit is a service to Departments to be audited, and th erefore quality of internal audit can be regarded as service quali ty.
Such a technique as “Servqual” that is widely used to evaluate s ervice quality is considered to be used to evaluate quality of int ernal audit.
SERVQUAL SERVQUAL is a technique to evaluate service quality by measuring a gap between a service “expected” by users and an actual service “perceived” by users. In this technique, 22 questions are asked for five dimensions determining perceived quality (evaluation on the scale of one to seven). Five dimensions Tangibles: physical facilities, appearance of equipment and employees Reliability: capability to execute a committed service accurately Responsiveness: willingness to assist customers and promptly provide a service Assurance: employees’ knowledge, politeness and capability to provide confidence and trust Empathy: consideration given to customers and care for each individual ⓒ 2013 J CSR. All Rights Reserved.
Summary
Significance of enhancing internal audit
Raise value of input to top management
Development of internal auditors is a key to the enhancement of internal audit.
Organizing a good internal audit is essential for development of internal auditors. Condition 1: Top management’s support and commitment to the public, people and business Condition 2: Training of internal auditors Condition 3: Cooperation of Departments to be audited Condition 4: Establish PDCA of internal audit which facilitates development of internal auditors
A good internal auditor is developed by utilizing limited opportunities of internal a udit, experiencing a good and successful internal audit based on the organized go od internal audit conditions, and receiving feedback of internal audit quality evalu ation results.
ⓒ 2013 J CSR. All Rights Reserved.
Assistance to Enhance Internal Audit Value
Use of the IRCA’s OEA (Organisations employing au ditors) program
http://www.irca.org/ja/OEAs/
J CSR provides information on audit of organizations through the website of Auditor Bank. Thank you very much for your kind attention. http://www.auditorbank.com/
ⓒ 2013 J CSR. All Rights Reserved.