IIA Today Q2 2013 by The Institute of Internal Auditors

Today A MESSAGE FROM THE INSTITUTE OF INTERNAL AUDITORS

Spider-Man and Exemplary IIA Leaders

4 8 14 18

News from The IIA and the Internal Audit Profession Spider-Man and Exemplary IIA Leaders Full Steam Ahead for COSO A Streamlined and UserFriendly Approach to Quality 2nd Quarter 2013

Our Principal Partners Make a Difference The IIA acknowledges the ongoing support from our Principal Partners, who help enhance the internal audit profession by sharing their resources and knowledge with our most valuable asset â&#x20AC;&#x201C; our members. These partners actively serve as members and volunteers within The IIA, participate in the introduction of new guidance, develop world-class training, and show their commitment in many other ways in an effort to advance the internal audit profession.

The IIA encourages you to tap into the expertise of our Principal Partners in 2013!

Welcome message Dear IIA Member,

Today PUBLICATION DIRECTOR

Carrie Summerlin EDITOR

Paula Michaels STAFF EDITORS

Ariel Allen Lisa Krist Maggie Dunn Shelli Browning CONTRIBUTING EDITORS

Christina Brune Georgeann Doyna Trish Harris ART DIRECTOR

Jon Peters Graphic Designers

Brandie Tate Cathy Watanabe CHIEF MARKETING OFFICER

Bill Michalisin IIA PRESIDENT AND CEO

Richard F. Chambers, CIA, CGAP, CCSA, CRMA IIA CHAIRMAN OF THE BOARD

Philip D. Tarling, CIA, CRMA, CMIIA IIA Today is a quarterly publication produced exclusively for members of The IIA. To learn more about this publication, please visit www.theiia.org/IIAToday . We welcome all comments, questions, and feedback. Please send your message to IIAToday@theiia.org and include your name and contact information.

The IIA has been a wonderful place for me to learn and grow both professionally and personally. The esprit de corps and passion for the profession I get from being around such a talented group of volunteers and staff motivate me to be the best internal auditor I can be and to instill that pride in those I work with. This is truly an amazing organization, full of committed and dedicated professionals whose desire to serve its members and stakeholders is unmatched. Our volunteer leaders represent the commitment and dedication of which I speak, as well as encourage others to come forward, give back, and enhance their own leadership skills. I hope you will find this special volunteer leadership issue of IIA Today and the stories included to be both inspiring and motivating. On behalf of the North American Board, Chapter Relations Committee, and staff at IIA Global Headquarters, I want to thank all of our volunteers for their important contributions to our organization. And a special thanks to our 20122013 volunteer leaders. The past year brought great success to The IIA, and I personally appreciate the role our leaders played and the passion they demonstrated throughout the year. As the 2013-2014 year begins, those who are embarking upon their first year of IIA leadership will work side-by-side with seasoned volunteers. As a result, The IIA will benefit from both new perspectives and long-standing experience and knowledge. What a great year this promises to be! As the chair of the North American Board, I invite you to exhibit your passion for the profession by volunteering for The IIA. As you will learn from those featured in this publication, it can be one of the most rewarding endeavors you will ever undertake. Sincerely, Carolyn D. Saint, CIA, CRMA 2013-2014 North American Board Chair Vice President Internal Audit, 7-Eleven, Inc.

The Institute of Internal Auditors

w w w. t h e i i a . o r g

2nd Quarter 2013

News

IIARF Bookstore Redesigns the Way The IIA Delivers Knowledge The IIA Research Foundation (IIARF) unveils its new digital platform, which will allow customers to purchase eBooks through The IIARF Bookstore to view on their eReader of choice. The IIARF wanted to provide practitioners with a more convenient way to access the critical resources the Bookstore offers. More than 25 of our best-selling products are available for purchase on this new digital platform.

NEW RELEASES Here are some of the latest releases from the Bookstore: ■■ COSO Internal Control–Integrated Framework:

Turning Principles into Positive Action was written by former COSO Chairman Larry Rittenberg, Ph.D., CIA, CPA, to provide useful guidance for auditors on the 7 key Framework changes that will affect how they conduct their work. Rittenberg also provides tips on how to communicate these important changes to stakeholders. ■■ The CRMA® Exam Study Guide is designed to

bring you up to speed on the content covered by the Certification in Risk Management Assurance™ exam. The guide was written and reviewed by an international team of practitioners and academics and is designed for a global audience. (Print only) ■■ While many books have been used to convey vari-

ous aspects of internal auditing, Internal Auditing: Assurance & Advisory Services, 3rd Edition incorporates the fundamental knowledge and skills needed to succeed as an internal auditor from both theoretical and application perspectives. (Print only) ■■ Quality Assessment Manual for the Internal

Download these ebooks and more now at www.theiia.org/bookstore.

I I A To d a y

w w w. t h e i i a . o r g

Audit Activity is critical because regardless of industry, sector, or size, implementing a comprehensive Quality Assurance and Improvement Program (QAIP) will ensure the internal audit activity is meeting expectations of clients and stakeholders. (Print only)

News

May Builds Momentum for Promoting Internal Auditing Year Round May 31 marked the end of another successful International Internal Audit Awareness Month, which was celebrated with great enthusiasm in a variety of ways around the globe. IIA chapters, Institutes, and individuals shared their â&#x20AC;&#x153;promoting the professionâ&#x20AC;? stories throughout the month via email and IIA social media channels, demonstrating a global commitment of time, effort, and passion to represent the internal audit profession with pride. Many local groups held informational seminars, continuing education opportunities, luncheons, black-tie galas, and charity events. A number of IIA chapters and Institutes, including members in the Bahamas and Nevada, reached out to their local government officials, prompting them to issue official proclamations recognizing May as International Internal Audit Awareness Month. Individual internal audit professionals also made a special effort to spread positive and informative messages about the evolving role of internal auditors in todayâ&#x20AC;&#x2122;s business landscape. Without a doubt, the global celebration of International Internal Audit Awareness Month has created great momentum for promoting the profession throughout the rest of the year.

w w w. t h e i i a . o r g

2nd Quarter 2013

News

IIA Conferences: Driving Knowledge Sharing and Networking General Audit Management Conference The 2013 General Audit Management Conference (GAM) was the largest, most impactful GAM conference to date. Over 1,100 were in attendance at the ARIA in Las Vegas, Nev., for the essential experience for CAEs. Dr. Robert Kriegel, New York Times and BusinessWeek best-selling author, NPR Marketplace commentator, sports psychology pioneer, and Olympic Coach kicked off the conference with his astute session on Leadership: Creating a Changeready Organization. This year’s 35 concurrent sessions, focused on topics ranging from Getting the Wow Factor in Your Audits, Using the Competency Framework to Enhance Audit Talent, and Fraud Risk Management: A Holistic Approach, were facilitated by world-renowned internal audit professionals with insights and experiences that were relatable and relevant to all who participated. Additional general sessions were also germane and insightful in light of the current global environment, including long-time favorite Richard Chambers, president of The IIA, who discussed the reliability of one’s ethical compass and falling victim to its blind spots.

Gaming Conference Attended by over 300 auditors, regulators, and related professionals in the gaming industry, the 2013 Gaming Conference in Las Vegas was one of The IIA’s hottest conferences to date. An award of appreciation was presented during the opening session to Ron W. Reigle, CIA, founder of the Gaming Advisory Group, renowned auditor, author, and advocate for the profession. This year’s 24 concurrent sessions focused on topics ranging from Fraud in the Back of the House, to Current Issues in Indian Gaming, and Top Ten Internal Control Issues in the Gaming Industry. Always a favorite, Wednesday evening featured the Gaming Industry Executive Panel, with experts Phillip Popehn, Robert Rudloff, and Arthur Askins breaking down gaming’s current hottest topics. The event wrapped up Friday morning with two spectacular, timely general sessions on the Latest Developments in iGaming and How Internal Audit Has Moved to the Front Line in the Fight Against Casino Fraud.

Leadership Academy “Speed to Succeed” was the theme of this year’s Leadership Academy, hosted by The IIA to bring emerging chapter leaders together for a three-day orientation event with the opportunity to network with one another and experienced North American leaders to learn best practices in chapter administration and build the right road map for success for the 2013-2014 chapter season. This annual event drew more than 300 IIA leaders representing 130 chapters who convened at the Walt Disney World Yacht & Beach Club Resorts to participate 6

I I A To d a y

w w w. t h e i i a . o r g

News in interactive general sessions, panels, smaller facilitated breakouts, workshops, and networking events. The IIA also recognized more than 50 chapters for demonstrating excellence in the 2012-2013 chapter season.

IIARF and IAAAF Awards and Recognition Bestowed at Leadership Conference Two IIA Research Foundation groups presented awards and recognized donors at the 2013 Leadership Conference. The IIARF presented the Donald E. Ricketts Research Award to two chapters that submitted original research reports covering critical topics affecting the profession. This year’s first place award winner was IIA–Dallas for their paper Mobile Computing: A Study of Internal Awareness. The second place winner was IIA–Austin for their work, Rethinking the Future of Audit: Internal Audit Is at a Crossroads.

The IIA Research Foundation in Partnership with McGladrey Releases Global Corruption Law Compliance Research Report With globalization now a reality for companies of all sizes, it’s vital for business leaders to ensure that vigilant compliance with global bribery and corruption laws and regulations is part of their firms’ overall risk management strategies. The cost of ignoring such activity is high, as fines and investigations impact a company financially while reputational damage can result in lost customers, business partners, and ultimately, more dollars. With these challenges in mind, The IIA Research Foundation in conjunction with McGladrey has developed the Global Corruption Law Compliance Report. Download your complimentary copy at www.theiia.org/bookstore.

Also, IIA Academic Relations recognized 15 chapters that contributed $5,000 or more in the 2012 chapter year to the Internal Auditing Academic Advancement Fund (IAAAF). Funded by the IAAAF, IIA Academic Relations promotes the internal audit profession to the next generation by providing professors and students around the world with access to internal audit educational resources.

JUST RELEASED • Contrasting GRC and ERM: Perceptions and Practices Among Internal Auditors Sponsored by: IIA-Albany, IIA-Downeast Maine, IIA-Southern New England, and IIA-Westchester-Fairfield

Coming Soon From The IIARF • Closing Gaps in Third-Party Risk Management Through Internal Auditing Sponsored by: Crowe Horwath • Internal Auditor Objectivity and Job Satisfaction • The Internal Auditor 360° Study

w w w. t h e i i a . o r g

2nd Quarter 2013

Feature story

Spider-Man and Exemplary IIA Leaders Learn from the best and tap into your own leadership super powers! In a recent Forbes Magazine article, Spider-Man was touted as the quintessential leader. The article listed three valuable lessons about strong leadership that we all can learn from this superhero: • With great power comes great responsibility. • Be who you are. • Do good things even if you don’t get the credit. Pretty simple, huh? And profound!

I I A To d a y

w w w. t h e i i a . o r g

Feature story

lthough Spider-Man might not immediately conjure up thoughts of internal auditors and IIA volunteer leadership, they do have quite a bit in common. And to make the case for their similarities, we interviewed 10 exemplary IIA leaders, tapping into their more than 221 years of collective IIA membership.

What’s the payback? Quite often we hear IIA leaders say that they get back much more than they give. Certainly, Spidey would attest to the fact that being a leader has countless benefits. After all, whether you are swinging from one building top to another or heading up a project or committee, it’s pretty cool to know that people look up to you! One of the great benefits — both personal and professional — of being an IIA volunteer is the growth that comes as a result. “As my IIA chapter’s secretary, I was chosen to attend the 2012 and 2013 IIA Leadership Academies,” says Nateida Lathon, who works at the Social Development Commission in Milwaukee, Wis. “Although I was already involved in the local CAE roundtables because of my job, I am more invested now as an IIA leader — not only in my profession, but as being a face of my chapter. I’ve made strong professional and personal connections with audit peers. This has opened my eyes more to the profession, which in turn has allowed me to add more value to my organization in my role as internal audit director. It also has allowed me the opportunity to mentor my staff, encourage their involvement in the local chapter, and support their growth and professional career goals,” she says. Deanna Sullivan, who was selected IIA–Dallas Chapter’s “Outstanding New Member” in 1987, has come a long way over the past two-and-a-half decades. This former International Conference chair views relationships among the greatest benefits of IIA leadership. “My dear friend, Aaron Saylor, encouraged my involvement at both local/chapter and international/global levels. He said it was important to give back to the profession to ensure it remains vibrant and growing. Aaron is no longer with us, but his advice is as relevant today as it was then,” attests Sullivan. “Working with The IIA has been incredibly rewarding. I have learned a lot professionally, have made some life-long friends, and have grown to be a better leader though amazing opportunities along the way,” she says. IIA Executive Committee Larry Harrington agrees with Sullivan. “It is amazing how much I have personally gained from my IIA involvement,” he says. “I have learned the importance of continuously investing in myself, welcoming change as the new norm, significantly refining my communication and influencing

w w w. t h e i i a . o r g

2nd Quarter 2013

Feature story

skills, greatly expanding my network of experts, and becoming a better CAE to help my company and our profession,” says Harrington. “Because of my IIA volunteer leadership experience,” adds IIA Board member and Botswana International University of Science and Technology Director of Internal Audit, Lesedi Lesetedi, “I have higher confidence, better negotiation capabilities, improved presentation and publicspeaking skills, and increased professional knowledge.” She goes on to say that she has developed a more in-depth understanding of different traditions and cultures around the world as her global network of professional colleagues has expanded and friendships have evolved. “My IIA volunteer leadership activities have provided intrinsic value that I cannot easily define,” Lesetedi says, “and a feeling of self-worth that has enabled me to grow both personally and professionally.” Carolyn Saint, The IIA’s North American Board Chair who often makes presentations at IIA district conferences, speaks with appreciation and admiration about leaders who bring IIA events to fruition. “I love being around the dinner table with them the night before as they share stories about what it took to get the event to the finish line,” she explains. “These are real friendships, cemented through the hard work and long hours it takes to make an IIA gathering so worthwhile for its participants. And yet, these volunteer leaders come back for more — year after year — aspiring to win the next big regional conference bid. This is 10

I I A To d a y

w w w. t h e i i a . o r g

in spite of the personal sacrifice and commitment required to make it happen — or, perhaps — it’s because of that sacrifice and commitment!” she says with a smile. As a member of The IIA’s North American Board of Directors, Mike Fucilli cannot say enough about the positive impact volunteer leadership has had on his life. “I directly attribute my professional success to my IIA involvement,” says Fucilli. “It positioned me to develop leadership, organizational, marketing, and speaking skills. My very first involvement was organizing a workshop for IIA–New York Chapter. This required obtaining a speaker, identifying a meeting location, developing a budget, selecting a menu, and reporting the outcome. This experience marked the birth of my facilitation skills! Over the years, I have evolved into a leading speaker at IIA conferences. These same skills have been invaluable in my position at the largest public transportation authority in the Western Hemisphere — the MTA — where I started as a senior auditor and ascended to CAE, with more than 80 professionals on my staff,” he says. Poste Italiane Director of Internal Audit Carolyn Dittmeier has been an IIA volunteer since 2001. Currently a member of The IIA’s Executive Committee, she was IIA–Italy’s president from 2004 to 2010, after which she served as European Confederation of Institutes of Internal Auditing (ECIIA) chair. “The greatest personal growth I have encountered was successfully activating a concrete transformation of the reputations of IIA–Italy and the ECIIA. We

increased visibility to stakeholders through new communication channels and strategies,” she explained. “I also had a great time being creative and devising new papers, publications, conferences, and the Corporate Governance Citizen Program in Europe for gaining sponsors and exposure,” says Dittmeier. The list of benefits goes on, and the positive experiences volunteers share are inspiring. North American Board member Todd Horbasenko defines the value of his IIA leadership involvement as real-life board experience, interpersonal skilldevelopment, professional network expansion, professional profile enhancement, and the best way to stay current on the development of the profession. He indicates that his most gratifying IIA leadership effort to date has been the creation of IIA– Canada as a virtual institute. “This was my most rewarding effort, and it is a source of great personal pride,” he says. He explains that the ability to enhance and address the unique needs of Canadian members evolved from the creation of the Canadian Council in 2006 (as a subcommittee of the North American Board) to the establishment of an IIA–Canada Board and the Canadian IIA Headquarters in Ottawa. After much consideration, a hybrid governance model — similar to what has been established between IIA North America and IIA Global — is now in place for IIA–Canada. “This experience has put me in the same room at the same table with such leaders of the profession as The IIA’s president and CEO and other executives at IIA

Feature story

Global Headquarters,” he explains. “And all of this began the moment I raised my hand and volunteered to serve on the board of IIA–Edmonton Chapter!” says Horbasenko.

Are you ready to raise YOUR hand? You, too, can flex your volunteer muscles and develop your own leadership super powers. The IIA offers many opportunities for becoming a leader. All you have to do is raise your hand and: • Take on a leadership role in your local chapter. • Write an article for your chapter newsletter. • Sign up to be on a regional IIA event-planning committee. • Mentor a new internal auditor or member of your local chapter. • Actively participate in International Internal Audit Awareness Month. • Take The IIA’s Instructor Development Course (IDC) and become a volunteer seminar leader. • Become an IIA quality assurance team member. • Find out more about The IIA’s committee structure and express your interest in becoming involved. • Explain and clarify internal auditing to your circle of influence. • Do everything you can to advance the internal audit profession and enhance professionalism of internal audit practitioners.

Did Spidey get it right? I definitely agree with Spider-Man’s lessons learned. Great responsibility comes with being in a position of leadership, and that should not be taken lightly. It requires time, commitment, continuous learning, and the ability to train and mentor others along the way. It’s true that you may not get credit or receive accolades for everything you do, but that’s okay, as long as you have passion and conviction, and know that what you are doing is for the greater good. – Nateida Lathon, Secretary and Certifications Chair, IIA–Milwaukee Spider-Man is absolutely right. He believes in servant leadership; that leaders do not exist to be followed, but because they are followed. It is both a great responsibility and a great honor to earn that role. And it’s a role IIA leaders earn every day. – Carolyn Saint, North American Board Chair Spider-Man is right on target! Specific to our profession, I would add several things: candidly and frankly advising management and the audit committee; challenging management in regard to confronting the top risks that could derail the achievement of organizational goals; identifying and recognizing those who can get the job done, while improving quality and maintaining relevance; and developing relationships based on mutual trust and respect. These actions, of course, are displayed by top CAEs. However, those who model the accompanying traits of courage, diligence, discernment, resourcefulness, integrity, and respectfulness not only make the best internal auditors, but also the best volunteer leaders. – Denny Beran, former Global Board Chair and current global board member I think Spider-Man’s belief in doing good things even if you don’t get the credit is an admirable way of being. Along those lines, I’ve adopted this anonymous quote as my mantra: I shall pass through this world but once. Any good that I can do, any act of kindness I can render, anyone I can inspire, and any activity I can undertake that adds value to life, let me do it now. Let me not defer or neglect it, for I may not pass this way again. – Lal Balkaran, former President of IIA–Toronto and co-founder of the Guyana chapter If you follow Spider-Man’s excellent advice to be who you are, you will get involved in the right volunteer leadership position at the level that best fits your skill sets. There are numerous committees, activities, and needs within The IIA. Don’t think that your talents and knowledge are of less importance or value than those of the people you see or read about in the internal audit community. Volunteer for things you are passionate about. Be who you are and be involved! – Deanna Sullivan, former International Conference Chair

w w w. t h e i i a . o r g

2nd Quarter 2013

TRAINING

2013 Seminar Course Matrix (Courses through December 2013) Updated 5/1/13

Course Code Course Level Duration

Palm Beach, FL Aug. 26 - 29

Chicago, IL Sept. 10 - 13

Aug. 26-29

Sept. 10-13 Sept. 10-13

Philadelphia, PA Sept. 25 - 26

Four Day Courses Audit Manager Tools and Techniques

TTM

Intermediate

Auditor-in-charge Tools and Techniques

AIC

Intermediate

Beginning Auditor Tools and Techniques

Basic

Aug. 26-29

Communication Skills for Auditors

ECA

Basic

Aug. 26-29

Leadership Skills for Auditors

LSA

Intermediate

Aug. 26-29

ABP

Basic

Aug. 26-27

Sept. 10-13

Courses Under Four Days Analyzing & Improving Business Processes Assessing Risk: Ensuring Internal Audit's Value

ARV

Advanced

Assessing Your Organization's Risk Management Process

ARM

Intermediate

Audit Report Writing

ARW

Basic

Auditing Derivative Strategies

ADS

Intermediate

Auditing Investment Activities

AIA

Intermediate

Building a Sustainable Quality Program

IQA

Intermediate

Construction Activity: Audit Strategies

EAC

Intermediate

Continuous Auditing

Advanced

Contract Auditing

Intermediate

Control Self-assessment: An Introduction

CSA

Basic

Aug. 26-27 Aug. 28-29

Control Self-assessment: Facilitation Skills

CFT

Intermediate

Corporate Governance: Strategies for Internal Audit

ACG

Intermediate

COSO 2013: Implementing the Framework

Sept. 10-11

COSO

Intermediate

Data Analysis for Internal Auditors

Intermediate

Effective Writing for Auditors

EWA

Intermediate

Sept. 12-13

Enterprise Risk Management: An Introduction

ERM

Intermediate

Sept. 10-11

Evaluating Organizational Ethics

ETH

Intermediate

Sept. 12-13

Financial Auditing for Internal Auditors

AFA

Intermediate

Human Resources: Auditing Your HR Function

HRF

Basic

Lean Six Sigma Tools for Internal Audit Fieldwork

SSF

Intermediate

Lean Six Sigma Tools for Internal Audit Planning

SSP

Intermediate

Operational Auditing: Influencing Positive Change

POA

Intermediate

Performing an Effective Quality Assessment

QAE

Intermediate

Project Management Techniques

PMT

Intermediate

Risk Based Auditing: A Value Add Proposition

RBP

Intermediate

Sarbanes-Oxley: Assessing IT Controls

SAI

Intermediate

Small Audit Shop: Doing More with Less

SAS

Intermediate

Statistical Sampling for Internal Auditors

SSI

Intermediate

Sept. 10-11

Value-Added Business Controls: The Right Way to Manage Risk

VAB

Basic

Sept. 10-11

CTA

Basic

Deloitte Public Offerings - Courses Under Four Days Critical Thinking for Internal Auditors

I I A To d a y

w w w. t h e i i a . o r g

Aug. 26-27

Sept. 12-13

Aug. 28-29

Aug. 26-27

Sept. 10-12

Sept. 25-26

TRAINING

San Antonio, TX Sept. 30 - Oct. 3

Las Vegas, NV Nov. 5 - 8

Anaheim, CA Nov. 18 - 21

Orlando, FL Dec. 9 - 12

New York, NY Dec. 17 - 20

Nov. 5-8 Sept. 30-Oct. 3

Nov. 5-8

Nov. 18-21

Dec. 9-12

Dec. 17-20

Sept. 30-Oct. 3

Nov. 5-8

Nov. 18-21

Dec. 9-12

Dec. 17-20

Sept. 30-Oct. 3

Nov. 5-8

Dec. 9-12 Nov. 18-21

Dec. 9-12

Dec. 17-20

Nov. 20-21

Dec. 17-18

Nov. 18-19

Dec. 17-18

Nov. 20-21

Dec. 19-20 Dec. 19-20 Dec. 17-18

Sept. 30-Oct. 1

Nov. 5-6

Dec. 17-18

Oct. 2-3

Dec. 19-20

We’re jazzing things up!

Nov. 7-8

The 2013 All Star Conference moves to the Big Easy where you can revel in the rhythm of the “best of the best”! Sept. 30-Oct. 1 Sept. 30-Oct. 1

Nov. 5-6

Nov. 20-21

Dec. 11-12

Dec. 17-18

Dec. 9-10

You won’t want to miss these educational tracks focused on enhancing the effectiveness and impact of internal audit:

Dec. 9-10 Nov. 18-19 Oct. 2-3

Nov. 7-8

Sept. 30-Oct. 1

Nov. 5-6

Dec. 19-20 Dec. 17-18 Nov. 18-19

Oct. 2-3

Dec. 11-12

Nov. 7-8

Dec. 19-20

Oct. 2-3

Dec. 11-12 Dec. 19-20 Nov. 20-21 Nov. 18-19

Sept. 30-Oct. 1

This year’s Conference will feature speakers and topics from a year of stellar presentations at IIA North America and Chapter conferences, as ranked by attendees.

• Internal Auditing and Corporate Governance • Risk Appetite and Strategy for Change • The Internal Auditor’s Role in Emerging Technology • Fraud: An Enterprise Level Perspective Members save US $200 when they register by August 2. Visit www.theiia.org/goto/AllStar2013 for more information and to register today. Group discounts are available by calling +1-407-937-1111.

Dec. 17-18

w w w. t h e i i a . o r g

2nd Quarter 2013

special feature

Full Steam Ahead for

COSO

With an updated internal control framework, a new chairman, and a recent white paper on sustainability risk, it’s been a busy couple of months for the Committee of Sponsoring Organizations of the Treadway Commission (COSO), a group dedicated to providing thought leadership and guidance on internal control, enterprise risk management, and fraud deterrence. In May, COSO issued its updated Internal Control–Integrated Framework (2013 Framework). While the original framework, released by COSO in 1992, has been an effective tool, much has changed in the past two decades. The new framework expands on the original, clarifying fundamental principles and addressing risks associated with technological advances, globalization, and increased regulation. The 2013 Framework, created under the leadership of retired COSO chair David Landsittel, is being carried forward under a new chair, Robert Hirth Jr., who stepped into his new role June 3. Hirth is a founding managing director of Protiviti, a global consulting firm of more than 2,500 employees in more than 20 countries — now part of Robert Half. He previously served as executive vice president of Protiviti’s Internal Audit and Financial Control practice and

I I A To d a y

w w w. t h e i i a . o r g

The COSO Five Organized in 1985, COSO is a joint initiative of the following five sponsoring organizations: 1. The Institute of Internal Auditors (IIA) 2. American Institute of Certified Public Accountants (AICPA) 3. Financial Executives International (FEI) 4. American Accounting Association (AAA) 5. Institute of Management Accountants (IMA)

special feature

as a member of the firm’s six-member global Executive Team. “One of my immediate goals will be to effectively and extensively communicate the benefits of and updated concepts in the recently revised framework,” Hirth said. “The basic concepts are still there, but we’ve modernized it. We’ve brought it up to speed, if you will, to 2013.” Companies are encouraged to get to work right away in using the 2013 Framework, which will officially supersede the old framework as of Dec. 15, 2014. In the meantime, companies are advised to specify which version of the framework they are using. IIA President and CEO Richard Chambers says it is important to note that while the COSO framework may be used as a tool for Sarbanes-Oxley compliance, the principles are intended to apply to private companies, not-for-profits, government bodies, and other organizations as well. “The COSO framework is applicable to all organizations,” Chambers said. “The goal is to help boards and executive leadership determine whether their organization has effective internal controls.” As chair, Hirth said he is focusing on making sure as many companies as possible are educated about the revised framework. To assist in that process, COSO has published Illustrative Tools for Assessing Effectiveness of a System of Internal Control, and

Internal Control over External Financial Reporting (ICEFR): A Compendium of Approaches and Examples. The COSO website, www.coso. org, also features a newly published nine-page article, “The 2013 COSO Framework SOX Compliance: One Approach to an Effective Transition,” aimed specifically at assisting public companies’ compliance with Section 404 of the U.S. Sarbanes-Oxley Act of 2002. The article outlines an approach to transitioning from COSO’s original framework to the 2013 Framework. As a member of COSO, The IIA has established a COSO Resource Center, www.theiia.org/goto/coso, to provide the most comprehensive and up-to-date list of resources, tools, and training to support implementation of the 2013 Framework. Additionally, The IIA conducted a three-hour workshop on the subject during the 2013 International Conference in Orlando, July 14. Although the framework provides concrete guidance, Hirth emphasizes

that companies should consider its application to be a dynamic, rather than static, process designed to adapt and evolve with changes in the business environment. “The framework is a great model,” he said. “If you will learn it and use it, you will benefit from it.”

Thought Paper on Sustainability Risk In response to the growing number of organizations integrating sustainability into their business operations, COSO and Ernst & Young recently published a thought paper titled Demystifying Sustainability Risk: Integrating the Triple Bottom Line into an Enterprise Risk Management Program. The idea is to achieve increased shareholder value by integrating ERM and sustainability. Demystifying Sustainability Risk can be downloaded from The IIA’s COSO Resource Center, www.theiia.org/goto/coso.

Transition Steps COSO Chair Robert Hirth recommends a five-step process to help companies through the transition process: 1. Learn the 2013 Framework 2. Apply it to your company – identify and correct gaps 3. Develop a transition plan 4. Implement 5. Obtain external auditor sign-off for 2014

w w w. t h e i i a . o r g

1st Quarter 2013

LOCAL News

MEMBER NEWS Alcoa’s Board of Directors has elected Paris Watts-Stanfield as Vice President, Internal Audit, and an officer of the company. In this role, she is accountable for Alcoa’s worldwide audit activities in the finance; information technology; and environment, health, and safety areas. Most recently she was Alcoa’s director of internal audit, responsible for leading the company’s global Financial Business Process and IT audit groups.

IIARF Project Spins Off to Become an Award-Winning Academic Paper A Post-SOX Examination of Factors Associated with the Size of Internal Audit Functions by Urton L. Anderson, Margaret H. Christ, Karla M. Johnstone, and Larry E. Rittenberg has been selected to receive the 2013 AAA Accounting Horizons Best Paper Award. This was a project originally initiated with The IIA Research Foundation that became a spin-off academic paper. “To win a Best Paper Award on an internal audit topic is pretty unprecedented.” Rittenberg explained. “It’s good news for the internal audit profession. We thank The Foundation for its help in facilitating and supporting this kind of research.” Steven Randall, Managing Partner of Vonya Global LLC, has been named The IIA–Chicago Chapter New Member of the Year for 2012-2013. This award recognizes the outstanding contributions made by a new member of The IIA, new IIA–Chicago Chapter Board of Governors member, Officer, or other chapter volunteer during the current year. Mr. Randall won the award for his role serving as a member of The IIA–Chicago Chapter’s Board of Governors and his contributions made to the association in his role as the Social Media Committee Chairman, his role in the Career Assistance Program, his support of IIA– Chicago Chapter’s Annual Seminar planning committee, and other contributions.

I I A To d a y

w w w. t h e i i a . o r g

LaDawn Yesho, S&T Bank, was promoted to executive vice president, chief audit executive. In her role, Yesho will continue to oversee all aspects of the bank’s auditing functions. She previously served as senior vice president, chief audit executive and has worked at S&T Bank since 2009. Yesho earned a certified public accountant license and Certification in Risk Management Assurance designation.

Canadian Auditor Spearheads Volunteer Opportunity in New Zealand During a sabbatical in early 2013, Givonna DeBruin initiated her own volunteer assignment for a four-week stint with an internal audit peer at a healthcare organization in New Zealand. Seeking to experience a healthcare system outside of Canada and coming on her 10-year work anniversary, DeBruin emailed IIA–Australia and IIA–New Zealand to connect her with a healthcare peer interested in accepting a volunteer for an information exchange. She received a response from an organization in Hamilton, New Zealand, and learned that both countries’ governments have an information sharing agreement specifically for the purpose of facilitating such exchanges. Of her experience, DeBruin said, “Working overseas has been a dream of mine for many years and I’d like to encourage others to do so as well!” She is hopeful that auditors from the team she worked with will travel to the 2015 International Conference in Vancouver and include a side visit to her health authority in British Columbia’s interior.

STAFF NEWS IIA Vice President of North American Services Hal Garyn, CIA, CRMA, has served since June 2010 as leader of The IIA’s Chief Audit Executive Services team, which includes The IIA’s Audit Executive Center, as well as the North American Quality Services and Global Advocacy teams. He oversaw the launch of the Audit Executive Center in October 2010 and its growth to more

LOCAL News than 600 members during the past two years. As of April 1, 2013, Garyn has been appointed to vice president, IIA Professional Practices to provide staff oversight to the International Professional Practices Framework Oversight Council (IPPFOC) and The IIA’s guidance- and standardsetting processes. Additionally, he will continue to lead The IIA’s Global and North American Advocacy efforts, which he was instrumental in launching.

with a Teaching Excellence Award from the University. “When I talk to students, I tell them that getting an accounting degree, and specifically internal audit certification, will give them a tremendous skill set,” Newman said. “It is a remarkable education that very few universities offer at the level that we can, and thanks to IIA–Houston, it will continue to grow.”

IIA–Michiana Celebrates 45th Anniversary

CHAPTER NEWS IIA–Houston Donates $100,000 Endowment to IAEP School It’s been an exciting and prideful year for the University of Houston’s C.T. Bauer College of Business. In March it was recognized by The IIA’s Internal Auditing Education Partnership (IAEP) program as one of only six accounting programs globally as a Center of Excellence for its focus and commitment to internal audit curriculum. Thanks to a strong relationship between the University, IIA–Houston, and the Houston business community, the school’s internal audit curricula has provided a world-class education to students seeing a career or entry-level position in the internal audit profession. Now that tradition will continue thanks to a $100,000 program endowment on behalf of IIA–Houston.

“The endowment is an extremely generous gift that will put the program on a path toward self-sustainability,” said Michael Newman, director of accounting programs at the University of Houston. Newman was recently recognized

On May 30 the Michiana Chapter celebrated 45 years as an organized IIA chapter with a reception and presentation for past and current members. District Representative Duane Borkowski and District Advisor John Bowman joined this celebratory event on a rooftop deck in South Bend, Ind., with panoramic views of Notre Dame and the Golden Dome.

Attendees enjoyed appetizers and beverages while they networked, and then were treated to a dynamic presentation on the state of the Michiana economy from Jeff Rea, the president and CEO of the St. Joseph County Chamber of Commerce. Incoming chapter President Richard Fair recognized the past presidents and notable volunteers who have contributed to the greater Michiana internal audit community. Richard received a 45th Anniversary achievement certificate signed by IIA President and CEO Richard Chambers, along with the 2012-2013 Chapter Achievement Program Gold Award presented by Duane and John.

Have news to share? The IIA wants to share the achievements, accolades, and initiatives of our members and chapters. From a member’s promotion to an innovative chapter event, we want to hear about it and share through IIA Today or IIA Connection. Submit at http://www.theiia.org/newsletter-submission-form. w w w. t h e i i a . o r g

2nd Quarter 2013

special feature

A Streamlined and User-Friendly Approach to

The speed of business demands streamlining. The increasing pressure to do more, to do it better, and to get it done yesterday makes it more critical than ever before for internal audit departments to turn the magnifying glass on themselves and take a close look at what they are doing well and where there is room for improvement. As this is the very impetus for developing a Quality Assurance and Improvement Plan (QAIP), The IIA recently released new versions of the manual and the associated courses designed to put organizations on a path to success when developing or enhancing their QAIP. The new manual, Quality Assessment Manual for the Internal Audit Activity, introduces a shift in methodology from the last update to the manual published in 2011. The hope is that this new version will help internal audit departments around the globe develop solid QAIPs and ready themselves for an external assessment by an independent reviewer or review team, which is required at least once every five years in order to remain in conformance with the International Standards for the Professional practice of Internal Auditing (Standards). As the Director of IIA Quality Services Debi Roth explains, the intrinsic value of the new manual is that it is written and organized in the same way that auditors work. “We received comments about previous versions of the 18

I I A To d a y

w w w. t h e i i a . o r g

manual that practitioners felt it was labor-intensive,” says Roth. “Since the purpose of a QAIP is to enhance the efficiency and effectiveness of the internal audit function, we wanted to make the process of developing one as efficient and effective as possible. The new manual is much more user-centric and it just makes sense. We’ve received feedback that practitioners really appreciate the streamlined approach it takes.” To streamline the manual, the team of authors which included Patrick Copeland, CIA, CRMA, CISA; Donald Espersen, CIA, CRMA; Martha Catherine Judith Grobler, CIA, AGA, CRMA; and James Roth, Ph.D., CIA, CCSA, CRMA — all of whom bring significant quality improvement and assessment experience to bear — organized the

special feature manual based on four process segments which relate back to specific standards: ■■ Internal audit governance ■■ Internal audit staff ■■ Internal audit management ■■ Internal audit process

“We (the authors) feel the segments reflect the way most chief audit executives think about their audit shops,” says Copeland. “We organized the tools in the manual to align with the four segments, which facilitates performing both internal and external assessments. The planning tool for the (internal audit) staff segment aligns with the program tool for (internal audit) staff, and so on for each segment.” Copeland contends that the new methodology will prove more useful to CAEs in establishing their QAIP — which includes Ongoing Monitoring, Periodic Internal Assessments, and External Assessments — by eliminating redundancies from the process. The new structure ensures practitioners will only have to request information once, as the road map included in the manual then outlines where that information is used within the assessment process. For the final assessment, an Evaluation Summary–Master Framework identifies the tool (planning or program section, interview question, survey question, etc.) used to assess each standard in The IIA’s mandatory guidance. The Master Framework verifies that the assessor is only requesting information needed to complete the assessment. To ensure fluidity across the board, manual authors Copeland and Espersen rewrote the two courses The IIA offers that are designed to educate practitioners on how to most effectively use the manual. The two courses complement each other by design. Building a Sustainable Quality Program enables practitioners to: ■■ Apply The IIA’s Quality Standards to establish

an effective QAIP. ■■ Gain experience with the quality assessment

(QA) process model and related tools contained in the manual to identify areas of focus for their QAIP. ■■ Practice building ongoing and periodic assessments, developing metrics, and designing QAIP result reports.

■■ Assess the readiness of their internal audit

activity for an external QA. The second course, Performing an Effective Quality Assessment, allows practitioners to: ■■ Examine the process flow and tools in the

new manual and discuss how it can be used to conform with the Standards, while identifying opportunities for improvement. ■■ Practice using manual tools to plan, perform, and evaluate results of an external QA case study. ■■ Design an efficient and effective periodic internal assessment program. ■■ Evaluate the external QA options to determine the best fit for their internal audit activity. Roth, who was there for the launch of both courses and has facilitated courses herself, says, “The (Performing an Effective Quality Assessment) course gives attendees the opportunity to gauge where their department is currently at and walks them through real-life examples to provide context. Not only can they determine whether or not they are ready for a QA, but they learn specifically what they need to fix or adjust beforehand and walk away with ready-to-use ideas on how to improve the function of their department.” She also notes that both courses can be delivered on-site for organizations that would like to customize the message for their particular needs. Thanks to the hard work of the team of authors, reviewers, and course developers, now more internal audit departments than ever before will have a streamlined and user-friendly path toward Quality that will help them better meet the evolving needs of today’s stakeholders.

Visit these web pages to learn more about getting your QAIP on track: • QA Manual: www.theiia.org/bookstore • Seminar Course: www.theiia.org/seminars • Services/Resources: www.theiia.org/quality

w w w. t h e i i a . o r g

2nd Quarter 2013

IIA Conference Schedule

IIA Members: Register early for IIA Conferences and save! Call +1-407-937-1111 to ask about group discounts. www.theiia.org/Conferences 247 Maitland Avenue Altamonte Springs, FL 32701-4201 USA

Please recycle this newsletter by passing it along to a colleague.

August 19–21, 2013

2013 Governance, Risk, and Control Conference (IIA/ISACA) Phoenix, AZ, USA

September 23–24, 2013

Industry Labs: A Mosaic of Ideas Philadelphia, PA, USA

September 29–October 2, 2013

2013 Canadian National Conference Winnipeg, MB, Canada

September 29–October 2, 2013

2013 Central Regional Conference Columbus, OH, USA

October 14–16, 2013 New Orleans, LA, USA

November 3–6, 2013

2013 Midwestern Regional Conference Minneapolis, MN, USA

07/130937/PM/CW

2013 All Star Conference

2nd Quarter 2013

Spider-Man and Exemplary IIA Leaders

Today A M E M B E R S - O N LY P U B L I C AT I O N