Posts Tagged “audit market”

As the threat of climate change mounts, Audit International know that businesses must take steps to counter its damaging effects. This is in order to meet ambitious government Net Zero targets, which aim to halve emissions in a little over a decade.

The promising news is that the majority of organisations now understand that sustainability must be made a priority when it comes to devising their overall strategy.

However, companies are often left in the dark as to how best to report on their ESG credentials in a way that’s impactful and means something to shareholders and other stakeholders. It’s clear that what’s needed is a uniform set of standards for measurement and reporting, just as there is for financial performance. This is particularly prevalent in the Accounting sector, where calls are increasingly being made to introduce universal and transparent ESG standards.

However, the world of sustainability reporting is a confusing and often disparate mass of names and frameworks. They include the Climate Disclosure Standards Board (CDSB), the Global Reporting Initiative (GRI), the International Integrated Reporting Council (IIRC), the Sustainability Accounting Standards Board (SASB) and the Task Force on Climate-related Financial Disclosures (TCFD).

The good news is that a forerunner has emerged that promises to offer a single source of truth when it comes to ESG reporting. It is called the International Sustainability Standards Board (ISSB). The ISSB will do for sustainability reporting what the International Accounting Standards Board (IASB) does for financial reporting. That is, develop standards for companies to report their performance to investors. Both will be under the International Financial Reporting Standards (IFRS) Foundation umbrella.

Where did the new framework originate and what exactly is it?

Created at 2021’s COP26, ISSB will provide a global baseline for high-quality sustainability reporting that supports the work being done in the US by the Securities and Exchange Commission (SEC) and the European Union (EU)’s Corporate Sustainability Reporting Directive (CSRD).

The ISSB is focused on ‘single materiality’ or the ESG information that drives valuation and matters most to investors. This is also the focus of the SEC and so the mandates are consistent. In contrast, the CSRD has a broader ‘double materiality’ mandate, which means it will cover information of interest to stakeholders, even if it is not of interest to investors. Linking the two is the concept of ‘dynamic materiality’, meaning that more light can be shed on ESG issues – such as climate change – moving forwards.

The ideal outcome is that ISSB becomes a global standard which integrates the work of all previous standards and frameworks focused on investor needs. Ideally, the SEC and EU can use its standards. The EU can then top these standards up with those covering double materiality. As dynamic materiality makes these relevant to investors, the ISSB can then take over responsibility for the standard setting process.

How can ISSB success be achieved?

The corporate community has a key role to play in ensuring the success of the ISSB. Investors are increasingly demanding information on a company of interest’s sustainability performance. At the same time, companies are increasingly being accused of greenwashing their sustainability reporting by making it appear more environmentally sound than it is.

Having standards, with proper audits, addresses both issues. That said, it’s important to note that standards aren’t targets for issues like carbon emissions or diversity and inclusion. Rather, they provide credible information on the reporting done by a company on its progress in achieving whatever targets it decides to set, if any.

While ensuring that ISSB is a success, companies can also take steps to secure their own long-term viability. The first way is to participate in the standard setting process. As with financial standard setting, exposure drafts for proposed standards will be published in the public domain. Companies need to join investors in providing their input, including constructive critiques. If a company has an opportunity to participate in any advisory councils and working groups or share its views in comment letters, it should make the effort to do so.

The second approach is to proactively adopt these standards. There will be an inevitable lag between when the standards are published and the country in which the company is headquartered making them mandatory. However, those who wait will likely lose out.

As some companies quickly adopt ISSB’s standards, investor pressure will mount for others to follow suit so they can compare companies’ performance and do their own analysis. Failure to report won’t give a company the benefit of the doubt. Rather, investors will likely assume the worst, all to the possible detriment of the company’s stock price.

Ultimately, the ISSB will make life better for any company which cares about having a sustainable, long-term corporate strategy. Therefore, companies should give their full support to make these standards the best and most accurate they can be.

​“Audit International are specialists in the recruitment of Auditors and various Corporate Governance Professionals including Internal Audit, Cyber Security, Compliance, IT Audit, Data Analytics etc across Europe and the US.

If you would like to reach out to discuss your current requirements, please feel free to reach us via any of the following:
Calling
– Switzerland 0041 4350 830 59 or
– US 001 917 508 5615
E-mail:
– info@audit-international.com”

Amidst issues like supply chain complexity, economic uncertainty, and increased digitalization, Audit International are finding many organizations are adding vendors or changing their existing relationships with those they currently conduct business with.

Working remotely has prompted many companies to add cloud vendors. Supply chain backlogs might have prompted your business to switch to local vendors. Or maybe you’ve added marketing agencies or other types of consultants that have flexible capacity, rather than increasing headcount.

These decisions can help businesses adapt to changing conditions and build resilience, but working with vendors may also introduce new risks. While you might feel like you have a handle on issues like in-house data security processes, you need to be sure that vendors also align with your needs in these areas.

Internal audit teams can play an important oversight role when it comes to vendor risk management. While they might not be making specific vendor management decisions, they can still be involved in making sure proper due diligence is followed when selecting vendors. And once vendor relationships are in place, internal audit teams can monitor these arrangements to ensure organizations aren’t opening themselves up to new risks.

What are the top vendor risk management issues?
Working with third parties like software vendors, managed service providers, cleaning companies, etc. can help businesses fill gaps in current capabilities, increase efficiency, and more. Yet, internal audit teams also need to make sure that their organizations are accounting for any and all potential risks:

Cybersecurity: Internal audit teams should review vendors’ cybersecurity practices to assess whether these meet your organization’s expectations, for example, data security controls and remediation capabilities.

Compliance: Third-party vendors can also create compliance risks, such as improperly storing customer data or engaging in illegal business practices. Even if these vendor issues do not lead to legal action against your organization, internal auditors should aim to get ahead of these issues to avoid reputational damage.

ESG: Environmental, social, and governance (ESG) scrutiny is increasingly extending into supply chains and can also create reputational risk. Internal auditors will want to assess how vendors align with their own ESG goals. This may in turn lead to implementing additional controls, for example, around data sharing practices so that your organization will be able to verify issues like vendor emissions.

Quality: Don’t automatically assume that vendors will provide the quality you’re expecting, even if they come recommended or are widely known. Internal auditors need to ensure that their organizations still conduct proper due diligence to see whether working with that vendor will provide the quality of work you’re expecting. Managing risk can also include looking at vendor performance controls to see if existing third-party vendors maintain appropriate quality standards.
These are just some of the many critical risks that can come from working with third parties. Keep in mind that vendors may also have their own networks of third parties, which could ultimately affect your organization.

While it might not be possible to know every connection point that your vendors have with other third parties, you would likely want to assess what their own third-party risk management practices look like.

How can internal auditors improve third-party risk management?
Internal auditors shouldn’t be the only ones responsible for vendor risk assessments, but they should be mindful of the aforementioned vendor risk management issues and collaborate with other departments to stay on top of these risks.

For example, internal auditors can collaborate with IT leaders to create a vendor security due diligence checklist. From there, internal audit controls can make sure that this checklist is used across all vendor reviews.

Internal audit leaders can also integrate analytics into audit processes, such as collecting performance metrics on third-party vendors, to assess whether they meet your organization’s quality expectations on an ongoing basis.

Too often, however, adding analytics to audit reports is a manual, labor-intensive process that can create its own risks, like data errors. TeamMate Audit Benchmark found 79% of internal audit teams manually leverage data from other applications.

Audit tools like TeamMate+ can help internal auditors get the third-party data they need through automated API exchanges with other platforms, which makes continuous monitoring of risk more feasible. They can then create automated reports to share insights with other departments to stay on top of third-party risk.

By aligning with these steps and staying on top of evolving vendor management risks, internal audit teams can help their organizations stay safe while getting the most out of their third-party partnerships.

“Audit International are specialists in the recruitment of Auditors and various Corporate Governance Professionals including Internal Audit, Cyber Security, Compliance, IT Audit, Data Analytics etc across Europe and the US.

If you would like to reach out to discuss your current requirements, please feel free to reach us via any of the following:
Calling
– Switzerland 0041 4350 830 59 or
– US 001 917 508 5615
E-mail:
– info@audit-international.com”

Here at Audit International this week, we are are all talking about the Chartered Institute of Internal Auditors dropping their ‘Risk in Focus 2023’ report. The report compiles the results of 9 in-depth interviews, 4 round table events with 39 participants, and responses from 834 Chief Audit Executives (CAE)’s from across 15 European countries. In a nutshell, the report has some solid contributors, meaning, the top 10 areas which are concerning other CAE’s, might be worth you thinking about also – especially as you prepare your 2023 annual plan.

The Risk in Focus 2023 report has had a great refresh and shows the movement of each of the risks over the years. This year’s report shows 15 categories worth consideration:

– Mergers and acquisitions

– Health, safety and security

– Communications, reputation and stakeholder relationships

– Fraud, bribery and the criminal exploitation of disruption

– Organisational culture

– Organisational governance and corporate reporting

– Financial, liquidity and insolvency risks

– Supply chain, outsourcing and ‘nth’ party risk

– Business continuity, crisis management and disasters response

– Climate change and environmental sustainability

– Digital disruption, new technology and AI

– Changes in laws and regulations

– Macroeconomic and geopolitical uncertainty

– Human capital, diversity and talent management

– Cybersecurity and data security

The report finds that the greatest movers, in terms of focus / attention given to this particular topic by CAE’s, found the following four categories had the most increased attention and focus since 2020:

– Macroeconomic and geopolitical uncertainty

– Human capital, diversity and talent management

– Supply chain, outsourcing and ‘nth’ party risk

– Climate change and environmental sustainability

This years report also highlights the impact the war in Ukraine has had on many of the businesses and risks highlighted in the report.

For each of the risks, the report provides suggestions on how Internal Audit can help the organisation.

“Audit International are specialists in the recruitment of Auditors and various Corporate Governance Professionals including Internal Audit, Cyber Security, Compliance, IT Audit, Data Analytics etc across Europe and the US.

If you would like to reach out to discuss your current requirements, please feel free to reach us via any of the following:
Calling
– Switzerland 0041 4350 830 59 or
– US 001 917 508 5615
E-mail:
– info@audit-international.com”

At Audit International, we know when people hear buzzwords like ‘data analytics’, ‘artificial intelligence’ and ‘machine learning’, it can be intimidating. Many people don’t fully understand such concepts, but in truth, you don’t need to. You just need to get comfortable with them. And you probably already are: familiar services like Netflix or Spotify use artificial intelligence to understand your preferences and make subsequent suggestions based on that knowledge. The level of consumers’ expectations is continually increasing, and the successful companies are those that are advancing with technology. The same is true for businesses and their expectations. In audit, the revolution is underway and the sections that follow highlight the key drivers for this change.

Improve the audit experience –

The volume of data available to auditors is astounding, but in most cases, this data is simply not being used. If this were happening in any other industry, there would be questions to answer. Data analytics can improve the audit experience in several ways, for both the audit team and for the client.

Improve audit quality-

During the planning phase of the audit, audit teams must shift their focus away from the old mindset of “what could go wrong?” Through analytics, we can turn our attention from what could go wrong to what has gone wrong. Auditors have access to the client’s complete financial data for the period under audit – if they focus on analysing and understanding the data, they could identify an unexpected transaction or trend in the process. During the execution phase, auditors should also build on the knowledge gained in planning to truly understand the business in question and focus their attention on higher risk transactions. Finally, auditors should move away from a ‘random sample’ approach and, instead, focus on the transactions that appear unusual based on their knowledge of the client, business or industry. These are just a few areas where improvements in audit quality can be achieved using data analytics.

Improve efficiency-

In the examples above, the use of data analytics in planning will identify what has gone wrong and any associated unusual transactions. In execution, these transactions will be tested as part of the audit sample. It could also cover some requirements under auditing standards concerning journal entry testing, as the journal entries will likely be the data that highlighted what went wrong in the first place. Again, this is just one example of efficiencies gained without even considering the hours saved by automating processes like creation of lead schedules and population of work papers.

Post-pandemic world-

The world will be a very different place in years to come. Firms with the ability to perform in-depth analysis using data analytics undoubtedly have a significant advantage over those that do not, given the efficiencies they can gain and the potential reduction of physical evidence required from clients, among other things. Due to the changes we have all had to endure, auditors may also have additional procedures to perform (e.g. roll-back procedures where they were unable to attend stock counts at year-end due to the COVID-19 closures of businesses). Such procedures have the potential to be automated, saving even more time and effort for audit teams.

Improve engagement-

Rather than spend time performing mundane tasks such as testing large randomised samples, data analytics allows audit teams to jump into the unusual transactions. This will make the job more interesting to auditors and cultivate a curious and questioning mindset, which will, in turn, lead to improved scepticism and audit quality.

Improve client experience-

This might happen in two ways. First, the time saved by the client’s staff (who, in theory, will have fewer samples for which to provide support) and second, through the value the audit adds to the business. As an example, consider an audit team performing data analysis on the payroll for their client. As payroll is a standardised process, the audit team has an expectation around the number of debits and credits they would see posted to the respective payroll accounts each month. As part of their analysis, however, they find an inconsistent pattern. This can be queried as part of the audit and the client will be better able to understand a payroll problem, which they were previously oblivious to.

Client expectations-

Given the level of data analysis that occurs daily in the life of anyone using a smartphone, a consistent, high quality is understandably expected in people’s professional lives, too. Audit clients, like all consumers, want more. They want a better and faster audit. They want an audit that requires minimal interference with the day-to-day running of their business, without compromising the quality of the auditor’s work. With troves of data now available to auditors, such expectations are not entirely unreasonable. Audit firms have access to vast amounts of financial and related data – in some instances, millions of lines of information – that, if analysed robustly and adequately, would improve their processes, their clients’ experience, and the quality of their audit files.

Aspirations of professionals-

Audit professionals can often struggle with work-life balance, as we here at Audit International know. Though most firms are getting on top of remote working, the hours in busy season are long. In a time of continuous connectivity, the time frame around ‘busy season’ is also becoming blurred. Through the use of technology, we will one day make auditing a ‘nine to five’ job. Many will scoff at that idea and, although we do not expect this to happen in the next five years, or even ten years, it is possible. By automating mundane tasks and continuously upskilling our graduates, we can transform how an audit team completes work. There will be more scope to complete work before clients’ financial year-ends, thus moving much of the audit out of the traditional ‘busy season’. Machines can complete specific tasks overnight so that auditors could arrive at their desk, ready to work on a pre-populated work paper that needs to be analysed by a person with the right knowledge. With appropriate engagement by all parties (i.e. audit teams, senior management, and audit clients), we could significantly reduce the hours spent on audit engagements and give this time back to auditors. Along with attracting high-calibre graduates, we will retain high-quality auditors in the industry while also avoiding mental fatigue and burnout, which will again lead to better quality audits.

Graduate recruitment-

Graduates joining firms in recent years have particular expectations of the working world. They want job satisfaction, flexible hours, remote working, and an engaging role that will challenge them. Professional services firms have to compete for the very best graduates, and no longer just against each other – a host of technology-enabled businesses are attracting talent on an unprecedented scale by meeting the needs listed above. Technology, and data analytics, in particular, can offer the solution to the graduate recruitment challenge – by making the work more efficient and automating mundane and repetitive tasks, graduates can instead focus on analysis. Time and time again, when we talk to candidates, we always hear that if they find their work challenging and interesting, they will feel more engaged.

Challenges-

This move towards technology is not without its risks to the profession. Automating basic tasks removes the opportunity for graduates to form a deep understanding of these sections of the audit file. The onus is therefore on the current cohort of Chartered Accountants to take the reins, both to drive technology advancement forward and also provide practical, on-the-job coaching to ensure that this knowledge is not lost for the generations that follow.

“Audit International are specialists in the recruitment of Auditors and various Corporate Governance Professionals including Internal Audit, Cyber Security, Compliance, IT Audit, Data Analytics etc across Europe and the US.

If you would like to reach out to discuss your current requirements, please feel free to reach us via any of the following:
Calling
– Switzerland 0041 4350 830 59 or
– US 001 917 508 5615
E-mail:
– info@audit-international.com”

Have you ever had one of those days where you were determined to write that audit report? So you block off the time on your calendar, go into your office, shut the door, remove any and all distractions and breathe. Because now is the time to take all of those thoughts and perfect phrases running wild in your head and put them on paper. You sit down at your desk ready to make it happen. And you come up with nothing.

You decide to invite a colleague in to assist. Because after all, two heads are better than one. The two of you discuss the issues thoroughly, but nothing seems to sound right.

Writing objective observations takes time, skill, and tact. And if you’re like any other auditor, the audit issues sound wonderful in your head. But by the time you formulate the right words, reach for your pencil and place it on paper, that wonderful wording has become a distant memory. It’s worse if you’re in a group setting because you now become frustrated as the group begins asking you to repeat what you said. Unable to remember words uttered only seconds prior, it is only then that you realize how old you truly are.

If you’ve ever faced this situation, do not fear. There are several tools and techniques you can use to speed up and improve your report writing. But first, we must address the five big problems with writing reports:

1. We think faster than we write
2. Our million dollar thoughts come at the wrong time
3. We believe in writer’s block
4. We look for perfection in the first paragraph
5. We don’t understand and/or appreciate the writing process

5 Problems with audit report writing
We think faster than we write
We’ve all been there. Browsing through our cabinets trying to make a mental grocery list. Then you reach the point where there are too many items to remember. You decide to write a list. You reach for your paper and before the pen touches the pad, you’ve already forgotten the five items you wanted to write.

Our brains are fascinating. I can remember where I was in the summer of 1989, but I cannot remember what I ate for breakfast this morning. It is that forgetfulness that can derail your report writing.

Our million dollar thoughts come at the wrong time
Worse yet is when you have this wonderful idea, but then realize that it is 5:00 o’clock and you are stuck in traffic. There is no way you can capture that great thought without causing a pile up. So you try other techniques. You turn off the radio and repeat whatever it is over and over. You hope to continue this until you get home, or at least until you get to a stopping point. Of course something interrupts your thought and you forget what you were trying to remember.

We believe in writer’s block
Some people believe that writer’s block is a thing. I’m here to tell you, it is not. At least in the context of business writing or internal audit reports. Wikipedia define writer’s block as follows:

“Writer’s block is a condition, primarily associated with writing, in which an author loses the ability to produce new work or experiences a creative slowdown. This loss of ability to write and produce new work is not a result of commitment problems or lack of writing skills. The condition ranges from difficulty in coming up with original ideas to being unable to produce a work for years. Writer’s block is not solely measured by time passing without writing. It is measured by time passing without productivity in the task at hand.”

As you can see, writer’s block is a primary concern for creative writers. Our audit reports are, or should be, factually based non fiction. We are taking a series of facts, placing some logic and order to those facts, and providing management with a conclusion. What we are not doing, is creating new characters or developing plots and story lines. We know the beginning, middle and end of the story. Therefore, we know what to say. The problem is how do we say it so that it has the best impact given within the culture of the organization.

We look for perfection in the first paragraph
Because audit report writing is simpler than creative writing, we believe that we should be able to sit down and create the perfect prose in minutes. After all, we know the beginning, middle and end of the story. When we finally put pen to paper, our initial draft is usually not good. We then become frustrated. But I believe that frustration is because we don’t understand the writing process.

We don’t understand and/or appreciate the writing process
All the magic happens in the editing. Any writer will tell you this. Ernest Hemingway famously once said that “The first draft of anything is ****” (insert a very bad word here). As someone who has had articles published, I can tell you this is true. I can recall the first time I sent something to an editor. I thought it was an okay piece. But what came back was a magnificent manuscript. I fined tuned it a little and the result was something we were all pleased with. The writing process does not require perfection at the start. Your initial goal is to get something on the page. After that, trust the process and let the magic happen in editing.

3 tools you can use
Google voice typing
Because our brains seem to signal our mouths to speak faster than our hands can write, voice typing is the perfect shortcut to getting those wonderful words out of your head and on paper. For those unfamiliar with voice typing, you talk, it types. It’s as simple as that. Well, sort of.

The best free voice typing tool I’ve found is through Google. Log in to your account. Then, access Google Docs and open a document. Go to Tools, then Voice Typing (or you can press Ctlr+Shift+S).

You will see a microphone that may say Click to Speak. Click it, talk to it, and watch the magic happen. You will need to learn certain commands like period, comma and new paragraph. But other than that, if you speak clearly, it will recognize most speaking voices and words.

Your Cell Phone voice recorder
If barking out commands to your computer isn’t your thing, you’re in luck. There’s another option. If you’re like me, your cell phone is probably within arms reach. Grab your phone and go to your favorite app store. Search for a voice recorder. You should see several. Download one that piques your interest.

You can now record yourself talking about the audit issues. Now you will never miss that wonderfully worded paragraph that would sound great in an audit report. Once recorded, you can listen to the recording and pull out the impactful paragraphs.

Transcription
If you truly believe the recording represents your best work ever, you can have it transcribed. Yes, you heard me, transcribed. It’s not as bad or as expensive as you think. Before I get into that, I must say that I am not being paid by nor am I endorsing these specific products. there are several transcription services that I have used. Some use live transcribers while others use automated engines.

Summary

Writing audit reports can be a daunting task. But it has to be done. Nowadays we have a lot of tools that can help streamline the process. Many of the biggest issues start with us. Writer’s block is only as real as we allow it to be. Sit down and put something on paper. Use some electronic tools to get your words on paper. Almost any words will do. Afterall, the magic happens in the editing.

“Audit International are specialists in the recruitment of Auditors and various Corporate Governance Professionals including Internal Audit, Cyber Security, Compliance, IT Audit, Data Analytics etc across Europe and the US.

If you would like to reach out to discuss your current requirements, please feel free to reach us via any of the following:
Calling
– Switzerland 0041 4350 830 59 or
– US 001 917 508 5615
E-mail:
– info@audit-international.com”

This week Audit International are taking a look at the 4 ways how Internal Audit can get a seat at the table.

When it comes to risk management and compliance, most organizations operate on a 3 Lines of Defense (3LOD) model, in which operational management, compliance, and internal audit work together in tandem to assess and mitigate risk and manage controls and compliance.

This model may be successful in theory, but as the risk management and compliance functions have grown more complex, it doesn’t always work as well as you might hope. Given the rising sophistication of cybersecurity threats and incidents of fraud, and the increasing compliance requirements posed upon organizations of all sizes, it can be difficult to keep an organization-wide pulse on threats and breaches in compliance as they arise.

The problem is, the three branches don’t always collaborate effectively, which may leave internal audit out of the loop and unable to provide much value to the organization. They may not have access to the data they need to generate effective recommendations. The internal audit team’s focus may be simply on checking boxes and ensuring compliance, rather than providing strategic insights that will help your organization understand and take steps to mitigate new threats.

If you want your internal audit team to move the needle at your organization, you need to get the ear of executives who can advocate for your work. By partnering with leadership, you’ll be able to spearhead new initiatives and gain critical access to data that will help your organization save money and reduce risk, proving your team’s value.

Here are four strategies for doing that effectively:

Identify the key people who can support you, and make a plan to build relationships with them
Your audit team will naturally be in touch with the managers who can provide key information needed to conduct your audits—but by focusing only on these contacts, you’re missing out on building relationships with the leaders who will be able to help you gain a more visible role in the organization. Build a plan for conducting periodic outreach to higher-level executives within your organization, such as your chief risk officer or your CTO. You can solicit feedback from them on any open questions they may want your team to review in your audits, or provide high-level executive briefs showcasing work that you’ve done and issues they may want to explore in further detail. Make sure that they know you and your team are available to support them and open for feedback.

Proactively address organization-wide trends
Rather than focusing solely on issues identified in individual audits, start looking at your audit results in aggregate to identify trends. Is a single department or office location having trouble resolving a specific compliance issue, or is it an across-the-board trend that should be shared with your executive team? Review your data frequently to understand risks that should be mitigated, and come up with step-by-step action plans for how they should be addressed, including who’s responsible and what the benchmarks for success are.

Pay close attention to third-party risks
Many audit teams take an insular view of risk management, failing to uncover the external risks brought on by vendors and technology partners. Make sure that you have policies in place to carefully vet and automate compliance on your third-party vendors, pulling in external data that will alert you to any financial or legal issues they may face. Regularly track all of your solutions and technology partners for red flags, and ensure that you have a strategy for mitigating them. You can showcase your findings in sessions with executives and other partners throughout the business, and collaborate to come up with a plan for any of your scenarios. Keep in mind that risks from big providers such as Amazon or Facebook may impact a lot of your customers or partners as well, so ensure that you map out all of the variables that may impact your company’s business model across the board.

Use best-in-class GRC technology to automate compliance and analyze data
In order to provide the most useful insights to your leadership team, it’s important to integrate your entire risk management function across an easy-to-use GRC platform. Your GRC platform should come with pre-built content that will help you automate your controls framework, regardless of your industry. It should make it easy to monitor compliance status and risk levels across the organization at any given time, with triggers prompting action when control levels are not being met. You should be able to easily drill down into your data and generate executive dashboards, so that you can share insights to justify recommendations and help your leadership team make better informed business decisions.

By building a cohesive strategy for integrating with the 3LOD, backed by in-depth data analytics, real-time data feeds, and workflow automation, your audit team will be able to generate insights that can help to identify new risks, and develop new strategies for mitigating risks across the entire organization. This will help you to become a highly visible, influential, and trusted partner to the business.

“Audit International are specialists in the recruitment of Auditors and various Corporate Governance Professionals including Internal Audit, Cyber Security, Compliance, IT Audit, Data Analytics etc across Europe and the US.

If you would like to reach out to discuss your current requirements, please feel free to reach us via any of the following:
Calling
– Switzerland 0041 4350 830 59 or
– US 001 917 508 5615
E-mail:
– info@audit-international.com”

Audit International were in awe to hear this revolutionary news from the billionaire founder of the outdoor fashion brand Patagonia. He has announced just yesterday he is giving away his company to a charitable trust.

Yvon Chouinard said any profit not reinvested in running the business would go to fighting climate change.

The label has amassed a cult following due to sustainability moves like guaranteeing its clothes for life and offering reasonably priced repairs.

The brand’s website now states: “Earth is now our only shareholder.”

Mr Chouinard has always said he “never wanted to be a businessman”.

A rock climbing fanatic, he started out as making metal climbing spikes for himself and his friends to wedge into rocks, before moving into clothing and eventually creating a hugely successful sportswear brand with a cult following.
Founded in 1973, Patagonia’s sales were worth around $1.5bn this year, while Mr Chouinard’s net worth is thought to be $1.2bn.

He claimed that profits to be donated to climate causes will amount to around $100m (£87m) a year, depending on the health of the company.

“Despite its immensity, the Earth’s resources are not infinite, and it’s clear we’ve exceeded its limits,” the entrepreneur said of his decision to give up ownership.
The Californian firm was already donating 1% of its annual sales to grassroots activists and committed to sustainable practices. But in an open letter to customers, the apparently reluctant businessman said he wanted to do more.

Mr Chouinard said he had initially considered selling Patagonia and donating the money to charity, or taking the company public. But he said both options would have meant giving up control of the business and putting its values at risk.

Instead, the Chouinard family has transferred all ownership to two new entities. The Patagonia Purpose Trust, led by the family, remains the company’s controlling shareholder but will only own 2% of its total stock, Mr Chouinard said.

It will guide the philanthropy of the Holdfast Collective, a US charity “dedicated to fighting the environmental crisis” which now owns all of the non-voting stock – some 98% of the company.

“Each year the money we make after reinvesting in the business will be distributed as a dividend to help fight the crisis,” Mr Chouinard said.
Patagonia combines high-end outdoor fashion with its own brand of environmental and social activism. It’s a heady combination that certainly appeals to a loyal, if predominantly well-heeled following.

Part of the attraction comes from the fact that its environmentally conscious stance isn’t new. It was preaching eco-awareness years before sustainable fashion became fashionable.

But it’s still pretty hard to save the planet, if your business depends on selling stuff, however many recycled or renewable products you use.

By ringfencing future profits for environmental causes, Patagonia’s founder Yvon Chouinard has done his best to square that circle.

But he is also clearly trying to ensure that Patagonia brand is future-proofed and can never fall into the hands of the kind of companies he has accused of greenwashing in the past.

It’s nice to bring a good news story to you readers, and it will be interesting to see if any other climate conscious companies will follow suit. The bar has well and truly been set.

“Audit International are specialists in the recruitment of Auditors and various Corporate Governance Professionals including Internal Audit, Cyber Security, Compliance, IT Audit, Data Analytics etc across Europe and the US.

If you would like to reach out to discuss your current requirements, please feel free to reach us via any of the following:
Calling
– Switzerland 0041 4350 830 59 or
– US 001 917 508 5615
E-mail:
– info@audit-international.com”

Audit International are aware that public sector organizations face a variety of risks, ranging from cyber threats to budget constraints to compliance concerns. While internal audit teams in the government sector might not be responsible for solving all those risks, they need to make sure that they are following through with relevant risk management protocols.

Therefore, it is essential that internal audit teams are conducting internal audit risk assessments to figure out what these risks look like.

“Risk-based auditing ensures that the internal audit activity is focusing its efforts on providing assurance and advisory services related to the organization’s top risks… This requires internal auditors to have a working knowledge of basic concepts, frameworks, tools, and techniques related to risk and risk management,” explains the Institute of Internal Auditors (IIA).

In this article, we’ll examine five tips to help public sector internal auditors build better risk-based audit plans. These include:

1) Define your goals
Before you get too bogged down in the specifics of running an internal audit risk assessment, take a step back and consider what you’re trying to accomplish. Doing so includes finding internal alignment within your audit team and with other stakeholders.

As Baker Tilly advises, internal audit teams “should meet with the various stakeholder groups – management, the audit committee, and the governing body – to explain the process, set expectations for the results and listen to any desired outcomes, as a means of adapting the approach or identifying other activities where internal audit can add value.”

2) Organize your data
Conducting an internal audit risk assessment also requires strong data practices. But before you can get to a place where you are using data analytics to identify key risks, public sector organizations often need to organize their data first.

Information might be held in a variety of systems that makes analysis inefficient, if not ineffective. Tools like TeamMate+ use a data exchange API framework to pull together data from different sources, such as governance, risk, and compliance (GRC) systems and enterprise resource planning (ERP) tools, giving you a complete picture of what’s happening within your organization.

3) Get agile
If you go through an entire risk-based audit without getting any feedback along the way, then it’s easy to get off track. For one, risks might have changed from the time the audit started to when it eventually wraps up. And when you present to stakeholder leaders at the end of the risk assessment, it can be tough to then incorporate their feedback into your internal controls and assurance processes.

Engaging in agile auditing can help. By breaking an internal audit risk assessment down into more manageable chunks — where different risk areas go from the planning to presentation stages in short sprints — public sector internal auditors may have an easier time adapting to change and incorporating feedback.

4) Go dynamic
Agile auditing creates a dynamic internal audit risk assessment. Instead of approaching these assessments as an annual occurrence, you can review public sector risks on more of an ongoing basis.

That means collaborating with other departments throughout the year to keep up with emerging risks, which is where good data-sharing practices also come in handy. Dynamic or continuous risk assessments can also result in more frequent reporting so that you can keep everyone in the loop and get their timely feedback. Having a strong internal audit risk assessment tool like TeamMate that can help you simplify risk scoring and create efficient audit reports makes a big difference.

5) Keep up with public sector requirements
Lastly, working in internal audit in the government sector means staying on top of general risks like cybersecurity and financial concerns, along with meeting specific public policy guidelines and regulations. Public sector internal auditors often turn to sources like Wolters Kluwer, which provides resources like webinars and other Expert Insights so you can learn what you need to do to strengthen internal audit as a government organization.

Following these five tips can go a long way toward creating a strong internal audit risk assessment and a better audit process overall. Even if it seems like your organization doesn’t face many risks, conducting a risk-based audit can help you stay on top of any changes to your risk level. Rather than being caught off guard, building a reliable internal audit risk assessment plan can help your organization control risk, however that takes shape.

“Audit International are specialists in the recruitment of Auditors and various Corporate Governance Professionals including Internal Audit, Cyber Security, Compliance, IT Audit, Data Analytics etc across Europe and the US.

If you would like to reach out to discuss your current requirements, please feel free to reach us via any of the following:
Calling
– Switzerland 0041 4350 830 59 or
– US 001 917 508 5615
E-mail:
– info@audit-international.com”

The world of internal audit continues to advance. In recent years, audit teams have increasingly used data analytics and cloud technologies to increase efficiency and improve assurance. Now, emerging technologies like AI and robotic process automation (RPA) are further making their way into internal audit. Audit International take a look at what effect this will have on Internal Audit and Financial Services in the future.

It’s still early days, but the trend toward automation is clear. In fact, when asked about emerging technology, 20% participants of a recent audit teams survey said they’re already using RPA. In addition to that, 12% said they’re using AI, 3% said they’re using blockchain, and 15% said they’re using more than one type of emerging tech.

These technologies, particularly RPA, have the potential to enhance audit quality. For example, RPA can enable internal audit teams to spend more time collaborating with other departments and sharing results with boards, rather than getting bogged down in repetitive, less strategic tasks.

And in data-centric industries like financial services, these technologies can make a particularly large impact, as we’ll examine in this article.

What is RPA?
Physical robotics can perform motions that automate repetitive tasks, like putting a cap on a bottle or moving a box from one place to another. Similarly, RPA automates repetitive tasks, but the difference is that RPA is centered around software, not hardware.

“Robotic process automation (RPA), also known as software robotics, uses automation technologies to mimic back-office tasks of human workers, such as extracting data, filling in forms, moving files, et cetera. It combines APIs and user interface (UI) interactions to integrate and perform repetitive tasks between enterprise and productivity applications,” explains IBM.

What does RPA mean for internal audit?
One way that RPA can be used for internal audit is to make data-related tasks more efficient.

“If we cut to the chase, the job is straightforward: we download data, analyze it, and use it to discuss processes and controls…The issue is that we waste a lot of time obtaining and formatting data for each audit—the same tables and charts repeatedly,” writes Jean-Marie Bequevor, Expert Practice Leader Internal Audit at consultancy TriFinance, in an article for Internal Audit 360°.

RPA can also help to automate periodic reporting. If you know certain information is needed in every report, then an RPA program could potentially be set up to obtain and fill that information.

That said, RPA can also carry risk, both in terms of the use of RPA in audit programs and the use of RPA across other departments. Internal auditors need to consider RPA internal controls to make sure that RPA is being used appropriately. You wouldn’t want to end up with a misprogrammed bot that creates errors or security holes.

What does RPA mean for financial services?
In addition to being used for auditing, RPA can also play a role in corporate finance and the financial services industry more broadly.

Finance professionals — ranging from corporate treasurers to wealth managers to mortgage lenders — deal with large quantities of data. With RPA, financial services professionals can automate data-related processes like data collection, data cleansing, and analysis.

For example, an investment analyst might use RPA to improve their research process. Instead of manually creating and assembling a clean spreadsheet full of financial data, an RPA tool could automate that, freeing up time for the analyst to engage in more complex, nuanced tasks.

RPA in financial services can also help when it comes to client service and marketing tasks. For example, banks could automate activities like identifying customers that are a good fit for credit card offers or loan products. Rather than sending out these offers to all customers or manually reviewing every client file, an RPA program could be set up to compile a list of customers that meet certain criteria.

These are just a few of the many ways that RPA can be used in financial services and internal audit in general. A repetitive, data-oriented business process tends to be a good candidate for RPA. Many of these types of tasks exist in the financial services industry in areas ranging from compliance to customer onboarding.

With automation, financial services firms can free up time and focus on higher-value work, like building customer relationships and identifying new revenue opportunities. Meanwhile, internal audit professionals can use RPA to efficiently provide assurance.

“Audit International are specialists in the recruitment of Auditors and various Corporate Governance Professionals including Internal Audit, Cyber Security, Compliance, IT Audit, Data Analytics etc across Europe and the US.

If you would like to reach out to discuss your current requirements, please feel free to reach us via any of the following:
Calling
– Switzerland 0041 4350 830 59 or
– US 001 917 508 5615
E-mail:
– info@audit-international.com”

Audit International recently came across a very interesting article, on improving Internal control systems, in the Wall Street Journal, and thought we’d share it with you.

Increasing business complexity and regulatory requirements are driving continual change to the risk environments for many organizations, and historical approaches to risk and controls may not be suited for the current atmosphere of digital transformation, persistent change, and uncertainty. As the business landscape continues to evolve, the risk of accounting and reporting misstatements rises, often due to the inability to respond to internal and external circumstances and adapt quickly to business changes.

Developing an internal controls framework with upgraded operating models, advanced technology integration, and new processes to monitor, implement, maintain, and optimize a risk and reporting structure can position an internal control program to stay ahead of risk and increase value. First, we will explore some of the internal and external factors driving challenges beyond traditional remediation and restatements in accounting and reporting, including considerations receiving attention from the SEC and AICPA. These critical change drivers, along with internal controls and automation opportunities, inform a new risk and controls framework empowered by more proactive and data-driven solutions.

External Factors Driving Remediation and Restatements

Remediation and restatement drivers include external challenges such as new accounting rules; the SEC and regulatory guidance; and environmental, social, and governance (ESG) reporting. Some of these external drivers were highlighted at the recent AICPA conference and featured prominently in recent SEC comments—including SEC reporting and rulemaking, ESG matters, auditor independence, and digital assets.1 2

Data quality and the importance of modernized reporting supported by new technology were prominent features at the AICPA conference, with an emphasis that organizations evaluate their standards, processes, and technologies to create accurate and easily accessible reports. In addition, responding to market demand for ESG information was a key theme throughout the conference and SEC comments. ESG is the universe of topics that reflect areas of performance management around the impacts and dependencies of the business on society and the environment. It is a dynamic and interactive process that will likely have far-reaching implications for an organization, and the overlap between sustainability and financial reporting is inherent. Still, given the scope and possible market share of ESG activities and resulting data volume, multiple possibilities of future regulatory requirements may cause uncertainty around developing a new reporting framework that can mitigate remediation and restatements and optimize the controls environment.

Internal Controls and Automation Opportunities

Understanding both the external and internal drivers to risk and reporting structures helps inform the structure of a new internal control program to be more resilient, efficient, and agile through a changing risk profile. In addition, developing the new program using a change framework that identifies what to monitor, implement, maintain, and optimize in the controls program implementation may further enable a more resilient and efficient framework.

In addition to the external challenges to remediation, addressing internal challenges and opportunities is also necessary when developing the new control program. Disruptions from new technology and digital transformation are potential examples of prevailing internal challenges that may lead to restatements and remediation. However, the digital transformation also enables opportunities with automation, enhanced analytics, artificial intelligence, and data-driven solutions for the evolving risk and controls landscape and reporting lifecycle.

Automation Opportunities Across the Reporting Lifecycle

Process automation—includes manual, repetitive, rules-based processes and enables transaction automation, dynamic data manipulation, and streamlined communication. Examples include report generation, data reconciliation, and trend tracking.
Shared services process automation—includes processes with multiple interactions across different systems that enable process synergies. Examples include payroll, onboarding, education and training, and IT functions such as infrastructure, directories, and file management.
Outsourcing process automation—can be built for outsourcing contracts using robotic process automation (RPA) solutions. Examples include reconciliations, claims processing, inventory processing, production support, and network monitoring.
Developing a New Internal Controls Program

This five-step guide to developing a new internal controls framework can be considered to help address the external and internal challenges and utilize automation and data-driven solutions to move a control program forward and reduce the chances of accounting and reporting remediation throughout the transformation.

Conduct dynamic risk assessment and scoping updates that are periodically refreshed to remain agile, identify fraud risk considerations, and create a communication plan.
Develop internal control program methodologies, update operating models, and ascertain control owners and operators, including areas to automate.
Introduce technology to help automate and monitor the control environment and obtain electronic evidence with data and analytics.
Establish automated control methodology, develop a digital testing approach to control automation, and evaluate and update protocols for data security and cybersecurity.
Lead with the process, data, and user experience, all enabled by advanced analytics, data visuals, automation, and intelligent technology integrated within the framework.
Potential Benefits of an Updated Control Framework

Using remediation and restatement drivers to create a modernized controls framework may offer benefits beyond mitigation of risks in controls reporting. Developing a framework for a changing risk profile built on a foundation of new technology elevates the quality of reporting by increasing transparency and visibility into business processes with meaningful insights into managing risks. These deeper insights allow the function to refocus efforts and move away from point-in-time solutions to address issues continuously with more transparent monitoring and visualization capabilities.

“Audit International are specialists in the recruitment of Auditors and various Corporate Governance Professionals including Internal Audit, Cyber Security, Compliance, IT Audit, Data Analytics etc across Europe and the US.

If you would like to reach out to discuss your current requirements, please feel free to reach us via any of the following:
Calling
– Switzerland 0041 4350 830 59 or
– US 001 917 508 5615
E-mail:
– info@audit-international.com”