🔍
Definitions, Focus, and Outlook | Fundamentals of Internal Auditing | Part 2 of 44 - YouTube
Channel: unknown
[0]
Welcome to the Fundamentals of Internal Auditing.
[2]
I’m Hernan Murdoch.
[3]
In this episode,
[4]
you will learn about the definition of internal auditing,
[7]
how internal audit relates to the three lines of defense,
[9]
and career prospects in this very exciting field.
[20]
With me today is Kathleen Crawford.
[22]
She's a subject matter expert on all things internal auditing,
[25]
lots of experience in financial services and other industries
[28]
and she's going to help us better understand internal auditing
[32]
and some other very important things about this profession.
[34]
Welcome, Kathleen.
[36]
Thanks, Hernan. Good to be here.
[38]
Well, as Hernan mentioned, we're going to hear first
[41]
about the definition of internal audit.
[44]
This definition was adopted
[46]
by the Institute of Internal Auditors,
[48]
which is the professional organization that we all work under,
[52]
whose standards we apply, whose guidance we follow.
[56]
This definition went into effect in 2002.
[61]
We have a few different phrases
[64]
that are bolded for added emphasis.
[67]
I will read the first line
[69]
and talk about the emphasis in the first line.
[71]
So, internal auditing is an independent objective assurance
[75]
and consulting activity designed to add value
[79]
and improve an organization's operations.
[83]
You'll notice that independent is something that is emphasized,
[88]
that's because internal auditing is within the context
[92]
of belonging to an organization, but it is set apart
[96]
so that it can maintain its independence and its objectivity.
[101]
You'll also see…
[102]
Kathleen when you say, you see that independent
[104]
does that mean that in the organizational chart
[106]
then as you were to take a look at it,
[108]
you will see not over some operational area,
[111]
but rather that it will be some off to the side reporting
[114]
to different parties within the organization.
[116]
- Is that right?
- Absolutely.
[118]
In fact, usually, the reporting chain
[120]
is very, very high up in the organization.
[123]
First, reporting relationship to a member of leadership
[128]
and a very, very important reporting relationship
[130]
to the audit committee of a board of trustees
[133]
or a board of directors
[134]
or whatever the highest pinnacle of leadership.
[139]
So yes, that structural consideration
[143]
really helps with independence and objectivity.
[146]
Great, thank you.
[147]
Sure. The other thing…
[149]
and Hernan, you remember when this happened too,
[153]
the split of assurance and advisory work.
[158]
Concurrent with this definition,
[161]
the IIA came into an understanding
[165]
that its membership was interested
[168]
in some kind of guidance
[170]
to allow these auditors all around the world
[174]
to allow them to employ some consulting
[179]
as opposed to providing just assurance.
[181]
So, assurance and advisory became sort of a DNA
[185]
or a twin strand of DNA in auditing in 2002.
[190]
And it's very much true now.
[192]
That helps a lot so that kind of the starchy
[197]
or boring image of internal auditors of just checking numbers
[200]
and spreadsheets and Ledger's and reports,
[202]
that’s the assurance side.
[204]
But then you have the exciting side
[205]
- with the consulting, right?
- Yes, indeed.
[207]
In fact, but I would also argue
[210]
that the green eyeshade of assurance is a thing of the past.
[214]
Assurance is pretty neat too.
[220]
Yes. It's certainly comforting.
[221]
It's comforting to have someone
[223]
who is outside of the functioning of an area,
[227]
process, or system, weigh-in on whether or not
[230]
things are going as intended by management,
[233]
whether it's assurance or consulting.
[235]
And that's why it says and consulting not or consulting.
[238]
Correct.
[239]
Both roles are equally important.
[240]
Absolutely, absolutely, correct.
[244]
And we talked about this in later episodes,
[249]
I think we'll bring some real context to that
[252]
so that people who are listening in will have an appreciation
[255]
for it's not an either-or kind of situation,
[258]
but in certain circumstances,
[260]
leadership might want us to weigh in on something,
[264]
be it a system that's under development,
[267]
or a particular way of doing things
[271]
and that's more of advisory
[273]
or that less of assurance type of arrangement.
[279]
One of the things that I really like about the definition too
[281]
is that it says, “Add value.”
[283]
I know a lot of times people think about internal auditors
[286]
as just being their unnecessary evil of sorts,
[288]
but when you think about adding value,
[290]
then that really sets the pace
[293]
for what internal auditors need to do and think
[295]
in terms of how can we help the organization, right?
[297]
So, adding value and helping is also part of the definition.
[301]
Can you elaborate on helping management
[303]
- and what does that entail?
- Absolutely.
[305]
In fact, I can probably elaborate with an example.
[309]
A number of years ago, I was asked to evaluate
[314]
how the non-profit that I worked for at the time
[317]
was using its overtime.
[319]
It's pretty standard in the field that I was in
[324]
that they had to use overtime a lot for direct care workers,
[328]
because ordinarily, the work doesn't pay particularly well.
[333]
We went in looking at it first
[336]
from a perspective of cost savings,
[339]
but then later realized that all these extra hours of overtime
[344]
were made by necessity because this was an organization
[348]
that was very, very spread out geographically.
[353]
And so, it wasn't so easy to get a phone call
[356]
and be able to say,
[357]
“Yes, I can be there for the three o'clock shift,”
[360]
because of geographic distance.
[362]
So, what we did instead,
[363]
was to look at could they set up pools of employees?
[368]
And might that make it easier for them
[371]
to identify part-time workers and per diem workers
[374]
that might be able to step in at a moment's notice?
[377]
And that was very, very different in terms of,
[380]
“You're spending too much money and overtime.”
[383]
Instead of slapping them on the wrist,
[385]
we gave them some information
[388]
that they could decide how they were going to use.
[390]
And that was more in the vein of adding value.
[393]
That's great.
[394]
That’s a great story. I like that.
[395]
That's very illustrative of what this is all about.
[398]
Now, one of the things that the definition also talks about
[402]
is helping achieve objectives.
[403]
So, what you highlighted is one of those objectives
[405]
about minimizing expense and so on.
[408]
So, helping the organization achieve its objectives.
[410]
What are some of the key questions
[412]
that internal auditors need to get accustomed
[414]
to asking with every engagement that’ll help them
[417]
really drive their mindset and focus
[419]
on what they need to focus most.
[421]
For me, the three questions are whether or not systems,
[426]
processes, or functional areas are working
[428]
as intended by management.
[430]
If not, why not?
[433]
So, are these different areas of the business,
[437]
the procedures, the policies.
[440]
The design might be fine,
[442]
but management believes and intends something
[445]
when they set up these systems and policies
[448]
and we can go in and basically assess
[452]
and opine on whether or not
[454]
those things are working as intended by management.
[456]
So, that's the first question that needs to be answered.
[460]
I think the second is,
[462]
by far the more important of these questions.
[466]
If not, why not?
[468]
So, if something is not working as intended,
[470]
why is that the case?
[472]
Or why is that not the case?
[474]
So, back to the overtime story that I told you.
[476]
We could have said,
[478]
“Yes, you're spending X percent of funds on overtime
[483]
and this person over here is getting, you know,
[486]
20 hours a week, extra overtime,
[489]
and this one is getting 50 hours a week, extra overtime.”
[492]
But there was a fundamental breakdown
[496]
or an unanticipated consequence of that regional disparity.
[501]
So, why are things not working as intended?
[504]
Once you start to dig into that…
[507]
That's a very powerful question.
[509]
And I know how important it is in the audit field to ask why.
[514]
Don't just take things on the surface level, but dig in a little bit.
[516]
- Exactly.
- So, that's great.
[518]
And I like your illustration as well.
[519]
How about the third question?
[520]
You said there were three.
[521]
Yes. So, the third question is, if not, so what?
[526]
We encounter situations all the time
[529]
where the policy or procedure says
[531]
a particular thing happens in a particular order,
[534]
or to a particular depth, and that's fine on the surface,
[539]
but sometimes what we find is that
[541]
there has been an adaptation over time.
[544]
So, the policy or procedure may not be the letter
[548]
of how it was written down in the first place.
[551]
So, I like to add that third question
[553]
so that auditors realize that this is not about perfection.
[558]
This is about adaptation.
[560]
And we're not going to slap people on the wrist
[562]
for doing something that is better
[564]
than maybe it was originally designed to be.
[567]
So, that so what question really matters to me too.
[571]
I like that.
[572]
Put things into perspective, right?
[575]
Yes, so as far as the three lines model,
[579]
I understand that it was revised recently.
[582]
So, can you walk us through that new rendition of that model
[585]
and implication for internal auditors?
[587]
Sure. Well, as you can see on the graphic,
[590]
the three lines model covers the roles
[593]
and responsibilities of a governing body,
[595]
the roles and responsibilities of management,
[598]
and the roles and responsibilities of internal audit.
[601]
There is intentionally a loop of communication
[605]
that operates between all three or among all three.
[609]
So, internal audit has that reporting relationship
[613]
up to the governing body.
[614]
It is expected that we have that position
[618]
and I referred slightly to that earlier.
[621]
We also need to have a common ground
[624]
and common communication with management as well.
[627]
So, the three lines means that a governing body
[632]
sets the tone, sets the policy,
[634]
sets the expectations, and management carries it out.
[639]
Internal audit will come in
[641]
and based on risk assessment,
[645]
which is a topic we'll speak about at length in another episode.
[649]
Through risk assessment,
[651]
determines what they have the bandwidth
[653]
to look at over a particular time horizon based on risk.
[657]
So, we'll be reviewing the areas, processes, and systems
[662]
that management is responsible for,
[664]
and communicating with them as we expect them to be
[668]
communicating up to higher leadership as well.
[672]
So, the dynamics are that the governing body
[676]
of the top issues guidance and provides resources,
[681]
and sets the pace and the direction of the organization.
[683]
So, that's going down.
[684]
Management and the different units
[687]
that are running the organization
[688]
are going to do the work and generate reports that go up,
[692]
and of course, request help if they need assistance and so on.
[694]
And then horizontally, you have coordination and collaboration.
[697]
Is that really what's happening in many ways?
[700]
Right on point. That's exactly right.
[702]
And so, this idea that internal audit is of the organization
[706]
but sort of set off to the side, increases that probability
[710]
that we will be independent and objective.
[713]
But as a practical matter, we can't be off on another planet.
[716]
We have to be in the same organization,
[718]
under the same umbrella of leadership
[720]
that management is with a different role.
[723]
Well, that’s the same thing with the definition,
[724]
because in the definition,
[725]
you mentioned that they're supposed to be independent,
[728]
needs to be objective as well,
[730]
and also needs to help the organization and help add value.
[734]
So, all of those things seem to be reflected
[736]
in that framework as well, which I think is great.
[739]
Now as we think about the profession
[741]
and the prospects for employment and compensation,
[744]
which is always important to a lot of people.
[745]
What does that look like if we were to look at things now
[750]
and look into the future?
[752]
Well, you set me up for a perfect segue.
[754]
Because the US Bureau of Labor Statistics puts out statistics
[760]
about all sorts of professions
[763]
and internal audit is represented there.
[766]
Typical entry-level education, there's no barrier
[770]
as long as someone has a bachelor's degree,
[772]
and it doesn't have to be in accounting.
[774]
It doesn't have to be in finance.
[776]
You don't have to be an accountant.
No.
[780]
Do you know what my background is Hernan?
[783]
Tell us, tell us, I’m curious.
[786]
Well, way back when I wanted to be a veterinarian,
[789]
so I studied sciences, and then I also studied liberal arts.
[794]
So, my background is in that.
[796]
That's my undergrad background,
[798]
and then I have a graduate business degree.
[802]
But when I came into the profession,
[805]
it was through a circuitous route,
[811]
but it has been the joy of my professional life
[815]
to be an internal auditor.
[817]
And for others who might be interested in coming in,
[820]
the outlook is really great.
[822]
US Bureau of Labor Statistics says
[824]
that they expect to see about 62,000 additional internal auditors
[831]
over the next, well, now it's about next nine years or so.
[836]
But the number of jobs very, very healthy
[839]
at about 1.5 million internal auditors,
[843]
and also a pretty healthy starting salary.
[847]
A little bit shy of $72,000.
[850]
So, $34 an hour if you break it down by a 40-hour week,
[855]
so it's really, really healthy.
[857]
That's awesome.
[859]
Wow, that's very, very good to know.
[861]
Especially as you're thinking towards your career
[863]
and what career direction you want to take things in.
[866]
And like you said, you don't have to be an accountant
[868]
or someone in finance to become an internal auditor.
[871]
You just need to be willing to learn,
[873]
how to discipline, pay attention to detail,
[876]
be a critical thinker, and a few other things
[878]
that we will explore further in a future episode.
[881]
So, thank you very much.
[882]
I really appreciate you helping us better understand
[884]
the definition of internal auditing,
[886]
how internal auditing fits
[887]
into the framework of the three lines model,
[889]
and then the career prospects for people in this profession.
[892]
- So, thank you very much.
- My pleasure.
[894]
If you liked this series,
[895]
subscribe to the ACI Learning YouTube channel
[898]
to enjoy more audit-related content.
Most Recent Videos:
You can go back to the homepage right here: Homepage