Peter Maris

It's Tuesday. On Tuesday's in 2024, I have been posting on something related to Internal Audit. Today, is it CONFORMANCE or is it COMPLIANCE? From 2013 to 2016, I had global staff responsibility at The IIA for the Standards and the IPPF. I remember always counseling people when they would say things like, "we try to 'comply' with the Standards." And I'd politely suggest that it is about "conformance," not "compliance." We took great pains to draw this distinction between "conformance" and "compliance" as terms used when following the Standards. As "principles-based," the Standards were meant to give a lot of latitude in how internal audit functions achieved "conformance," rather than be a prescriptive rendition of what must be done by everyone. That's why External Quality Assurance Reviews (QARs or EQAs) have their conclusions be about how well the internal audit function being reviewed "conforms" to the Standards (e.g., "generally conforms," "partially conforms," "does not conform"), rather than about "compliance" with the Standards. When we all saw the exposure of the new Standards (GIAS) in March of 2023, they were arguably more rules-based (lots of "musts") than the previous standards. The final GIAS took some steps away from the exposure's level of prescription, but are still arguably more rules-based than the predecessor Standards. As we now have exposed the 1st of what is promised to be a number of Topical Requirements (8 topics were suggested as being under development last year), these additions to the Standards/IPPF are very prescriptive. It seems like we are moving away from seeking "CONFORMANCE" and are navigating towards making internal audit more about "COMPLIANCE" over the last couple of years. It is a trajectory I, personally, am very uncomfortable with. You, in my humble opinion, should be too. #internalaudit

29

8 Comments

A new PCAOB staff report shares observations on how root cause analysis can drive audit quality. Read the report for PCAOB observations related to the use of root cause analysis, key questions for audit firms to consider, and more. https://lnkd.in/gRNPXi33

51

4 Comments

It's Tuesday. On Tuesday's in 2024, I have been posting on something related to Internal Audit. Today, someone else's take on The IIA's introduction of Topical Requirements ... both in general and the specifics on the 1st one on cybersecurity. Clarissa Lucas, CIA, CISA, CIDA, shares her "hot take" on Topical Requirements in her newsletter. I agree with her perspective. She opens with, "I don't believe the IIA should require internals auditors to include specific tests in the scope of their audits. Instead, suggested, non-mandatory guidance that auditors can use to support their decision-making and professional judgement empowers auditors. Strict and narrowly focused requirements, like those in the proposed topical requirements hinder auditors from providing truly "risk-based assurance, advice, insight and foresight". The purpose of internal auditing includes providing risk-based assurance, and these topical requirements - as written - prevent auditors from fulfilling that purpose." Read more at the link to gain her insights and perspective. And thank you to Clarissa for taking a stand. Those in the profession, globally, who have expressed a view are almost overwhelmingly in agreement here. Perhaps it's not to late for The IIA to reconsider. My tag line when it comes to Topical Requirements: "Guidance, yes! Requirements, no!" #internalaudit

29

22 Comments

Learning to disagree well with audit clients may help internal auditors create greater value for them, says Andy Kovacs in the latest “Building a Better Auditor” blog post. https://loom.ly/YZpE37Y #IaMagIIA

117

17 Comments

IIA Heartland-Iowa Chapter As Audit Awareness Month winds down and we prepare for the long holiday weekend, we would like to share a wonderful post from Richard Chambers who summarizes well how to respond to those who ask, "What do Internal Auditors do?".... It's a great read to end the week. Enjoy! https://lnkd.in/gSHbPp7h #iia #oneIIA #IIAMAY

3

Brendan Leech reviewed Audit Board’s Focus on the Future report to bring you the top risks internal audit leaders must be aware of in 2024. 🔍 📰 Article Highlights: Risk Breakdown: Brendan’s article provides a comprehensive breakdown of the highest risks organizations will encounter throughout the remainder of 2024. Strategic Insights: Dive into the specifics and ensure your organization comprehends your risk exposure gap and aligns resources and skillsets appropriately. Alignment Matters: Align your internal audit function with these insights to safeguard your organization’s success. Read the full article here: https://lnkd.in/eW7ZWWMq. #InternalAudit #BusinessRisks2024 #AuditBoard

6

[Blog] Years back, internal audit sat among the less desirable roles for upwardly mobile financial professionals. Post Enron, the situation changed when internal audit was positioned outside of finance in the organization and chief audit executives started reporting either to the CEO or to the board's audit chair. In this blogpost, you will discover five reasons to why talented individuals have been drawn to the profession for decades. @alexandervancaenegem @annemiepelgrims @annebinard @stephaniekelberg @oranevancamp @stephaneruysschaert @laurensjandehaes @dirkvanbastelaere #internalaudit #riskmanagement #trifinance https://lnkd.in/emW2XNQ4

53

The Association of Fraud Examiners affirms that internal audit can offer more value through prevention rather than detection. Effective internal audit programs play a crucial role in reducing both the extent and duration of fraud losses. Read article: https://bit.ly/3UsrL5A #InternalAudit #Fraud #Prevention

11

Thank you Jon Taber, CPA, CIA, CFE, CFF , Robert Berry , and Tracie Marquardt CPA for putting me in the hot seat! Listen to the episode and let me know your thoughts in the comments. #internalaudit #audit #agile #agility

17

2 Comments

It's Tuesday. On Tuesday's in 2024, I have been posting on something related to Internal Audit. Today, 𝗶𝘁'𝘀 𝘁𝗶𝗺𝗲 𝘁𝗼 𝘁𝗲𝗹𝗹 𝗧𝗵𝗲 𝗜𝗜𝗔 𝗵𝗼𝘄 𝘆𝗼𝘂 𝗳𝗲𝗲𝗹 𝗮𝗯𝗼𝘂𝘁 𝗧𝗼𝗽𝗶𝗰𝗮𝗹 𝗥𝗲𝗾𝘂𝗶𝗿𝗲𝗺𝗲𝗻𝘁𝘀 𝗯𝗲𝗳𝗼𝗿𝗲 𝗶𝘁'𝘀 𝘁𝗼𝗼 𝗹𝗮𝘁𝗲! ... ... yes, of course, if you have feedback for The IIA on the 1st (of many) Topical Requirements covering cybersecurity, get your comments to The IIA by completing the canned survey tool provided. BUT ... ... if you want to tell The IIA that Topical Requirements (TRs) should NOT BE MANDATES, but be recommended guidance, you'll have to tell The IIA that separately. (Two recent polls done here on LinkedIn have indicated that around 90%* of internal audit practitioners want TRs to be guidance, not mandates.) I have been asked by some folks what I would recommend internal audit professionals do to share their views on this. I have recommended they contact certain IIA officials directly. So, here are the individuals who you should consider contacting directly, with their contact info. > IIA President and CEO – Anthony Pugliese (anthony.pugliese@theiia.org) > IIA Chairperson of the Global Board – Sally-Anne Pitt (sallyanne@pittgroup.com.au) > IIA Chairperson of the Standards Board – Naohiro Mouri, CPA, CIA Mouri (ia7773104@gmail.com) > IIA Executive Vice President of Global Standards, Guidance, and Certifications – Benito Ybarra (benito.ybarra@theiia.org) > IIA VP Standards and Guidance – Katleen Seeuws (katleen.seeuws@theiia.org) NOTE: All e-mails provided are in the public domain, so I am not divulging anything anyone could not have sourced on their own. 𝗠𝘆 𝗿𝗲𝗰𝗼𝗺𝗺𝗲𝗻𝗱𝗮𝘁𝗶𝗼𝗻 𝗶𝘀 𝘁𝗼 𝗰𝗼𝗻𝘁𝗮𝗰𝘁 𝗮𝗻𝘆 𝗼𝗿 𝗮𝗹𝗹 𝗼𝗳 𝘁𝗵𝗲𝗺 𝗱𝗶𝗿𝗲𝗰𝘁𝗹𝘆 𝗮𝗻𝗱 𝗹𝗲𝘁 𝘁𝗵𝗲𝗺 𝗸𝗻𝗼𝘄 𝘁𝗵𝗮𝘁 𝘆𝗼𝘂 𝗮𝗽𝗽𝗿𝗲𝗰𝗶𝗮𝘁𝗲 𝗧𝗵𝗲 𝗜𝗜𝗔 𝗽𝗿𝗼𝘃𝗶𝗱𝗶𝗻𝗴 𝗮𝘀 𝗺𝘂𝗰𝗵 𝘁𝗼𝗽𝗶𝗰𝗮𝗹 𝗴𝘂𝗶𝗱𝗮𝗻𝗰𝗲 𝗮𝘀 𝗶𝘀 𝗽𝗼𝘀𝘀𝗶𝗯𝗹𝗲, 𝗯𝘂𝘁 𝘁𝗵𝗮𝘁 𝗧𝗵𝗲 𝗜𝗜𝗔 𝘀𝗵𝗼𝘂𝗹𝗱 𝗻𝗼𝘁 𝗯𝗲 𝗱𝗶𝗰𝘁𝗮𝘁𝗶𝗻𝗴 𝗮𝘂𝗱𝗶𝘁 𝗽𝗿𝗼𝗷𝗲𝗰𝘁 𝘀𝗰𝗼𝗽𝗲 𝘁𝗵𝗿𝗼𝘂𝗴𝗵 𝗺𝗮𝗻𝗱𝗮𝘁𝗲𝘀. *One poll by Nam Phong Ho was 89% in favor of guidance over mandates, and a petition I initiated resulted in 93% in favor of guidance over mandates.

21

9 Comments

It's Tuesday. On Tuesday's in 2024, I have been posting on something related to Internal Audit. Today, counting the number of internal audits done is a valueless metric. It's about the quality of what's being audited, not the quantity. What made me want to go down this path is something I read recently in a company CEO's letter to accompany their sustainability report. The company is Wesco, a $20+ billion U.S.-based provider of business-to-business distribution, logistics services and supply chain solutions. In Mr. Engel's (CEO) letter, dated June 4, 2024, he states ... "We are continuously improving to address emerging risks and ensure we remain at the forefront of ethical business practices. 𝗙𝗼𝗿 𝗲𝘅𝗮𝗺𝗽𝗹𝗲, 𝗼𝘂𝗿 𝗶𝗻𝘁𝗲𝗿𝗻𝗮𝗹 𝗮𝘂𝗱𝗶𝘁, 𝗾𝘂𝗮𝗹𝗶𝘁𝘆 𝗮𝗻𝗱 𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝘁𝗲𝗮𝗺𝘀 𝗽𝗲𝗿𝗳𝗼𝗿𝗺𝗲𝗱 𝗼𝘃𝗲𝗿 𝟮𝟬𝟬 𝗮𝘂𝗱𝗶𝘁𝘀 𝗶𝗻 𝟮𝟬𝟮𝟯, ensuring our operations are running in alignment with the standards we set. This commitment is not only vital to our continued success, but is also essential to building trust with our stakeholders and creating a positive impact on the communities we serve." (emphasis added) While I am sure the "internal audit, quality and security teams" do a very fine job at Wesco, with no other detail, the statistic of performing "over 200 audits" in a year is meaningless. What was audited? Do the audit's have anything to do with sustainability? Were the results satisfactory? And on, and on, and on ... Don't let your companies get away with meaningless reporting like this. While I won't go so far as to call it "greenwashing," it is still meaningless. (Note: if you are interested in the full letter, it is available at this link: https://lnkd.in/ePar-nhH)

32

11 Comments

As Internal Audit Month winds down, I wanted to re-share an article on effective ways to answer questions about what you do and an internal auditor. #iiamay #internalaudit https://lnkd.in/dtYXaZ8

178

14 Comments

A thoughtful process is essential to properly define the model to be adopted by the Internal Audit function. This process will be influenced by several factors, including the organization's size, risk appetite, the Board of Directors' understanding of the value Internal Audit can bring, and the available budget, among others. #internalaudit #iastrategy #iaresources

1

Happy Internal Audit Month! Harold Silverman talks about why it's so important to spread the message of internal audit's value to your stakeholders. What are you doing to raise awareness? https://loom.ly/yzsWlo0 #IaMagIIA

127

PCAOB report shares observations to help auditors with testing of information produced by companies and external sources The Public Company Accounting Oversight Board (PCAOB) has issued a new staff Spotlight report titled "Inspection Observations Related to Auditor Use of Data and Reports." This report focuses on enhancing auditor understanding of proper testing methods for information produced by companies (IPC) and information from external sources. IPC examples include invoices, shipping documents, and data from company IT systems, while external information encompasses items like customer purchase orders and bank records. The report addresses findings from the 2021 and 2022 inspection cycles where about 17% of audited instances showed deficiencies in auditors' testing procedures for IPC and external information. To boost audit quality, the Spotlight outlines common audit deficiencies, shares best practices, and provides reminders to help auditors effectively assess the accuracy and completeness of these information sources. The report can be found here:

8

The AICPA published the latest SOC 1 Audit Guide. Read this article for a detailed outline of the updates and what impact this may have on your organization: https://bit.ly/44kCaF3

13