From the President's Study

Thank you for taking time from your busy schedule to read this issue of The IIA Research Foundation Report. I am pleased that we have already made huge strides toward these priorities I outlined in the last issue of Report.

• Pursuing leading researchers to perform global internal audit studies     
• Researching and releasing eSAC (see article in this issue)     
• Beginning work on the monograph Research Opportunities in Internal Auditing (see article in this issue)

As The Foundation enters its 26th year, I have a new proposal for action for us. We will build upon our existing role as a financier of significant research, and take on a new role as a performer of significant research. Both of these roles are critical to our success

By tapping into the incredible knowledge and competency of The Foundation's headquarters staff, we can work faster, smarter, and more consistently. We can provide global, long-term strategic direction to our products and the The Foundation as a whole.

How can this be accomplished? By taking advantage of the expertise already available to us — both staff and resources. For example, we hope to issue timely and concise technical bulletins on emerging topics such as eSAC technology, recovering internal audit costs, business continuity planning, and salary surveys for internal auditors and chief audit executives (CAEs). We may tap into the findings of the some of the Global Auditing Information Network’s Flash Surveys, or may perform similar surveys ourselves.

Additionally, IIA headquarters is a clearinghouse for research performed by IIA affiliates worldwide, and because our vast international network can keep staff abreast of current issues, we may be able to increase the relevance of products to our customers worldwide.

We will continue to fund outstanding research as we have for 25 years, and hope that this new role — performer of significant research — will mean faster delivery of products to the marketplace, consistency and high quality in those products, and of course, cost efficiency.

Dr. Larry Rittenberg, CIA, is Research Foundation president and IIA vice chairman of the board-research. He has been an IIA member since 1975 and is currently a professor of accounting at the University of Wisconsin in Madison.

In this issue of The IIA Research Foundation Report:

From the President's Study
A message from Dr. Larry Rittenberg, President, IIA Research Foundation

Will Your System Support You?
An introduction to Electronic Systems Assurance and Control (eSAC)

Research Opportunities in Internal Auditing
A road map for research opportunities based upon the new definition of internal auditing.

A New Focus on Students
The Foundation's emphasis on the auditors of tomorrow — college- and university-level students.

Where There is a Will, There is a Way
Charitable bequests to The Foundation through the Heritage Circle

A Foundation Committed to Research
About The Foundation's research projects:
               · 2002 Research Priorities
               · Projects in the Pipeline

Matching Gift Program Benefits All
Increasing the value of contributions to The Foundation through corporate matching gift programs.

About Our Foundation

Will Your System Support You?

In an e-commerce world, moving at Internet speed, where controls and interdependency know no organizational or geographical boundaries, it is essential that guidance be available for managing systems and technology at all levels of the organization. The need to keep current with technology has never been more urgent. Auditors and IT security practitioners must understand risks and how to mitigate them, and be able to discuss security issues with management at appropriate levels of detail. 

The eSAC model sets the stage for effective technology risk management by giving companies a framework to guide an evaluation of the e-business control environment. Within the context of an organization’s mission, values, objectives, and strategies, the different eSAC modules will assist in gaining an objective perspective on the organization’s technology culture.

This knowledge will then aid in providing assurance to customers, regulators, management, and boards that IT risks are understood and managed. However, the pace of change makes assurance a moving target. Organizations need a continual risk assessment and management process to examine changing vulnerabilities and consequences, and to prioritize risks and probabilities. Effective risk management will focus resources on things that must be protected and threats that can be mitigated at appropriate cost.

Deciding where to focus resources first can be a serious challenge. What are some of the issues? Pace of change, error transparency, reputation issues, coping with increasing transaction volumes, business channels, a changing legal and regulatory environment, and more must be evaluated with limited resources and staff. How can eSAC help? Service to management means providing assurance on the availability, capability, functionality, protectability, accountability, and auditability of the systems involved. Each eSAC module is written and critiqued by people who actually work with the subjects covered.

eSAC provides current information to understand, monitor, assess, and mitigate technology risks. It examines risks in all business system components, including customers, competitors, regulators, and partners. No longer under the constraints of paper-based publishing, eSAC will be constantly updated. The demands of today’s environment call for nothing less timely.

A one-year subscription to eSAC, Order No. 9100, is $245 for IIA members and $295 for nonmembers. It is available as a CD-ROM and subscribers can access it through www.theiia.org. Updates will be provided quarterly on the CD-ROM, and monthly on the Web site. A one-year subscription to eSAC via the Web site only, Order No. 9100-E, is $225 for IIA members and $275 for nonmembers. To order electronic distribution via the Web site only, call The IIA Research Foundation at +1-407-937-1356 or e-mail research@theiia.org.

Research Opportunities in Internal Auditing

The monograph Research Opportunities in Internal Auditing (ROIA) is a cooperative academic/practitioner project charged with identifying important internal audit topics that would raise interest in internal auditing research and actively engage researchers around the world.

ROIA will serve both as an invitation to academicians to do meaningful research in internal auditing and as a framework for interested academics/practitioners to think about contemporary internal auditing practice issues and developing responsive research agendas and supporting methodologies. 

The monograph’s editors include Andrew Bailey, CIA, University of Illinois at Urbana-Champaign; Audrey Gramling, CIA, Georgia State University; and Sri Ramamoorti, CIA, Andersen.

Among the project authors are Urton Anderson, CIA, University of Texas; Dana Hermanson, Kennesaw State University; William Kinney, University of Texas; W. Morley Lemon, University of Waterloo; Jane Mutchler, Georgia State University; Douglas Prawitt, Brigham Young University; Larry Rittenberg, CIA, University of Wisconsin; T. Flemming Ruud, University of St. Gallen; and Kay Tatum, University of Miami.

The monograph’s seven chapters will provide a road map for research opportunities based upon the new definition of internal auditing.

• Assurance and Consulting  
• Corporate Governance  
• Independence, Ethics, and Objectivity  
• Managing Internal Auditing  
• Organizational Role of Internal Audit  
• Risk and Control  
• Systematic, Disciplined Approach

The anticipated completion date for Research Opportunities in Internal Auditing is January 2003, in time for presentation during the annual American Accounting Association (AAA) Auditing Section meeting.

A New Focus on Students

For 26 years contributions to The Foundation have enabled it to support research and education in internal auditing and to promote the internal auditing profession. Thank you.

The Foundation is placing additional emphasis in 2002 on the auditors of tomorrow — college- and university-level students — and the need to attract them to a profession in internal auditing. 

Internal auditing is fundamental to the internal control process of any well-run organization. Therefore an education in internal auditing should be part of every business and public administration curriculum.

That is the premise of Endorsed Internal Auditing Programs (EIAPs). EIAPs offer a curriculum of study in internal audit-related disciplines. A program must offer at least two courses in internal auditing disciplines to be considered an IIA EIAP. EIAP graduates are very successful in the job market, and many Fortune 500 organizations recruit internal auditors from them.

Just recently The Foundation approved the Lebanese American University in Beirut as its 44th EIAP.

We must remain committed to providing the resources necessary to support EIAPs because their success helps establish internal auditing education worldwide, and demonstrates to other universities that internal auditing education is worth the necessary resource commitment.

Additionally, The Foundation has partnered with The IIA Academic Relations Committee on Research Opportunities in Internal Auditing.

Our cooperative outreach to students is a vital link to a successful future. We hope The Foundation can count on your continued support as we train the auditors of the future.

Where There Is a Will, There Is a Way

A number of Research Foundation supporters have made charitable bequests to The Foundation through their wills, trusts, and estate planning. In addition to leaving a lasting legacy to the profession, these donors are given recognition as Heritage Circle donors.

Tax-deductible contributions and gifts to The Foundation may be made in two categories: restricted and unrestricted. They are summarized in the following paragraph, with full details available at www.theiia.org.

Restricted donations are designated by the contributor and earmarked for a specific research project or educational program. Unrestricted contributions are used to meet audit research and educational objectives as authorized by the IIA Research Foundation Board of Trustees. These objectives would include funding research projects, sponsoring forums and symposiums, awarding research and doctoral dissertation grants, and assisting internal auditing educational programs in colleges and universities.

We recommend that you consult with your attorney about the best way to use your will, trust, insurance policy or other estate plan to support The IIA Research Foundation.

A Foundation Committed to Research

The Research Foundation maintains a strong belief in research and in publishing reports that aid the practitioner as well as the profession. The Foundation’s portfolio of researchers and writers studying the profession is world-class. Many of the published reports are used to support IIA conference and seminar programs.      

The Foundation continually identifies and examines emerging business issues. Members of the Board of Trustees and the Board of Research Advisors (BORA) solicit suggestions from thought-leaders in internal auditing, academia, and related business professions. These suggestions are reviewed and approved by the Trustees as future Research Priorities.

The priorities are published and proposals are solicited from leading researchers, educators, and practitioners around the world, and grants are awarded based on the quality of proposals received and the expected contribution the project will have to the profession. 

To learn more, visit www.theiia.org or contact research@theiia.org.

Electronic Commerce
This research will seek to determine what effect e-commerce is having on historical IT and business development control models; how leading edge organizations are meeting this challenge; and how audit approaches are being adapted accordingly.

The Role of Internal Auditing Services in Corporate Governance and Management
This research will examine how internal auditors are helping management and the board satisfy their corporate governance responsibilities.

Auditing Continuous/Online Controls
This project will identify online/continuous techniques used by leading-edge companies to control advanced automated systems; audit practices for testing the effectiveness of these techniques; and using continuous control monitoring as a substitute for traditional audit assignments.

The following research is under way.

Enterprise Risk Management: Pulling it all Together
While the concept of enterprise-wide risk management is still emerging and the techniques and theoretical underpinnings are still in development, much progress has been made in select industries and countries. Key areas to be addressed include internal auditing’s role in the integration of risk management processes; assurance tools and approaches, and reporting techniques and methods.

A Balanced Scorecard Framework for Internal Audit Departments
The objective of this report is to describe how internal audi departments can use a "balanced scorecard" framework as a management tool. The study shows how internal audit departments can develop key performance measures and identify key performance drivers.

Digital Agent Technology
Digital agent technology is one technology that can be used to develop the Web-based information cockpits and address the real need for continuous online control systems to monitor key performance indicators. This study will describe commercial applications available, those under way, and other enabling technologies.

Electronic Commerce Systems: Control and Risk Analysis
This study will look at the conceptual business-to-business (B2B) e-commerce assurance framework, which includes organizations throughout the supply chain. This framework will become the basis for identifying sets of key performance indicators (KPIs) that capture the sufficiency of an organization’s B2B e-commerce integration with internal business processes.

eSAC
See related article.

Fraud and Its Deterrence
This research will examine the role of internal auditing and special investigative units with respect to anti-fraud and anti-abuse activities worldwide.

Mergers, Acquisitions, and Divestitures
This research will examine current practices employed by internal audit departments in support of mergers, acquisitions, and strategic alliances. The research will target the challenges to the control processes that emerge as different business cultures are blended into one entity.

Research Opportunities in Internal Auditing
See related article.

Risk Exposures in Employment and HRM Practices
Litigation and recent changes in HR practices have affected most of the elements of HRM, such as recruiting and hiring, training, job ratings, performance appraisal systems, compensation, benefits, and employee relations programs. Auditors and HR managers need a framework to evaluate their practices against the current norms of expected practices and potential exposure factors.

Risk Assessment by Internal Auditors Using Past Research on Bankruptcy
The use of bankruptcy-associated models for ongoing monitoring can help in assessing risks associated with prospective investments, suppliers, customers and attendant credit risks, etc. This research will summarize a number of domestic and international models.

Matching Gift Program Benefits All

Matching gift programs are a terrific way for organizations to show support of their employees and the charitable donations that they elect to make.        

One organization that contributes to The Research Foundation through the matching gift program is Archer Daniels Midland, headquartered in Decatur, Illinois. According to Archer Daniels General Auditor Steve W. Minder, CIA, "The corporate matching gift program allows me to increase the value of my contribution to The Foundation, and enables my employer to make a tax-deductible contribution to a worthwhile organization."

"If your organization has a matching gifts program, doubling your contribution to The Foundation is as easy as filling out some paperwork," Minder adds. "It is well worth the effort."

About Our Foundation

The Research Foundation is the recognized leader in sponsoring and disseminating research to assist and guide internal auditing professionals, business and government communities, and the general public in the areas of audit practices, risk management, controls, and governance.

Founded by The Institute of Internal Auditors in 1976, The Foundation has set the standard for professional achievement in the internal auditing profession.

Contributions to The Foundation are tax-exempt under Section 501(c)(3) of the U.S. Internal Revenue Code. Operating exclusively for research and educational purposes, The Foundation pays no taxes on earnings or contributions received. In turn, when U.S. individuals or organizations contribute to The Foundation, their contributions are deductible under Section 170 of the U.S. Internal Revenue Code. To learn more about The IIA and The Research Foundation, visit www.theiia.org.