Most of the time, internal auditors and management agree on factual findings and where a lot of time is lost is during the discussing process preceding the issuance of the audit reports. Who is the best placed to address an issue: management or the internal auditors...

For sure, I must be too bold...

Denis

But this is the exception on not the norm.

Kind regards,

Mike

I have also just read PwC’s 2013 State of the Internal Audit Profession Study which reveals that "many internal audit functions are not keeping pace with changes—which poses a major challenge for companies (and audit committees) seeking to determine their future strategies for, and investment in, internal audit."

My personal view is driven by the fact that in this era of dynamically changing environments, globalization and new technologies companies need to re-visit their strategy on a continuous basis. Technological innovation can create a paradigm shift leading to changes in the market and the ways markets and organizations operate. The introduction of the computer resulted in ongoing automation of processes and after some period of time elapsed also continuous monitoring / auditing became introduced and more widely accepted. Apparently the efficiency gains have prevailed the idea of big brother is watching you.

The redesign of the organization, processes, and systems, are often executed through (large) projects. With increasing demands from management on the internal audit profession, the question is also raised of how the auditor’s traditional assurance role can be redefined and more proactive project auditing roles and techniques can be applied.

I am aware there are still many discussions on how the auditor can be more proactive in a changing environment ( this week I will also publish an article about "proactive project auditing" in the American journal - EDPACS, NO. 5 -) . I strongly prefer to see the glass half full keeping in mind the words of Darwin: "It is not the strongest of the species that survives, nor the most intelligent that survives. It is the one that is the most adaptable to change."

From a security standpoint, there are confidentiality considerations.  What networks may data gathered through the glasses traverse, what party has claim to the data which may be stored at these points, and what are the legal and company policy implications?  As a computer, the device itself may introduce risks similar to other mobile devices entrusted to users.

While research into possible side effects of a new product are important, the fears of additional electromagnetic radiation seem overblown.  The radiation of the device in question is in a spectrum which is already seeing very wide use, and has not been found to have measurable ill effect.  As humans, we tend to improperly inflate miniscule risks, especially those which involve something rare, novel, beyond our control or understanding, or which have high emotional impact.  As with mobile telephony and entertainment in wide use, we are likely to find the greatest personal risks from this new technology are those of accidents resulting from user distraction.

The larger social effects and privacy implications of a technology such as Google Glass becoming common likely require more than this comments section to address, though they are worth considering.

Thank you for the article.  I look forward to the debate.

Brian Cathey, CISA, CISSP, OSCP, etc.

Audit Committees are playing a greater role in setting objectives, measuring effectiveness and assessing performance for CAE's. Robust questioning is an imperative As you say "the audit committees success is tied to the effectiveness of the internal audit department". Many audit committees don't realise that !

We encourage boards to ask the following questions:

1. Is management providing the board with a materially reliable report on the areas/objectives with the highest levels of retained/residual risk?  If the answer is no, why not?

2. What percentage of the organization's most important strategic objectives and potentally value eroding objectives have been risk assessed by management and/or internal audit? Which objectives in those categories have not been formally risk assessed by management and/or internal audit?

3. Do your auditors know how to complete reliable risk asseessments in accordance with ISO 31000 that cover not only "controls" but all forms of "risk treatments" including risk transfer, risk sharing and risk financing vehicles?  

4. When your internal auditors complete assessments are they providing subjective opinions on what they think is "effective control" (which is actually deciding on acceptable levels of residual risks) or providing management with reliable information on residual risk status?

5. What is internal audit doing to enhance management/work unit risk asssessment/management capabilities?  

Your column however made me also realize another tool that could also be very useful for auditors especially smaller, budget concious shops.  Data collection and storage tools like Evernote would make great low cost audit workpaper packages.  Evernote is capable of capturing and storing all types of data from written text, voice recording and photographs.  It not only captures this data but also is very capable of organizing it through the use of data tags and notebooks.  

With Evernote's cloud based platform, information is available anywhere through mutliple tools: laptop, iPad, Android tablet, iPhone, Android phone or the internet.   All one needs is a connection to the internet.  Using any Smartphone, an auditor could easily capture audio or pictures or makes notes for their audit.  A quick cut and paste would also allow them to capture images of documentation into the workpapers. 

Best of all, Evernote is a "free" tool for basic use and is very affordable for more data intensive power users.  Evernote also allows controlled sharing of information for team use.  Imagine combining Google Glasses with Evernote!

Thanks for getting me thinking or how new tech can be used!

Clay Cochran, CIA, CISA, CFSA, CRMA