Phil

What I find interesting is the report sees very little role for internal audit helping boards discharge the responsibilities they list in the guidance,  including the ability of traditional direct report internal audit methods that provide subjective opinions on control "effectiveness" to help boards oversee risk appetite and tolerance.  Deloitte, like all of the major public accounting firms is still required by U.S. SEC regulation as external auditors to provide subjective opinions on whether they believe controls over financial reporting are, or are not, "effective" in accordance with COSO 1992.  Soon they will have to form views whether the company manifests enough of the control criteria in COSO 2013 to get a binary "effective" rating.  In cases where Deloitte provides contact Internal Audit services I suspect they still take a fairly traditional approach and opine whether they think controls are "effective".  They certainly took this approach in a client I am currently working for.   This doesn't provide what it could to help boards better understand the areas of the financial disclosures that have the highest composite uncertainty and the other areas, including key strategic objectives, that have high residual/retained risk positions.

   poor skills of board  members /poor knowlrdge of their roles (failure to use info, no consideration of        risk, ineffectiveness, )

   poor skills of executives (no use of info, no consideration of risk, no communication of strategy, no risk    monitoring)

   culture of short term focus (costs rule. conflicts of interest)

   deficcient systems and processes.

I would prefer not to class these as risks, however, but as drivers of risk. Risks result from these such as the risks of  fines and damages or loss of reputation or claims for aggressive selling practices or defective products, pursuing inappropriate market segments, relying on obsolete delivery structures etc..

In a word, they are not events of loss or the quantums of such losses but they are very definitely the sources of loss events. In fact, drivers of risk are far more important to understan than the loss events themselves because it is by manipulating the drivers that risks are controlled. Only if one is unable to influence the drivers or react to them does one resort to treating the ailma\ent (ie acquire insurance or provide a capital reserve). 

http://store.theartofservice.com/it-governance-complete-certification-kit.html

You list a number of business process problems to illustrate the breadth that people try to assign to GRC, including strategy, communications, performance management, business information and communications as well as specific bullets on risk and compliance.  We might add ethics too.  None of this need be wrong, but at the end of the day, is it not only semantics?  

The bottom line is that a well-run enterprise needs to do all of this (and other things) well.  However unless one is setting up an organisation from scratch, many elements of GRC are already in place, even if not clumped together under that Soubriquet.  An integrated offering therefore represents a major challenge for any business to contemplate adopting, and the value proposition for dropping existing piecemeal systems and processes and replacing them with a different, integrated, all-singing-all-dancing one, is very hard to demonstrate.  So in reality I totally agree that the piecemeal approach, of upgrading capability in specific areas where the business sees greatest risk, is the only practical way forward.  

And I think is exactly what you did.

I agree the GRC concept is great and sure is what any organization should aim to achieve. But as you said, most organizations are far to be such mature. So, the pragmatic way of doing things happen in real life is to address any of the big GRC areas (risk, compliance and governance) or even any GRC flavor by itself, when the opportunity arises and the organization is ready to do it. And, if you do it right, hopefully you would have the opportunity to add some additional flavors/projects towards the ultimate all-processes/areas integrated GRC “nirvana”.

I find a lot of the labels in maturity models to be benign, and reinforce a culture of mediocrity (going through the motions, looking good on paper, no real results).

 I'm not sure why you keep focusing on a few slides in my IIA presentation and papers while ignoring the other points being made.  I am advocating that IA's main role should be to report to the board whether they are getting reliable information on the effectiveness of management's risk management porcesses AND the reliability of the information they get on the organization's  true retained/residual risk status.  You need to embrace the "AND" in the sentence to understand our vision.  both parts of the sentence are important.

 

You draw importance to the idea of "reporting on key value creation and potentially value eroding  objectives real time, not point in time,  that are deemded outside of risk appetite/tolerance". I agree that this can be important, but even more important is reporting on whether has the capability to manage risks within tolerance! There is some, but little value in reporting that the risk is outside tolerance when management knows that perfectly well and is taking appropriate actions in response.

You also state"In many organizations management doesn't report on risk to the board hence internal audit must continue to function as the primary risk/control analysts". I disagree with this assertion as being outside the scope of internal audit and in violation of IIA Standards and their Position Paper on the role of internal audit in risk management. Instead, internal audit should report to the board that management does not have effective risk management in place.

We do agree that internal audit should not report on control effectiveness, but instead focus on whether management has the processes in place and operating effectively to manage risks. 

My fondest wish is that you would join the call, with which I believe you agree, instead of blazing a separate path.

In many organizations management doesn't report on risk to the board hence internal audit must continue to function as the primary risk/control analysts.  In today's world I believe IA filling the role of primary risk/control analyst providing subjective opinions on "control effectiveness" without providing reliable information on the risk that remains after considering risk treatments or opining on the effectiveness of mangement's risk management processes  should be considered to high risk.

If the auditor listens to management explain why the risk is acceptable and then disagrees, the auditor should escalate to more senior management. If necessary, because the risk is significant, the auditor will take it to the board. See the IIA Standards on this topic.

I hope that helps.