http://www.theiia.org/intAuditor/ask-the-experts/2012/finding-the-right-balance/ Blogen-us Tue, 26 Feb 2013 12:09:14 PMTue, 26 Feb 2013 12:09:14 PM http://www.theiia.org/intAuditor/ask-the-experts/2012/finding-the-right-balance/2013-02-26Risk and perception are seasonal! While a CAE can plan well ahead on what he thinks are the bases to be covered, he would also need to check with the Chairman of the Aud Com to ensure he has the considered the flavor of the year. With ever changing business climate, the business owners always have the need to weigh risks proactively and on priority basis. What constituted a non-compliance few months back may no longer be the pin up and hence, the CAE continuously needs to address this. Charlie would do well to recast the audit plan to include the regulatory framework that business now prioritizes. http://www.theiia.org/intAuditor/ask-the-experts/2012/finding-the-right-balance/2012-04-12I think Charlie may have erred a bit in creating this current audit plan. Expanding IA’s responsibilities to include a consultative role is progressive, but it should not come at the expense of addressing critical risks to the business. Perhaps, initially Charlie should have worked more in conjunction with the audit committee as well as Management in developing this plan. By reaching out early in the process, getting input from all stakeholders, he may then not have been caught off-guard by this request. Additionally, a good audit plan should have some flexibility built into it to allow for change to address new and unforeseen risks. Like many in the industry, my department currently tries to keep abreast of our profession and learn what are the new concerns of our peers. In a previous company, my audit department had a formal quarterly review of risks to attempt to update the audit plan as needed. What is a critical risk today can be overshadowed by a new risk(s) as the months go along. Lastly, perhaps Charlie should consider co-sourcing or adding staff. It is not always easy to add staff to one’s department, but by demonstrating that IA is seeking to offer additional benefits to the company through its consultative services, this may support expansion. At the very least, using outside resources to provide depth and breadth may allow Charlie to work to satisfying all his customers and cover these additional concerns presented by the Committee. http://www.theiia.org/intAuditor/ask-the-experts/2012/finding-the-right-balance/2012-04-12Fred, Thanks for the interesting case study. I appreciate the dilemma faced by Charlie. I would say that a CAE should cast a very wide net in viewing risks/opportunities. We do an ERM-type Heat Map that has the top 15 Risks/Opportunities that Internal Audit can do something about. For us, this includes areas such as FCPA, Compliance with Labor Laws, Compliance with Import/Export Requirements, SOX Compliance, and, Continuity/Disaster Recovery, Major IT Implementations, etc. We also consider very operational Risks/Opportunities: Transportation, Maintenance, Capital Expenditures, Product Quality, etc. -- In essence, any risk/opportunity which can be addressed by a control or process, is fair game for Internal Audit to assess. Of course, as the Heat Map is being prepared, Management and the Audit Committee should be consulted for their ideas. Manny