All Things Internal Audit: Internal Audit Education in Action

00:00:02 Speaker 1

The Institute of Internal Auditors presents all things internal audit in this episode. Lindsey Patterson speaks with Dennis Applegate about how internal audit education is shaping the future of the profession. From addressing the talent pipeline shortage to giving students hands on experience with risk assessments and mock audit plans APPLICATE shares.

00:00:20 Speaker 1

How academic programs can inspire the next generation of internal auditors.

00:00:26 Speaker 3

Hi, everyone. Lindsey Patterson here with the IAA, I am our Executive Vice president of membership, marketing and communications and one of the areas that I work on a lot day-to-day is building the pipeline into the profession. So I am very excited today to be joined by Dennis Applegate of professor at the Alvers School of Business.

00:00:47 Speaker 3

At Seattle University, which is one of the IAS Center of Excellence schools to start talking about how we can build the pipeline together, here are some of the exciting work that he's doing in his classrooms. So Dennis, does that sound like a good plan?

00:01:03 Speaker 2

Yes, I'm eager to get started.

00:01:05 Speaker 3

All right, so tell me a little bit, tell our audience a little bit about your background, how you got involved in internal audit and then started teaching it.

00:01:13 Speaker 2

OK, good. I'm a CPA and a CIA by profession.

00:01:18 Speaker 2

And have taught college courses in accounting and auditing part time for more than 30 years while working full time in private industry, mostly in internal audit management. But following my retirement, I was hired by Seattle University.

00:01:34 Speaker 2

Teach in their internal audit program, mainly the introductory course principles of internal auditing, and for the past seven years I've taught full time in the accounting department, not just internal auditing, not not just the internal auditing principles class, but other courses as well.

00:01:56 Speaker 2

Mostly in accounting, financial auditing, and financial.

00:02:01 Speaker 2

Management.

00:02:02

So.

00:02:03 Speaker 3

I'm a CPA, CIA too, so you probably know this. The CPA profession right now having a big pipeline challenge, fewer and fewer students are sitting for the CPA exam. Over the last several years, fewer students have been enrolling in accounting programs and that's not great for internal audit because we still see in North America.

00:02:24 Speaker 3

That the majority of internal auditors come from that accounting back.

00:02:28 Speaker 3

Around.

00:02:29 Speaker 3

So hearing that, what are you guys doing? What are you seeing work at the university to attract the students to internal audit when there's that decline in the pipeline?

00:02:40 Speaker 2

Well, I guess first I can talk a little bit about the trends that we've seen, the demographic data that's been reported, particularly I think the most influential 1 was the Internal Audit Foundation report a few years back that shows the age of internal auditors under 40 years has declined 17%.

00:03:01 Speaker 2

While the age of internal auditors over 40 years has increased 18 per.

00:03:06 Speaker 2

Percent, you know, pushing the overall age of the profession much higher. So if this trend continues, you know, many internal audit leaders are questioning whether the next generation of internal auditors will be sufficient to meet the demand.

00:03:22 Speaker 2

The best way for educators to help replenish this internal auditor pool is by integrating internal audit education into their existing business curriculums and by providing stand alone internal audit courses very similar to what we do at Seattle University.

00:03:40 Speaker 2

The IAS Global model internal audit curriculum gives detailed guidance for such courses and for the integration of those courses into the business curriculum at universities. In addition, the IIA encourages members of local I chapters to support.

00:04:00 Speaker 2

IAEA partner schools by teaching internal audit courses by serving as guest lecturers who can demonstrate to students the critical role of internal auditing in the day-to-day operations of the firm.

00:04:14 Speaker 2

In our case at CI University, we've got three members of the local I Seattle Chapter Teach audit related courses at CLU. Several other members teach a periodically or support the schools business coursework in other ways. You know their guest lecturers or they.

00:04:33 Speaker 2

Serve on our advisory committees, so in our opinion those are the best ways to attract and prepare the next generation of internal auditors.

00:04:44 Speaker 3

Absolutely, Dennis. Those are some great options for individuals. If you're in academia or even if you're not. If you're an individual, you know you can volunteer to be a guest lecturer. But you said something a few times that I really loved. You, talked about the Business School. And right now we see so many internal audit courses.

00:05:05 Speaker 3

Built in just to the accounting program, which is a great start, but when we see these challenges with building out the pipeline.

00:05:14 Speaker 3

I think having more of that internal audit curriculum in the broader Business School is a great way to raise awareness of the profession because I don't know about you. But when you know I went and I got my masters degree in accounting, I focused on audit. That was my area of specialty. I don't know that I ever heard anyone talk about internal.

00:05:35 Speaker 3

Audit it was all external audit. So we also have just an awareness problem.

00:05:40 Speaker 3

So I love that. I love that it's part of the Business School and the business curriculum. Can you tell us a little bit about like what internal audit course you teach? Like, what are the objectives, how does it bring students into the profession? What are you integrating into that curriculum?

00:05:58 Speaker 2

See again the course that I teach is principles of internal auditing.

00:06:03 Speaker 2

You know, and it contains 4 objectives. The first objective, as it explains the COSO Enterprise Risk management framework and the COSO internal Control, Frank Framework to students, that's the those are the primary conceptual frameworks that form the basis of the profession.

00:06:24 Speaker 2

Secondly, the course covers heavily professional IIA standards that guide risk assessment. The master audit plan.

00:06:37 Speaker 2

And discrete audit projects. So we've got the conceptual frameworks, then we have the CIA standards. The third objective is to define the roles and responsibilities of the internal auditor in assessing risk, particularly enterprise risk, and in assessing controls that mitigate the risk to the firm.

00:06:59 Speaker 2

And the fourth objective is to describe the assurance, tests and techniques that help to assess governance, risk management and process controls. You know, in addition to those objectives, special attention is also given to audit sampling plans particularly.

00:07:18 Speaker 2

Attribute sampling and the role of internal auditors in assessing internal controls over fraud. So audit sampling plans and fraud. We have special classes.

00:07:30 Speaker 2

On each of those topics, if you boil it down, the main objective is to develop in the student a risk and control mindset and that concept and technique is blended into every class that we and into the agenda of every class in this particular.

00:07:49 Speaker 2

Course in one form or.

00:07:52 Speaker 2

Another.

00:07:53 Speaker 3

Feels like you guys have looked at all of our research and all the foundations research and are leading the way in terms of what we would like to be seeing in a profession because that enterprise risk piece is so critical for internal auditors today, but especially a few years from now.

00:08:13 Speaker 3

For our listeners who haven't read our Vision 2035 report, this is something that the stakeholders within the profession audit. Committees, boards, CAE's are saying is going to become increasingly important over the next several.

00:08:28 Speaker 3

Years internal auditors having that role in enterprise risk management, so love hearing that the students are already getting that insight and that practice, how do they actually like learn it hands on are there case studies what are you doing to get them that?

00:08:45 Speaker 2

Experience. That's a great question.

00:08:48 Speaker 2

And and you you correctly point out that that enterprise risk is really at the top of mind for the for the profession.

00:08:57 Speaker 2

You know, a couple years back, 2023 KPMG did a survey of audit committees and 62% of the respondents want greater focus by their internal audit functions on critical enterprise risk. That's.

00:09:16 Speaker 2

The highest response rate by far to you know to the questions that were asked, they want greater focus by internal audit departments on enterprise risk. So for this reason, you know our CI university students are taught.

00:09:32 Speaker 2

That the board and senior management, you know, view the world in terms of enterprise strategy and the risk to that strategy, you know both in terms of likelihood and impact of not achieving that that strategy strategy, this is a little bit of an aside here, but we we also emphasize in the course.

00:09:52 Speaker 2

The courses that we teach, we emphasize that that rather than focus entirely on controls, we focus on what the client.

00:10:00 Speaker 2

Management is interested in, and their interest is in risk. It's not necessarily in controls as much as it is in risk. So so, so it's it's the, it's the risk to earnings targets, market share, major projects you know the reputation of the firm at.

00:10:21 Speaker 2

That's the focus that senior executives are interested in. We don't discount the importance of, you know, of adequate and effective internal controls. But we just want to emphasize to the students that if we want to get the attention of senior management at the.

00:10:36 Speaker 2

Board we got to focus on the enterprise risk, the risk to the strategies of of the firm. So we integrate that, we integrate this concept of enterprise risk you know into the agenda of nearly every class, even our class on audit sampling plans spends time on on the notion of enterprise risk.

00:10:58 Speaker 2

And just to kind of follow up on, I think another aspect of the question that you asked, which is how we present this or how we how we teach our students about the, the the concept of enterprise risk, we assign A-Team oriented project that's designed to emulate.

00:11:18 Speaker 2

To mirror the required annual internal audit risk assessment.

00:11:23 Speaker 2

As you know, the global internal audit standards require the develop of a master audit plan and schedule, so that's the end product of this team oriented student project. You know the the end product is a master audit plan and schedule we usually have.

00:11:43 Speaker 2

25 to 35 students in a class and depending on the size, while assigned 4 to 5 students to a team, we have 6 or 7.

00:11:51 Speaker 2

Teams that are working on the enterprise risk of major companies, major firms in the Pacific Northwest area, and we got a we got a ton ton of them, very strong, you know, well known firms, Boeing, Nordstrom, Starbucks, Pack, car, Microsoft.

00:12:12 Speaker 2

Expedia, Costco, Alaska Airlines, all of those we've used and at various stages as the targets of the risk assessment of the teams that we've assigned.

00:12:28 Speaker 3

Does this team sound like they might have some very interesting risk assessments based on some of those companies in the news the last few years? Are they doing this research just with public information? Do they connect with individuals within the companies? What does that look like?

00:12:35 Speaker 2

Ohh yeah yeah.

00:12:44 Speaker 2

The teams start with the SEC 10K because in the SEC 10K there are. There's usually a strong information available on the strategy of the company and the financial and operational and compliance risks that the firm is facing. So that's really the starting.

00:13:05 Speaker 2

Point the teams also do library research looking for current events that will have an impact on the risk of the enterprise risk of the of the firms. And they also about these firms since they're so woven into the culture and the the business of the community here. Those are the sources.

00:13:26 Speaker 2

But we don't. Well, we don't allow is for the students to actually contact the firm themselves them themselves, because what that tends to do is it tends to tweak or otherwise it gives an unfair advantage. We say it that way. It gives an unfair advantage.

00:13:41 Speaker 2

To to certain teams that don't have the same access that those.

00:13:46 Speaker 3

The insider trading of the academic world.

00:13:48 Speaker 2

Yeah. There, there you go.

00:13:50 Speaker 3

So and then in building out, you know that frameworks that they're using, are they using like a slot analysis heat maps? How are you teaching them to assess risk effectively? Because I'm going to guess that a lot of these students.

00:14:02 Speaker 3

Have never done a risk assessment.

00:14:05 Speaker 2

So in in, in evaluate you know we the the students present the their the results of their projects to an audit committee. A hypothetical audit committee and that that committee is comprised of professional, senior professional internal auditors, usually at the management level they present.

00:14:23 Speaker 3

I love that.

00:14:25 Speaker 2

Their the results of their of their work to them now the the the key that we teach here, the key aspect of this is that there has to be a clear line of sight from the enterprise strategy.

00:14:37 Speaker 2

Through the assessed risk to the audit projects, because unless the projects reflect the audit, projects in the master plan reflect the assessed risks that address the strategies of the company, then the master audit plan would lose relevance and.

00:14:57 Speaker 2

Credibility with the board. So that's the key thing that we emphasize when we teach this project is to make sure that that sight line is maintained and that's the basis that the audit committee will use when they evaluate the projects that are.

00:15:14 Speaker 2

Presented. So there has to be that direct linkage, and if that isn't there, then of course the the teams run the risk of a problematic grade.

00:15:24 Speaker 3

Well, that makes sense.

00:15:25 Speaker 3

It it aligns perfectly with what we expect in the profession, right? Because the standards say that that internal audit teams strategic plan should align with the goals and plans of the organization. So it sounds like you're setting students up for success in the real world.

00:15:40 Speaker 2

Yeah, so, so let me just give you a quick overview of of what's presented, because I think that'll address part of your question. So that the students will present this risk assessment based on a template that we provide a slide by slide template. So they have, you know, direct guidance on what.

00:16:00 Speaker 2

The hypothetical audit committee that we use for the evaluation, what they're expecting, so it begins with an overview of the firm, but it's not the same overview that one would normally expect because we're talking to an audit committee. The audit Committee knows their firm.

00:16:16 Speaker 2

So there'll be a brief statement of what the firm strategy is and what their business objectives are, and then they'll launch into a synopsis of the competitors and any risk that the competition poses to the firm strategies. And then an analysis of external and internal events.

00:16:38 Speaker 2

That present risk to the firm, usually they they we try to get them to segregate those risks and to control by their controllable and non controllable nature.

00:16:49 Speaker 2

And then all the risks are then listed in descending order. This would be on a on a subsequent slide. All the risks are listed in descending order of severity, and the severity is would be defined as the likelihood of the risk occurring times, the impact the dollar impact of the risk.

00:17:09 Speaker 2

That would be the severity and then those are those risks are then displayed top down in descending order, highest risk.

00:17:17 Speaker 2

Severity first, all the way down through the the most critical risk. Usually we try to limit because the the presentations could extend over a long period of time. We try to limit the number of critical risks to about 6:00 so that we can get they can get through the presentation in about 1/2 an hour. As it is the class.

00:17:37 Speaker 2

The class where we do the presentations tends to go extremely long, so we need to keep it as short as possible.

00:17:45 Speaker 2

Included also would be a a heat map, maybe others would call it a four blocker where in the upper right hand quadrant of the block of the heat map there would be the critical risk based on impact and likelihood the final slide.

00:18:05 Speaker 2

Would show the actual projects that would be done as part of the audit plan. They would schedule the projects, what quarter of the upcoming year the projects would be performed.

00:18:16 Speaker 2

And the the the scope and purpose of each of the projects as well as the the risks that would be addressed by each. The teams not only make the presentation, but they also prepare a written report to document the results of their oral presentation. So when I do the final grading.

00:18:36 Speaker 2

You know, based on the critique of the audit committee, if there's anything that I didn't pick up on in the presentation, I can always reference that in the written report as well. So that the grading is there.

00:18:49 Speaker 3

That it sounds like these students are getting so much hands on experience. The real day-to-day work that they're hopefully going to be doing and an internal audit career. Have you got any success stories, any feedback from your students who completed the course that went on to have a career in internal audit or even elsewhere? What are?

00:19:07 Speaker 3

You hearing from them?

00:19:08 Speaker 2

Yes.

00:19:08 Speaker 2

I I think that's a great question. I think one of the most rewarding things about this is the fact when when students complete this course, there's usually 10 to 15%.

00:19:18 Speaker 2

Of them take Part 1 of the CIA exam. Love that, and they don't really do much study beyond what they've learned in the class, and the vast majority of them actually pass actually passed that first part to the exam, and I sell it in class as a great resume builder.

00:19:21 Speaker 3

Oh I.

00:19:38 Speaker 2

And what better asset I guess or to add to your resume than to show that you have the initiative?

00:19:46 Speaker 2

You know, and the aptitude to take a professional exam and to pass it. So again, a number of our students go into the profession, but not the usual way one would think. Some have gone into internal audit departments, but most tend to go to public accounting firms.

00:20:06 Speaker 2

They go to work for public accounting firms, but they don't do financial auditing. They're doing risk advice.

00:20:13 Speaker 2

Misery and assurance work on a consulting basis and a couple of our students, our senior managers, now for a major CPA firms and are on our partner track.

00:20:26 Speaker 1

Yeah, we, we.

00:20:28 Speaker 3

We found the profession got to do a better job of telling our students that there are opportunities at public.

00:20:33 Speaker 3

Accounting firms, but in internal audit in risk and advisory, I think sometimes there is this perception that you have to go one or the other, right? Like I'm going to do external audit or I'm going to do taxes.

00:20:44 Speaker 3

Is for a public accounting firm or I'm going to go do internal audit with an organization. But you actually can do both in one area you can have.

00:20:53 Speaker 3

The best of both worlds.

00:20:55 Speaker 2

Yeah. And I think that, you know, many of the many of the companies outsource their internal lot of work anyway. So there's another Ave. for students. That's not to say I don't wanna. I wanna leave the misimpression that our students aren't going to turn lot the apartments. But I I just want to point out that I see a great number of them move into CPA firms.

00:21:15 Speaker 2

As well, and again, not necessarily doing financial audit work, but internal audit work on a consulting basis.

00:21:23 Speaker 3

I love that. So it sounds like you guys are leading, you know, the way in terms of internal audit education, which is probably why you're a center of excellence school. What advice would you have for other professors, universities that want to incorporate internal audit into their curriculum?

00:21:39 Speaker 2

Yeah. That's another great question. Yeah, as I mentioned earlier, you know, I I.

00:21:45 Speaker 2

We relied when we set up our internal audit program, we relied heavily on the IIA's global model internal audit curriculum.

00:21:57 Speaker 2

And that's that should be the starting point is to is to look for that. That curriculum contains, you know, sample learning objectives and content recommendations for six core courses, 6 supplemental courses. You know covering a wide range of internal audit.

00:22:16 Speaker 2

Knowledge and skills, you know from business communications all the way to, you know, fraud and forensics.

00:22:23 Speaker 2

So I would you know, I would suggest that they start there, develop their curriculum once the curriculum is in place, you know to coordinate with the IIA's internal auditing Education Partnership program, you know, to confirm the structure and the quality of their curriculum.

00:22:43 Speaker 2

And you know, to get on a on a, on a track, a fast track, one would hope a fast track to becoming an internal audit center of of excellence.

00:22:54 Speaker 3

I love that. I promise our listeners, I did not pay him to say that. So thank you so much because I agree there are so many great resources available for free.

00:23:03 Speaker 3

To academics who want to share this information with their students, you know, the textbook case study.

00:23:08 Speaker 3

Please so please reach out if that's something that you're interested in. Dennis, is there anything else you would like to add? You'd like our audience to know?

00:23:17 Speaker 2

There's a great opportunity for universities to build out their business curriculum and attract students that are interested in not just accounting and auditing, but also the operations, the operational and compliance risk of companies and the students.

00:23:38 Speaker 2

Would benefit by a broader curriculum that would address these issues.

00:23:43 Speaker 2

Those issues that I just mentioned, operational risk compliance risk in addition to financial risk and you'll see that students will be attracted to programs that have that in their curriculum. And in fact, we've seen it a large.

00:24:03 Speaker 2

Increase in our MBA program.

00:24:06 Speaker 2

And in our masters in accounting program, by offering the internal audit curriculum don't offer, agree on it. But we do offer the courses that are also integrated into our our curriculum so.

00:24:23 Speaker 2

So it's it's, it's bent, there's a there's a mutual benefit here to for the students and for the.

00:24:28 Speaker 2

City.

00:24:29 Speaker 3

I absolutely agree. Again, love hearing you say that because as we're seeing you know, universities have that decline in enrollment in their accounting majors, something that I just preach over and over is that we can succeed together by promoting other opportunities beyond just public accounting and public accounting is a great career. As I mentioned, I'm a CPA.

00:24:51 Speaker 3

You know you're a CPA for many individuals, but for those students who may not want to go in public accounting by promoting these other areas, you know, internal audit risk management, advisory services management and.

00:25:04 Speaker 3

Wanting even, you're opening up the door to more students and you can help you know your own enrollment in that way. So love to hear you say that. Thank you so much for joining us today. Dennis, I really appreciated it and I hope that some of our other educator members and just educators can take some of the advice.

00:25:24 Speaker 3

And experience that you've had and take that back to their schools to grow awareness of the profession too.

00:25:29 Speaker 2

Well, thank you very, very much for having me today, Lindsey, appreciate it.

00:25:34 Speaker 1

Want fresh ideas and real takeaways for your GRC role? Join the 2025 GRC conference from August 18th to the 20th in New York, or virtually packed with informative sessions and useful tools. The conference offers up to 24 CPE's snag your spot now with theia.org.

00:25:55 Speaker 1

If you like this podcast, please subscribe and rate US. You can subscribe wherever you get your podcasts. You can also catch other episodes on YouTube or at the iaa.org that's theia.org.