internal audit strategy for non-profits
Post on 15-Aug-2015
51 Views
Preview:
TRANSCRIPT
Internal Audit Strategy and Risk Approachfor Not for Profit OrganizationsA practical model
Debashis GuptaIndia
April 2, 2015Debashis Gupta
Discussion Points
Internal Audit Context Conceptual framework Model Resourcing Process Risk
Debashis Gupta
Context
1. Wide geographical distribution of project/program sites/units
2. Range of programs/themes – research, publication, participatory action research, community capacity building…
3. Range of program delivery mechanisms4. Range of network, collaborations and
funding mechanisms, with associated stakeholder demands
5. Volunteers, partners (with/without formalized arrangements)Debashis Gupta
Myriad Stakeholder concerns
1. Range of stakeholders – network/ collaborators, donors – bilateral, multilateral, Foundations, private…
2. Range of funding mechanisms/windows – earmarked/non-earmarked…
3. Associated delivery commitments/ performance agreements…
4. Results frameworks, independent evaluations
5. Reporting obligations
Debashis Gupta
What this means for Internal Audit (‘asks’)
1. Range of program management/ control & governance structures, including at partner organizations, to be considered
2. Impact on beneficiaries/communities
3. Need to ensure continuity of programs
4. Frequently, lack of recourse
(legal/other) e.g. reg. volunteers
Debashis Gupta
Internal Audit – Walking a tightrope
Multiple stakehol
ders
Financial recording
& reporting
Cost Mgt.
Special projects/ initiatives
Risk
Mgt.
Ethical conduct
Partners
Volunteers
Juggling with sometimes conflicting priorities in a dynamic environment…
Internal Audit - expectationsIn uncertain times how does a modern day IA function add value to the Audit Committee/ Board of Directors?
93% of respondents agreed or strongly agreed that the IA function could add value by o Greater level of
engagement with stakeholders
o Enhance focus on compliances
o Closer monitoring of critical processes to isolate outliers
o Adopting a leaner approach to audit by focusing on high risk areas.
Source: IIA survey 2012
How Internal Audit copes (response)
1. Put beneficiaries/communities first2. Substance over form 3. Intent & transparency vs. procedure4. Assurance strategy – convergence/
synergies (IA, Monitoring, Evaluation,…)5. Capacity building (consulting role)
Debashis Gupta
Internal Control & Governance Frameworks & models
1. COSO Internal Control Framework (now COSO 2013 ver.) – endorsed for SoX
2. CoCo (Canada)3. Continuous Control Monitoring (CCM) &
Continuous Audit (CA) models/systems4. Risk Management & Governance f/ws:
ISO:31000 Kings (IOD SA) COSO ERM Cadbury 3 Lines of Defence
Debashis Gupta
Internal Audit model(Things to set)
1. Governance: Vertical & lateral inter-relationships and reporting (ensuring IA independence & objectivity):
Board of Trustees/Governors/Directors (individual entity-level)
Group/Network-level Collaboration – other auditors/evaluators
2. Structure: Level of delivery/execution (with associated frequency):
Local/Project execution-level (Operational) Regional and/or HQ (often Strategic)
(IIA IPPF-sensitive)Cont’d…
Debashis Gupta
Internal Audit model(Things to set)
3. Assurance promise (% mix): Financial (inputs) Program (outputs and/or outcomes)
4. Resourcing: Mix of internal & co-sourced, local and global
5. Process: Risk focus at all stages Planning (focus on significant risks) Execution/delivery (focus on key controls) Reporting (risk/objective-focused) Issue tracking (with consequence mgt.)
6. Consulting – Control & risk (facilitation)
Debashis Gupta
Internal audit - Evolution
Compliance-focus to Control-focus Control-focus to Risk based audit (RBA) RBA to objective-centric (risk cumulative),
enterprise-wide focus Risk/objective-based to Performance-centricPath – along the maturity scale as per IIA:Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.
The Institute of Internal AuditorsDebashis Gupta
Internal Audit – Evolution
Traditional transaction-based compliance auditing
Risk-based audit scoping + Process and transaction audits
Process audits & Risk-based audits
Risk-based internal audits – based on enterprise risk register
Audit of Enterprise Risk Management framework
Debashis Gupta
Internal Audit
Resourcing Strategy – Possible model1. Local – outsourced on ‘Co-sourcing’ model
(where appropriate resources available)
2. Centralised unit capacities to be built up for:A. Review of strategic & sensitive functions/projectsB. Improved monitoring of co-sourced auditorsC. Review of policies & processesD. Facilitating new initiatives e.g. control self
assessment, risk management
3. Explore potential to involve ‘guest’ auditors across regions/functions.
Debashis Gupta
Outsourced vs. Co-sourced audits
Outsourcing Org. agrees audits, auditor devises audit plan, programs,
report. Audit monitoring solely by auditor Working papers (WPs) not shared by auditors Audit wrap up & action finalisation by auditors
Capacity enhancement auditor responsibility
Co-sourcing Org. devises audit plan, jointly develops audit programs,
reporting. Active audit monitoring by Org. WPs reviewed by Org. and available on demand Org. actively participates in joint wrap up & agreement
on actions Org. arranges/ participates in training of auditors
Debashis Gupta
Internal Audit process
Planning1. Wide coverage – aim to cover all
significant locations and processes in multi-year cycle (e.g. once every 3 yrs)
2. Focus on fostering efficiencies/cost savings & best practices.
3. Project /program audits at various stages – planning, execution, closure
4. Supporting functions coverageKey: Risk weightage
Debashis Gupta
FY ..AuditPlan
Risk Assessment -Interviews with Management
Risk Assessment - Survey of Process
Owners
IntegratedTeam - Risk Assessment
ProcessUniverse
PrioritizeAudit Areas &
Draft Plan
Endorsement of key
stakeholder
Previous Internal Audit Reports
INPUT OUTPUTPlanning Process
LocationUniverse
Unit/Process RiskUniverse
Validate:
FormalApproval
Internal Audit Planning ProcessRisk based audit scoping – a model
Debashis Gupta
CO
MM
UN
ICATIO
N
PROCESS / PROCEDURAL CONTROLS
MONITORINGCONTROLS
Control environment
Con
trol e
nviro
nmen
t
INTERNAL AUDIT PROCESS – EXECUTION
PROCESS / PROCEDURAL
CONTROLS
Key controls, contributing to mitigation of the most significant risks identified and assessed for evaluation of control existence, efficacy and implementation.
Debashis Gupta
RISK BASED INTERNAL AUDIT – Purpose
Purpose of risk based internal audit is:
• To provide assurance on the effectiveness of controls and the management of risks to assist the company in achieving its objectives.
• To improve the company’s operations by adding value, supporting management and providing a platform for learning.
Debashis Gupta
Internal Audit & Risk
Traditional Internal audit model
Controls assurance based on cyclical or routine audit plans
Improvedinternal audit model
Controls assurance based onrisk-based internal audit plan
Risk-centricinternal audit model
Assurance on the effectivenessof risk management in additionto controls assurance
Debashis Gupta
Risk convergence
Internal Audit Compliance Risk Management
Internal Audits
Cost efficienc
y
Laws & regulations
Anti Fraud
Privacy
Program/Project implementation
Business
• Lack of co-ordination • Competition for attention
• Risks falling through cracks • Duplication of efforts
Debashis Gupta
Using a standard framework
How the complexities are being overcome by organizations
Internal Audit Compliance Risk Management
Objective setting Risk ID Control IDDeficiency
management
Business Functions
• Creating structure across/within functions, businesses and regulatory requirements
• Aligning with management & regulatory expectations• Choosing the right place to start: new and developing functions, union of
similar silos, areas rife with duplication, integrated/related environmentsDebashis Gupta
ENTERPRISE RISK MANAGEMENT(ERM)
Context & reportingOften required, confirmation by Board on:Continuous monitoring of risk management
system and satisfaction with current risk mitigation measures
Responsibility for ensuring an appropriate risk management process
Risk management aimsRisk mitigation strategies & practices.
lot of ask!
Debashis Gupta
Risk is the effect of uncertainty on objectives.- ISO 31000:2009
Risk is the chance of something happening that will impact objectives.
- AS/NZS 4360:2004Thus, risk can be defined as the potential for loss caused by an event (or a series of events) that could adversely affect the organisation's ability to achieve its objectives, or something that diminishes the effectiveness of the organisation.
Risk can be a HAZARD but can also enable the organisation to take full advantage of OPPORTUNITIES.
DEFINITIONS OF RISK…
Debashis Gupta
Risk Complexity
Key Characteristics Internal Audit Approach
Risk Naïve No formal approach developed for risk management
Promote risk management and rely on audit’s risk assessment
Risk Aware Scattered silo based approach to risk management
Promote enterprise-wide approach to risk management and rely on audit’s risk assessment
Risk Defined Strategy and policies in place and communicated. Risk appetite defined
Facilitate risk management/liaise with risk management and use management’s assessment of risks where appropriate
Risk Managed Enterprise wide approach to risk management developed and communicated
Audit risk management processes and use management’s assessment of risk as appropriate
Risk Enabled Risk management fully embedded into the operations
Audit risk management processes and use management’s assessment of risks
ERM Continuum
WHERE ARE WE ON THE RISK MANAGEMENT CONTINUUM?
Debashis Gupta
Risk Management Framework-1
1. Articulate business objectives
2. Assess significant risks across entire spectrum
4. Ensure alignment of objectives, risks & controls across the enterprise
3. Build in balanced controls to manage business risks
ERM methodology primarily based on COSO* framework
* Committee of Sponsoring Organizations (COSO) of the Treadway CommissionDebashis Gupta
ERM – Possible Roadmap
1. Developing a Risk Management Policy2. Developing a Risk Management
Framework covering:Structure, roles & responsibilitiesMethodologies, systems & toolsProcesses of risk identification, assessment,
prioritization, monitoring & reporting (in line with preferred framework e.g. ISO:31000 or COSO-ERM)
Cont’d…
Debashis Gupta
ERM – Possible Roadmap…3. Formal enterprise risk management
strategy can follow a two-pronged approach:
Risk management by process owners Risk identification, assessment & reporting
by ‘risk officers’ & ‘coordinators’ (existing functionaries co-opted in an ‘embedded’ role) facilitated by a nodal dept. (IA/ERM?) Identify the critical risks that the organisation is
facing, current or recommended actions to address these
Devise plans to continuously monitor and report on the most critical risks.
Cont’d…Debashis Gupta
ERM – Possible Roadmap…
4. Formal reporting on risk profile to Board/s (at least annually) - Risk review which identifies key risks across the company e.g.
Governance Risk Strategy and Policy Risk Funding risk (e.g.Risk of Dependency on too
few source/s of income/revenue/funding) Financial Management Risk PR and external communications Risk
Cont’d…
Debashis Gupta
ERM – Possible Roadmap…
5. Once ERM is fully rolled out, and all aspects of the ERM process are handed over to management consequent to the organization gaining the requisite degree of maturity on the risk management continuum, the role of Internal Audit can be limited to auditing the implementation of the ERM framework.
Debashis Gupta
ERM – Possible Roadmap…Process Business
Owners-M1 Leaders
RC*- CO M11
RC*- CO M12 RO*- Region M1
RC*- CO M13IA/ERM Nodal Committee
RC*- CO M21RO*-Region M2
RC*- CO M22
*RC = Risk Coordinator Process BusinessRO = Risk Officer Owners-M2 Leaders
Risk Identification Risk Assessment Risk Reporting
Bus
ines
s F
unct
ions
Debashis Gupta
Step# Description Responsibility Date agreed
1 Identify the key processes carried out within the business
Group ???
2 Identify the main purpose/objective of each of the key processes
Group ???
3 Map each key process at sub-process/activity level
Respective dept.
???
4 Develop risk rating scale for each process IA/ERM ???
5 Identify & prioritise key risks of each process (facilitated by IA/RM, if required)
Respective dept.
???
6 Identify mitigating measures in place/ proposed for each key risk
Respective dept.
???
7 Presentation of key risks and associated mitigating measures to MCT
Respective dept.
???
ERM – Possible Roadmap…
Debashis Gupta
top related