How Time Flies:Leadership Insights from aCareer in Internal Oversight

IIA Chapter EventOlympia WA

9 December 2015

Carman L. LapointeUnder-Secretary-General for Internal Oversight (Retired),

United Nations Secretariatcarmanly@vacoxmail.com

Overview

• A bit of context—a few examples of what the UN does• Internal Oversight in the UN context• How I got hooked on internal auditing• Why you should care about it• Lessons learned on my (long) watch

that might be useful…

All in a day’s work for the UN

• Feeding 90 million people in 75 countries• Assisting 34 million fleeing refugees• Vaccinating 58% of the world’s children• Monitoring 80 Human Rights treaties• Aiding 12.5 million victims of emergencies• Peacekeeping in 16 operations ($22

million/day)• Plus poverty reduction, maternal health,

climate change and much, much more

UNODC Combats Organized Crime

HumanTrafficking

Money Laundering

Illicit Crop Replacement

United Nations Landmine Assistance• 110 Million Landmines in

68 countries, and as many stockpiled

• 2,000 fatalities or serious injuries every month

• For every mine cleared, 20 are laid

• Used for terrorism and denying access to land, water, roads, utilities

United Nations Peacekeepers at work

• Peacekeeper on Patrol in DRC Women discussingPeacekeeping strategies

(UNICEF/DRCongo)

Average # lives lost per year in first 43 years: 20

Last 10 years: 118

Refugees and Humanitarian Aid

Line-ups for UNHCR services

A Somali boy in an IDP settlement in Mogadishu, Somalia. Credit: AU/UN IST/Price

Emergency Operations in HaitiCholera Patient Consultation Only 30% have

direct access to potable water; only

25% to sanitary toilets

9,000 deaths and 800,000 casessince 2010; 1,000 new cases per

week in 2015 in Haiti

Rule of Law and Development projects

Rule of Law: Monitoring Conditions in Women’s Prison in South Sudan

Irrigation Project in developmentdoubles as fish farm

The UN is Risky Business…on a grand scale

• But it all has to be managed and supported too• Administrative functions related to operations• $55 Billion pension fund that operates in most countries

and currencies• In short, the UN faces risks no other organization would

contemplate• Factor in a governance structure comprised of 193 member

governments, all trying to micro manage by consensus• New mandates, none dropped, no new funding• no new funding,

160 Posts (NY, Geneva, Nairobi,Peacekeeping Missions)

90 Posts (NY, Vienna, Nairobi, Peacekeeping Missions)

26 Posts in NY

Executive Office

Front Office

16 separate funding sourcesAnnual resources: $50 Million

A Look at the Work ofOIOS in the UN

Internal Audit Results: Non PKO

Overall Ratings for 89 Reports Issued 2013-14

420 RecommendationsBy COSO Control Component

PKO Investigations Completed

Sexual Exploitation

& Abuse

Financial(Insurance

Fraud)

Inspection and Evaluation • Each evaluation begins with an inception paper• A program impact pathway (PIP) is developed,

usually for the first time (first deliverable)• Biennial reviews of self-evaluation capacity– Scorecards issued in 2013 and 2015

• Approximately 10 evaluations per year• Peacekeeping moving from location to thematic

evaluations (e.g. protection of civilians, prevention of Sexual Exploitation and Abuse)

Inputs Activities Outputs Outcomes Impacts

Resources we have, develop or adopt to do our work

Things we do day to day

Products we produce

Changes we influence

Long-term changes

Examples:Staff, $$$, procedures, systems,standards

Planning, recruiting, coordinating, consulting, supervising, QA reviews

Reports, results, advice, updates, summaries, recommend-ations

Assurance, informed decision-making, awareness

Stronger, more effective delivery of all programmes, improved lives

PIPs: Logical pathways to manage risks and measure success

Performance targets are set and monitored for each element; Used in OIOS divisions and for client

programs evaluated.

Legislated Reporting Requirement

Annual Financial Implications of OIOS workResults for 2013-2014 (US$ millions)

Fraud by external parties 3.3 Fraudulent staff claims, payroll fraud 0.8 Overpayments 4.5 Cost recoveries 5.3 Efficiency gains 0.1

Total US$13.8 M

Why does internal auditing matter?

• Accounting versus accountability• Internal auditing (IA) versus external auditing• IA as a leadership development program (CPC)• Learning opportunity for potential candidates

(World Bank guest auditor program)• Capacity Development as a contribution to the

profession (IIA Capability Model & World Bank)

How I got hooked on internal auditing

• The Kapuskasing “opportunity”• Export Development Canada role/condition• Four years of college in night school as single

parent• Special dispensation to write CIA exam• Involvement in Ottawa Chapter and at IIA Global

Lesson # 1: It’s never too late to make a career change; our lives are shaped by our choices

Positioning internal audit

• EDC and its TQM journey– Internal Audit as workshop facilitators– Results became basis of risk-based audit plan

• Bank of Canada (Canada’s central bank)– Basel Committee framework for evaluating internal

controls

• Canada Post (lean)• IIA CCSA designation developedLesson #2: Tailor audit language and processes to suit

your organization

Balancing Advisory and Assurance Roles

• Independence promotes objectivity• Independence does not require isolation• Involvement of CAE in strategic forums and

discussions, as observer and advisor• Assurance results backed by facts and evidence

Lesson #3: Resist isolating the audit function and ensure role clarity as observer/advisor versus

assurance

Focus audit work strategically

• Align risk-based audit plans to strategic challenges and emerging issues

• Collaborate with and leverage the work of other assurance functions (ERM, external auditors)

• Involve internal audit in early phases of key initiatives, before they become fatal

• Examples: air operations, waste management, UMOJA

Lesson #4: Don’t start from scratch, leverage competent, relevant work done by others

Communicate plans and results effectively

• Pursue risks that resonate with management and the Board (or Audit Committee)

• Never leave significance to interpretation; use ratings; follow up according to significance

• Beware of language that implies audit ‘ownership’ of the results (revealed, found, etc)Lesson # 5 (a): Don’t allow big issues to get lost in

the fog of ‘nitpicking negativity’# 5 (b): When things go wrong, it isn’t because we

‘found’ it; seek change, not credit for results

Lead by example

• Being accountable for our own results is the best way to demonstrate commitment & usefulness

• Develop KPIs that are relevant• Share targets and results @360°• Share results of regular quality assessments

Lesson # 6: A taste of our own medicine helps us appreciate the challenges faced by our clients

A taste of our own medicine…

OIOS Internal Audit PIP

15

0 20 40 60 80 100%

64

0 20 40 60 80 100%

74

0 20 40 60 80 100%

13

0 5 10 15 20%

58

0 20 40 60 80 100%

Indicator Measurement as of 30 June 2014

Acti

vity

1. % of audits for which final report is issued within 3 months of exit meeting Target 100%

2. % of engagements with elapsed time from entry

conference to exit meeting is less than 4 months Target 100%

3. % of audits for which charged auditor hours do not

exceed the planned budget by more than 10% Target 100%

4. % of total staff days spent on engagements vs. total

available days Target 90%

5. Staff vacancy rate

Target 10%

6. % of internal quality assessments with conclusions

of “generally conforms to IAD audit manual” Target 100%

To be assessed at end of 2014

QuarterlyActivityReportsincludeScorecard:

41 KPIs:IAD – 15ID – 14IED – 12

OIOS Scorecards: Measuring what matters

A word on politics (and surviving)

• Best to follow professional standards, be sure• Brief management and Board (or AC) on strategy• Know where you stand before making a stand• Involve CAE and management in critical issues early;

allow opportunities for action• Escalate issues as appropriate, and warn mgmt• Consider incentives for early resolution

Lesson # 6 (a): Bad news easier with a plan in hand#6 (b): Sometimes it is what it is, nothing you do will make it

easier; accept it & move on

One thought on our future role

• Periodic (annual?) overall opinions on internal control

• Comparable to external audit opinions• Requires rigorous planning and

professional execution • Adequate resources, clear basis and

limitations

Consider stakeholder expectations

Questions and comments

Thank-you!