The Cutting-Edge Auditor

The Cutting-Edge AuditorUnleashing Internal Audit’s ValueGALVANIZE A DILIGENT BRAND

Housekeeping Today’s session will be 50 minutes with 10 minutes for Q&A.Please submit your questions through the Q&A panel on yourGoToMeeting consoleThis session will be recorded. We will send a copy of the recordingand slides to all attendees.This session has been pre-approved for 1 NASBA CPE credit. To beeligible, you must complete all 3 polling questions and stay on theline for 50 minutes.GALVANIZE A DILIGENT BRAND

Learning Objectives How emerging technologies, like data analytics andautomation, are affecting the scope of Internal Audit Inspiring stories of forward-thinking audit teams who aremaking an impact What skills are required to become a cutting-edge internalaudit functionGALVANIZE A DILIGENT BRAND

Geoff Thomasson CPA, MBAClient Partner, GalvanizeGALVANIZE A DILIGENT BRAND

Agenda Death of the tickmark recapHas the tickmark died yet?Unleashing Internal Audit’s ValueOrganizations Biggest Risks and the focus of Internal AuditBringing it all togetherThe Internal Audit team built to add valueGALVANIZE A DILIGENT BRAND

Death of the TickmarkA quick recap GALVANIZE A DILIGENT BRAND

GALVANIZE A DILIGENT BRAND

GALVANIZE A DILIGENT BRAND

GALVANIZE A DILIGENT BRAND

GALVANIZE A DILIGENT BRAND

GALVANIZE A DILIGENT BRAND

Has the tickmark died yet?GALVANIZE A DILIGENT BRAND

GALVANIZE A DILIGENT BRAND

Why hasn’t the tickmark died?RegulationsGALVANIZE A DILIGENT BRAND

Why hasn’t the tickmark died?RegulationsExamples Sarbanes Oxley PCAOB Requirements Yellow Book/Government AuditingStandards IIA GuidanceGALVANIZE A DILIGENT BRAND

Why hasn’t the tickmark died?RegulationsChangeManagementExamples Sarbanes Oxley PCAOB Requirements Yellow Book/Government AuditingStandards IIA GuidanceGALVANIZE A DILIGENT BRAND

Why hasn’t the tickmark died?RegulationsChangeManagementExamples Sarbanes Oxley PCAOB Requirements Yellow Book/Government AuditingStandardsChallenges Access to DataManagement buy-inTeam SkillsBudgetWhere to start. IIA GuidanceGALVANIZE A DILIGENT BRAND

Why hasn’t the tickmark died?RegulationsChangeManagementExamples Sarbanes Oxley PCAOB Requirements Yellow Book/Government AuditingStandardsLack of ValueChallenges Access to DataManagement buy-inTeam SkillsBudgetWhere to start. IIA GuidanceGALVANIZE A DILIGENT BRAND

Why hasn’t the tickmark died?RegulationsChangeManagementExamples Sarbanes Oxley PCAOB Requirements Yellow Book/Government AuditingStandardsLack of ValueChallenges Access to DataManagement buy-inWhy automateTeam Skillsactivities, processes,Budgetor audits that do notWhere to start.add significant value? IIA GuidanceGALVANIZE A DILIGENT BRAND

POLL #1Where would you say your organization lies on theevolutionary scale of automating aspects of Internal Audit?A. We have no plans to automate any aspects of internal auditB. We have not automated internal audit processes, but hope to begin in the next 12 monthsC. We have begun to automate some internal audit processes, but are early onD. We are fairly well along on automating several internal audit processesE. We have a highly automated internal audit functionGALVANIZE A DILIGENT BRAND

Unleashing Internal Audit’s ValueGALVANIZE A DILIGENT BRAND

My 2 cents on valueGALVANIZE A DILIGENT BRAND

My 2 cents on valueProviding assurance over the organization's biggest risksGALVANIZE A DILIGENT BRAND

My 2 cents on valueProviding assurance over the organization's biggest risksProviding valuable insight by connecting data across systems,processes and teamsGALVANIZE A DILIGENT BRAND

My 2 cents on valueProviding assurance over the organization's biggest risksProviding valuable insight by connecting data across systems,processes and teamsImproving IA efficiency and increase assurance coverage with thesame level of resourcesGALVANIZE A DILIGENT BRAND

Organizations Biggest Risks and thefocus of Internal AuditGALVANIZE A DILIGENT BRAND

Protiviti’s Top Risks for 2021GALVANIZE A DILIGENT BRAND

Protiviti’s Top Risks for 20214 Strategic Risks5 Operational Risks1 Compliance RiskGALVANIZE A DILIGENT BRAND

Protiviti’s Top Risks for 20214 Strategic Risks5 Operational Risks1 Compliance Risk Artificialintelligence Robotics Processautomation Internet of things BlockchainGALVANIZE A DILIGENT BRAND

Protiviti’s Top Risks for 2021How many Internal Audit4 Strategic Risks5 Operational Risks teams are looking at theserisks?1 Compliance Risk Artificialintelligence Robotics Processautomation Internet of things BlockchainGALVANIZE A DILIGENT BRAND

POLL #2How well would you say audits at your organization covertop strategic risk areas?A. We do a great job of auditing areas of top strategic risksB. We do an adequate job of auditing areas of top strategic risksC. We probably don’t do a very good job of auditing areas of top strategic risksD. We do a poor job of auditing areas of top strategic risksGALVANIZE A DILIGENT BRAND

Let's make a bold assumption .GALVANIZE A DILIGENT BRAND

Most of Internal Audit time is focused onFinancial and Compliance RiskGALVANIZE A DILIGENT BRAND

Internal Audit Value TransformationLet's convert that tosome numbers GALVANIZE A DILIGENT BRAND

Internal Audit Value TransformationLet's convert that tosome numbers Risk AreaResource AllocationStrategic Risk10%Operational Risk10%Financial Risk40%Compliance Risk40%GALVANIZE A DILIGENT BRAND

Internal Audit Value TransformationBeforeNow let's flip it AfterRisk AreaTimeStrategic Risk10%Operational Risk10%Financial RiskCompliance Risk40%40%Risk AreaTimeStrategic Risk40%Operational Risk40%Financial Risk10%Compliance Risk10%To.GALVANIZE A DILIGENT BRAND

Internal Audit Value TransformationRisk AreaTimeStrategic Risk40%Operational Risk40%Financial Risk10%Compliance Risk10%But what about thestuff we used to do?GALVANIZE A DILIGENT BRAND

Internal Audit Value TransformationRisk AreaTimeStrategic Risk40%Operational Risk40%Financial Risk10%But what about thestuff we used to do?Automate 10%Compliance RiskGALVANIZE A DILIGENT BRAND

Internal Audit Value TransformationThen leverage Data &Human Insights to helpprovide new insights tostrategic and operationalrisksRisk AreaTimeStrategic Risk40%Data HumanInsightsOperational Risk40%Financial Risk10%Automate 10%Compliance RiskGALVANIZE A DILIGENT BRAND

POLL #3About how much time would you say your organizationspends auditing Strategic and Operational risk areas (asopposed to financial and compliance areas)?A. Less than 20% of internal audit’s audit time is spent on strategic and operational risk areasB. From about 20% to 50% is spent on strategic and operational risk areasC. From about 50% to less than 80% is spent on strategic and operational risk areasD. About 80% or more is spent on strategic and operational risk areasGALVANIZE A DILIGENT BRAND

Bringing it togetherGALVANIZE A DILIGENT BRAND

Bringing it together To unleash Internal Audit’s value, we need to focus on freeing up time to focuson the organization's biggest risks, while still increasing assurance overtraditional areas of financial and compliance risks.GALVANIZE A DILIGENT BRAND

Bringing it together To unleash Internal Audit’s value, we need to focus on freeing up time to focuson the organization's biggest risks, while still increasing assurance overtraditional areas of financial and compliance risks.Automated Testing &Continuous MonitoringGALVANIZE A DILIGENT BRAND

Bringing it together To unleash Internal Audit’s value, we need to focus on freeing up time to focuson the organization's biggest risks, while still increasing assurance overtraditional areas of financial and compliance risks.Automated Testing &Continuous MonitoringDrive efficiencyeverywhere GALVANIZE A DILIGENT BRAND

Bringing it together To unleash Internal Audit’s value, we need to focus on freeing up time to focuson the organization's biggest risks, while still increasing assurance overtraditional areas of financial and compliance risks.Automated Testing &Continuous MonitoringDrive efficiencyeverywhere Double down on thebiggest risksGALVANIZE A DILIGENT BRAND

Automated Testing & Continuous MonitoringTypically, there are more areas of automation with financial and compliancerisks. We need to focus on building analytics and continuous monitoring formore data focused processes.GALVANIZE A DILIGENT BRAND

Automated Testing & Continuous MonitoringTypically, there are more areas of automation with financial and compliancerisks. We need to focus on building analytics and continuous monitoring formore data focused processes.Adding more valuewith access reviewsGALVANIZE A DILIGENT BRAND

Automated Testing & Continuous MonitoringTypically, there are more areas of automation with financial and compliancerisks. We need to focus on building analytics and continuous monitoring formore data focused processes.Adding more valuewith access reviewsCritical IT SOXSupportGALVANIZE A DILIGENT BRAND

Automated Testing & Continuous MonitoringTypically, there are more areas of automation with financial and compliancerisks. We need to focus on building analytics and continuous monitoring formore data focused processes.Adding more valuewith access reviewsCritical IT SOXSupportSupporting HR withAutomationGALVANIZE A DILIGENT BRAND

Drive efficiency everywhere Let's free up our own time! We need look at the internal audit process, identifythe activities that take the most time and try to automate it.GALVANIZE A DILIGENT BRAND

Drive efficiency everywhere Let's free up our own time! We need look at the internal audit process, identifythe activities that take the most time and try to automate it.RequestsLeverage systems to help withrequesting and following up ondocuments, meetings, etcGALVANIZE A DILIGENT BRAND

Drive efficiency everywhere Let's free up our own time! We need look at the internal audit process, identifythe activities that take the most time and try to automate it.RequestsLeverage systems to help withrequesting and following up ondocuments, meetings, etcReportingLeverage systems create 1 clickplanning memos, progressreports, and audit reports.GALVANIZE A DILIGENT BRAND

Drive efficiency everywhere Let's free up our own time! We need look at the internal audit process, identifythe activities that take the most time and try to automate it.RequestsLeverage systems to help withrequesting and following up ondocuments, meetings, etc.ReportingLeverage systems create 1 clickplanning memos, progressreports, and audit reports.Follow upLeverage systems andautomation to follow up andreport on findings.GALVANIZE A DILIGENT BRAND

Double down on the biggest risksWith the time you have freed up leveraging automation, lets double down onreviews of your organization's biggest risks, combining human insights with data.We might need to leverage external firms, hire new resources, or work with thebusiness.GALVANIZE A DILIGENT BRAND

Double down on the biggest risksWith the time you have freed up leveraging automation, lets double down onreviews of your organization's biggest risks, combining human insights with data.We might need to leverage external firms, hire new resources, or work with thebusiness.Proving higher averageinsuree risk results in 50m settlementGALVANIZE A DILIGENT BRAND

Double down on the biggest risksWith the time you have freed up leveraging automation, lets double down onreviews of your organization's biggest risks, combining human insights with data.We might need to leverage external firms, hire new resources, or work with thebusiness.Proving higher averageinsuree risk results in 50m settlementFlight time roundingcauses millions inunbilled revenue andexcess maintenancecostsGALVANIZE A DILIGENT BRAND