The RMC Advisors

The RMC Advisors is Moving to M&A News

Change.  The nature of the world is change; if we don’t grow, well, bad things can happen.

The RMC Advisors blog is ready to grow and become more than it was!  We are joining with the main news site on our home site, McKonly & Asbury News!  A new house, a new look, and to be honest, a much larger kitchen with new countertops.

While we hate to move and change our address (we hate missing mail), the reality is that this is best for you, the reader.  The McKonly & Asbury News site will have our articles, of course, but it will also have other subject matter to bring new, different, and interesting content straight to your desktop. 

In an effort to make this transition process as easy as possible for you, we will automatically transfer your subscription from The RMC Advisors to the McKonly & Asbury News site, as well as our bi-weekly newsletter which keeps you up-to-date on the latest business and financial information across all of our news sites.

We look forward to seeing you there, and tell your friends so they don’t get lost going to our new place of posting.  We promise to keep you subscribed as long as you want, and we hope you like the new format as much as we do.

All the best and see you soon,
The RMC Advisors

Internal Audit Insight

The IIA defines insight as an “end product or result from internal audit’s assurance and consulting work.  Insight can involve ‘connecting the dots’ (i.e. identifying the entity-level root causes of control concerns, emerging risks, or significant opportunities to improve the entity’s governance process) to deliver value-added results to key internal audit stakeholders.”

The Institute of Internal Auditors Research Foundation (IIARF) surveyed and interviewed board members, audit committee members, executive management, and internal auditors on insight.

The results noted insight is important to stakeholders with 90% of survey respondents noting that internal audit should deliver insight.  Unfortunately, only 72% of respondents agreed that internal audit functions provide insight identifying a gap between expectations and performance.

Respondents noted that internal auditors have significant finance and accounting experience but sometimes lack the operational experience to fully understand business strategies and challenges and provide insight.  Also, respondents desired internal audit focus more on helping improve the business than catching mistakes.

COSO Framework Draft Update

The Committee of Sponsoring Organizations of the Treadway Commission (COSO) recently updated its Internal Control Integrated Framework (Framework) to ensure it remains relevant in the changing business environment.  A Draft for Public Exposure is currently available on COSO’s website.

Key items of the Framework have not changed in the updated version including the core definition of internal control, the three control objectives, and the five components of internal control.  If your Company already has an effective internal control system, you will not need to make any significant updates under the updated Framework.

The updated Framework includes codification of the internal control concepts introduced in the original Framework. The codification occurs within the five (5) categories of control environment, risk assessment, control activities, information and communication and monitoring activities. The following is a summary of the seventeen (17) internal controls principles.

Chief Audit Executives – Appointment, Performance Evaluation, and Termination

This article covers the various factors senior management and the board of directors should consider when appointing, evaluating, or terminating the Chief Audit Executive (CAE). The position of the CAE is important and requires independence and objectivity while also partnering with the organization and adding value.

Appointing a CAE

CAEs should demonstrate the following soft skills:

• Ability to accurately assess situations and instinctively do the right thing even under resistance

• Good judgment and character strength
• Integrity

In addition, effective CAEs possess the following attributes and skills:

• Independence and objectivity
• Intellectual curiosity
• Quality focused
• Business and technical skills
• Communication and listening skills
• People management

Assisting Small Internal Audit Activities in Implementing the Standards

The International Professional Practices Framework (IPPF) and underlying International Standards for the Professional Practice of Internal Auditing (Standards) provide guidance to the internal audit activity. The Standards are applicable to all internal audit departments regardless of size, level of resources, complexity, or objectives and scope. Small audit activities face some unique challenges when implementing the Standards. Typically, a small audit activity has one or more of the following characteristics:

• One to five auditors
• Productive internal audit hours below 7,500 a year
• Limited level of co-sourcing or out-sourcing

Standards with a High Degree of Challenge for Small Audit Activities

The Practice Guide notes the following standards for which small internal audit activities face a high level of challenge when implementing:

• 1100 – Independence and Objectivity
• 1300 – Quality Assurance/Improvement Program
• 2000 – Managing the Internal Audit Activity
• 2200 – Engagement Planning
• 2300 – Performing the Engagement

These challenges are most likely to affect small internal audit activities, but they may affect internal audit activities of any size. This paper will review each of these standards, identify challenges to meeting the standard, and provide guidance to mitigate these challenges.

1100 - Independence and Objectivity

Standard:  The internal audit activity must be independent, and internal auditors must be objective in performing their work.

Challenge: Auditors may have operational responsibilities such as records management, compliance, IT security, risk management, or other finance and accounting activities.  The Chief Audit Executive (CAE) may report to an individual who has direct responsibility for areas that are subject to audits.

Guidance:  Internal audit should explain to the board the difficulties involved with auditing areas where operational responsibilities or chain of command cause independence issues. They should recommend alternatives for audits such as, using external resources, and verifying only auditors that are not involved with the operational activity complete and review the audit. The CAE should discuss any challenges relating to the reporting structure or operational duties with the board and/or senior management when establishing the audit plan. If internal audit issues a report where there is a lack of independence and objectivity, the audit report must disclose this condition along with the related impacts.

1300 – Quality Assurance/Improvement Program

Standard: The CAE must develop and maintain a quality assurance and improvement program that covers all aspects of the internal audit activity.

Challenge:  Lack of financial resources may limit the ability to perform an external or internal quality assessment (QA) in accordance with the Standards.  The performance of an internal QA may be challenging due to time and staff constraints.

Guidance: Small organizations may use peer organization reviews or self-assessment with external validation to satisfy the external QA requirement.  These approaches will have a lower monetary cost but will require a larger amount of internal audit staff hours.  Organizations may consider utilizing employees outside of the internal audit activity for internal assessments if they have prior audit experience or QA training.

Internal Auditing and Fraud

This practice guide summary will discuss how Internal audit can add value to the organization through its role in helping to deter and identify fraud. Fraud results in negative financial, reputational, psychological, and social effects on an organization.  To minimize the risk associated with fraud it is important for organizations to have a strong fraud program that includes awareness, prevention, and detection programs.

Fraud Awareness

Fraud schemes are often ongoing and can last for months or years. Employees commit fraud when they have access to confidential information and internal controls are inadequate or management can override controls without question.

Most frauds have the following characteristics:

• Pressure or incentive – need the fraudster is trying to satisfy by committing the fraud.
• Opportunity – the fraudster’s ability to commit the fraud.
• Rationalization – the fraudster’s ability to justify the fraud in his or her mind.

There are often red flags to indicate individuals might be committing fraud such as spending lavishly, becoming more secretive of their activities, and reluctance to take vacation or sick time.  While none of these red flags means an employee is actually committing fraud, a combination of occurrences may indicate the need for inquiries and increased audit attention.

Assessing the Adequacy of Risk Management

Recently, there has been an increased focus on the importance of managing risk as part of an overall strong corporate governance and enterprise risk management (ERM) program. With this new emphasis comes a responsibility for Internal Audit to assess the effectiveness of the risk management strategy within the organization. Though there are multiple risk management frameworks, this guide uses ISO 31000 as the basis for the risk assessment. This article discusses management’s role and the types of approaches for Internal Audit to measure the effectiveness of risk management within their organization.

The organization should not conduct the ERM process in isolation. Instead, involve all key stakeholders and use the following control-based assurance framework:

• Effectively identify and appropriately analyze risks.
• Implement adequate and appropriate risk treatment and control.
• Management effectively monitors and reviews processes to detect changes in risks and controls.

The organization’s ERM approach should change over time as internal and external factors change.  For example, changes may occur due to the arrival of new personnel, changes in entity structure, new processes, and if the business objective changes. In the same way, the assessment of the ERM process must occur on an ongoing basis.

Responsibilities

Management is responsible for determining the organization’s risk attitude and the Board is responsible for determining if the risk attitude supports the best interests of stakeholders.  Internal Audit should assess whether the company’s framework takes into consideration and defines risk management responsibilities and strategy, and whether the elements of the framework allow for building a risk-smart environment while still allowing for responsible risk-taking.

Monitoring and Assurance

Organizations must monitor risk management systems to ensure they are performing as intended.  Most organizations accomplish monitoring through ongoing activities, separate evaluations, or a combination of these two methods. Ongoing monitoring is often most effective since it is completed on a real-time basis, can react dynamically to changing conditions, and is ingrained in the organization.

Line management, internal audit, risk management specialists, and the compliance function often share the monitoring responsibility. As a result, it is important for the organization to coordinate assurance activities to ensure it uses resources efficiently and effectively.

Practice Guide Series - Introduction

The IIA’s practice guides [i] provide detailed guidance for conducting internal audit activities. They include detailed processes and procedures, such as tools and techniques; programs; and step-by-step approaches, as well as examples of deliverables.  This is the first in The RMC advisors series on the practice guides.

Formulating and Expressing Internal Audit Opinions[ii]

Internal auditors generally provide opinions for each audit and it can often be a challenging task to ensure the opinion provides all the necessary information to meet stakeholders’ objectives.

Planning

Auditors should determine stakeholder requirements for audit opinions including the level of assurance required before beginning an audit.  Careful planning and development of an audit plan helps to ensure the auditor obtains sufficient evidence to support an opinion. Audit plans and opinions must consider the scope of work performed.  Common elements to consider when defining the scope include:

• Descriptions of the portions of the organization being covered;
• Control components covered by the audit;
• The point in time or the time period over which the opinion is expressed.

Types of Opinions

Opinions generally fall into one of the following categories:

• Macro-level – broad level for the organization as a whole
• Micro-level – individual components of the organization’s operations 

Macro-level opinions are more complex and may require aggregation of findings from several audits, incorporation of evidence obtained through less formal means, and consideration of evidence obtained through reliance on the work of others.  Recent surveys indicate that most audit organizations issue micro-level audit opinions.

Generally, stakeholders request that internal audit activities provide positive assurance opinions.  A positive assurance opinion involves the auditor taking a definite position (i.e. internal controls are or are not effective), provides the highest level of assurance, and requires the highest level of evidence.  Positive assurance opinions imply the auditor gathered sufficient evidence to provide reasonable assurance that they would identify evidence contrary to the opinion if it existed.  Opinions can be qualified if there is an exception to the general opinion (i.e. controls were satisfactory with the exception of accounts payable controls, which require significant improvement).

In contrast, a negative assurance opinion is a statement that nothing came to the auditor’s attention about a particular objective (i.e. the effectiveness of a system of internal control).  The internal auditor takes no responsibility for the sufficiency of the audit scope and procedures to find all significant concerns or issues.  In general, this opinion is less valuable than positive assurance.

Results

Developing criteria framework can help achieve the objective of providing a valued opinion. This framework provides a baseline against which to apply measurement and judgment to evidence obtained in the course of the audit.  When establishing suitable criteria, it is important to determine if the organization has established basic principles regarding what constitutes an appropriate governance, risk management, and control process. These criteria may include:

Fourth Annual TRENDS Symposium – June 3, 2011

McKonly & Asbury, LLP and McConkey Insurance & Benefits are pleased to sponsor 2011 TRENDS IV. This symposium will take place at the Radisson Penn Harris Hotel & Convention Center at 1150Camp Hill Bypass in Camp Hill, PA on June 3rd! The $50 fee includes 6.5 CPE credits, a continental breakfast, breaks and lunch. To reserve a seat, please contact Erin Hench at ehench@macpas.com or by calling 717-761-7910.

We have an exciting array of speakers and topics planned which are based on comments we received from previous year participants. The following provides the agenda for the day and more information on the speakers and their presentations.

Fourth Annual TRENDS Symposium – June 3, 2011

Join McKonly & Asbury on Friday, June 3, 2011 for our fourth annual TRENDS symposium focusing on accounting and audit issues for the insurance industry. The session provides 6.5 CPE credits, which includes 1 tax credit and 1 ethics credit. McKonly & Asbury is an approved continuing professional education program sponsor through the Pennsylvania State Board of Accountancy.

We have an exciting array of speakers and topics planned, based on comments we received from previous participants.

• Legislative Update - Patricia Vance, Pennsylvania State Senator and member of the Pennsylvania Banking & Insurance Committee.
• Insurance Department Update - Stephen Johnson, Deputy Insurance Commissioner, and David DelBiondo, Director, Bureau of Financial Examinations.
• Tax Update – McKonly & Asbury Tax Group
• Business/Professional Ethics – Elaine Nissley, MBA, CISA, PMP, CCSA, CRISC, Principal, McKonly & Asbury Risk Management Services Group.
• Cloud Computing & Social Media: Risks and Controls - Samuel BowerCraft, MIS, CISA, Senior Manager, McKonly & Asbury Risk Management Services Group.
• Reinsurance –Jane Taylor, FCAS, MAAA, JD, Consulting Actuary, Huggins Actuarial Services.
• Safeguarding Confidential Data – John Dormuth, MSIM, CPCU, ARM, Account Executive, McConkey Insurance & Benefits. 

Sponsored by McKonly & Asbury and McConkey Insurance & Benefits, the symposium will take place at the Radisson Penn Harris Hotel & Convention Center at 1150 Camp Hill Bypass in Camp Hill, PA on June 3rd!

Agenda and Details

• June 3 (Friday)
• Registration starts at 7:30am
• The seminar will run from 8:00am to no later than 4:00pm. 
• Radisson Penn Harris Hotel & Convention Center (Camp Hill)

The cost to attend is $50, which includes a continental breakfast and lunch.

To register, please contact Erin Hench at ehench@macpas.com or by calling 717-972-5814.