The RMC Advisors

Practice Guide Series - Introduction

The IIA’s practice guides [i] provide detailed guidance for conducting internal audit activities. They include detailed processes and procedures, such as tools and techniques; programs; and step-by-step approaches, as well as examples of deliverables.  This is the first in The RMC advisors series on the practice guides.

Formulating and Expressing Internal Audit Opinions[ii]

Internal auditors generally provide opinions for each audit and it can often be a challenging task to ensure the opinion provides all the necessary information to meet stakeholders’ objectives.

Planning

Auditors should determine stakeholder requirements for audit opinions including the level of assurance required before beginning an audit.  Careful planning and development of an audit plan helps to ensure the auditor obtains sufficient evidence to support an opinion. Audit plans and opinions must consider the scope of work performed.  Common elements to consider when defining the scope include:

• Descriptions of the portions of the organization being covered;
• Control components covered by the audit;
• The point in time or the time period over which the opinion is expressed.

Types of Opinions

Opinions generally fall into one of the following categories:

• Macro-level – broad level for the organization as a whole
• Micro-level – individual components of the organization’s operations 

Macro-level opinions are more complex and may require aggregation of findings from several audits, incorporation of evidence obtained through less formal means, and consideration of evidence obtained through reliance on the work of others.  Recent surveys indicate that most audit organizations issue micro-level audit opinions.

Generally, stakeholders request that internal audit activities provide positive assurance opinions.  A positive assurance opinion involves the auditor taking a definite position (i.e. internal controls are or are not effective), provides the highest level of assurance, and requires the highest level of evidence.  Positive assurance opinions imply the auditor gathered sufficient evidence to provide reasonable assurance that they would identify evidence contrary to the opinion if it existed.  Opinions can be qualified if there is an exception to the general opinion (i.e. controls were satisfactory with the exception of accounts payable controls, which require significant improvement).

In contrast, a negative assurance opinion is a statement that nothing came to the auditor’s attention about a particular objective (i.e. the effectiveness of a system of internal control).  The internal auditor takes no responsibility for the sufficiency of the audit scope and procedures to find all significant concerns or issues.  In general, this opinion is less valuable than positive assurance.

Results

Developing criteria framework can help achieve the objective of providing a valued opinion. This framework provides a baseline against which to apply measurement and judgment to evidence obtained in the course of the audit.  When establishing suitable criteria, it is important to determine if the organization has established basic principles regarding what constitutes an appropriate governance, risk management, and control process. These criteria may include:

Fourth Annual TRENDS Symposium – June 3, 2011

Join McKonly & Asbury on Friday, June 3, 2011 for our fourth annual TRENDS symposium focusing on accounting and audit issues for the insurance industry. The session provides 6.5 CPE credits, which includes 1 tax credit and 1 ethics credit. McKonly & Asbury is an approved continuing professional education program sponsor through the Pennsylvania State Board of Accountancy.

We have an exciting array of speakers and topics planned, based on comments we received from previous participants.

• Legislative Update - Patricia Vance, Pennsylvania State Senator and member of the Pennsylvania Banking & Insurance Committee.
• Insurance Department Update - Stephen Johnson, Deputy Insurance Commissioner, and David DelBiondo, Director, Bureau of Financial Examinations.
• Tax Update – McKonly & Asbury Tax Group
• Business/Professional Ethics – Elaine Nissley, MBA, CISA, PMP, CCSA, CRISC, Principal, McKonly & Asbury Risk Management Services Group.
• Cloud Computing & Social Media: Risks and Controls - Samuel BowerCraft, MIS, CISA, Senior Manager, McKonly & Asbury Risk Management Services Group.
• Reinsurance –Jane Taylor, FCAS, MAAA, JD, Consulting Actuary, Huggins Actuarial Services.
• Safeguarding Confidential Data – John Dormuth, MSIM, CPCU, ARM, Account Executive, McConkey Insurance & Benefits. 

Sponsored by McKonly & Asbury and McConkey Insurance & Benefits, the symposium will take place at the Radisson Penn Harris Hotel & Convention Center at 1150 Camp Hill Bypass in Camp Hill, PA on June 3rd!

Agenda and Details

• June 3 (Friday)
• Registration starts at 7:30am
• The seminar will run from 8:00am to no later than 4:00pm. 
• Radisson Penn Harris Hotel & Convention Center (Camp Hill)

The cost to attend is $50, which includes a continental breakfast and lunch.

To register, please contact Erin Hench at ehench@macpas.com or by calling 717-972-5814.

 

Five Court Cases Every Internal Auditor and Audit Committee Member Should Know

Are your workpapers privileged? The Institute of Internal Auditors (IIA) recently presented a webinar entitled “Five Court Cases Every Internal Auditor and Audit Committee Member Should Know.” The webinar focused on court cases related to privileges that may protect internal audit workpapers and how to protect privileged information.

 Four main privileges related to your workpapers include:

• Work Product
  • Protects work prepared in anticipation of litigation.
• Self-Critical Analysis
  • Protects self-evaluative materials and results of candid assessments of compliance with laws and regulations from discovery when the public interest in preserving the internal evaluations of organizations outweighs a plaintiff’s right to the evidence.
• Attorney-Client
  • Protects communications between client and attorney made for the purpose of obtaining professional legal advice or assistance.  Generally, this implies an establishment of a relationship. Some jurisdictions only allow this privilege with external counsel.
• Accountant-Client
  • Protects information shared by a client and their accountant. The purpose of the accountant-client privilege is to create an atmosphere in which the client is able to provide all relevant information to an accountant without fear of subsequent disclosure.
  • No confidential accountant-client privilege exists under federal law.  Some states including Pennsylvania recognize Accountant-Client Privilege. 
  • Pennsylvania accountant-client privilege statute specifically notes “certified public accountant, public accountant or firm” but does specifically include internal audit.

Accountant-client, attorney-client, and work product privileges do not extend to matters disclosed to a third party.  Reference IIA: Practice Advisory 2400-1: Legal Considerations in Communicating Results for additional information regarding privileges.

 

Core Competencies for Today’s Internal Auditor

Another recent report similar to the Internal Audit Activity Summary in the IIA’s Global Internal Audit Survey focuses on core competencies for internal auditors.

Do your internal audit employees and management have the industry’s core competencies? Why is competence important? The IIA’s Code of Ethics requires competency based on the following rules:

• Rule 4.1 – “Internal auditors shall engage only in those services for which they have the necessary knowledge, skills, and experience”
• Rule 4.3 – “Internal auditors shall continually improve their proficiency and the effectiveness and quality of their services”

 Competencies, Skills, and Knowledge

The survey noted the following core competencies were highly ranked for all levels of the internal audit activity (staff, management, and CAE).

• Communication skills
• Problem identification and solution skills
• Keeping up to date with industry and regulatory changes and professional standards.

The survey considered technical skills very important and ranked them in the following order:

• Understanding the business
• Risk analysis and control assessment techniques
• Identifying types of controls

What Can Internal Audit Learn from the IIA Down Under?

Why do we care what is happening in Australia? In this global economy, it is important to leverage best practices and forward thinking ideas when available. In this case, Australia has consistently ranked ahead of the US on the Corruption Perceptions Index issued by Transparency International. The Corruption Perceptions Index is on a scale from ten (10 - very clean) to zero (0 - highly corrupt). Check out the Transparency International website for more details of their annual studies.

Corruption Perceptions Index (CPI)
Year	Australia		United States
	Rank	CPI	Rank	CPI
2010	8	8.7	22	7.5
2009	8	8.7	19	7.5
2008	9	8.7	18	7.3
2007	11	8.6	20	7.2
2006	9	8.7	20	7.3
2005	9	8.8	17	7.6
2004	9	8.8	17	7.5

 

Lessons Learned

What are some of the lessons learned that we in the US could leverage from Australia? Achieving High Performance, a study completed by the IIA and Protiviti, provides some insight into the Internal Audit profession in Australia and how they function. Some key lessons learned include:

What do Audit Committees at high achieving companies do?

• Appoint and remove the Chief Audit Executive.
• Approve the scope and budget of the Internal Audit plan.
• Approve the Chief Audit Executive’s salary.
• Evaluate the performance of the Chief Audit Executive.

What are the top five priorities of the Chief Audit Executives?

• Internal controls over the core financial processes.
• Proactive involvement in major project implementations.
• Attesting to risk management.
• Information Technology.
• Strategic risk.

IIA Australia Policy Agenda

The IIA in Australia is calling for action to reduce the reputational scandals and destruction of shareholder value that continues in all industries.  Their recommendations include five policy principles, which apply to all organizations. These policy statements call for effective self-regulation. It is time for organizations to stop relying upon government regulations and to proactively take accountability for their organization’s risk management and internal control processes.

Policy 1: Good Governance

Strong Internal Audit Function: Internal Audit provides a separation of ownership and an independence not afforded by management. This independent review function is a critical component of good governance.

Policy 2: Oversight

Strong and Effective Audit Committee: A strong independent Audit Committee is required to maintain oversight of management and the internal audit functions. Key characteristics include:

• At least three members with a majority being independent.
• The Audit Committee Chair is independent and does not chair the board.
• The Audit Committee members collectively provide deep finance, accounting and audit experience.
• The pay for Audit Committee members is commensurate with their workload, experience and personal exposure.

Policy 3: Internal Audit Reporting Lines

Independent Audit Function: Reporting to an active and knowledgeable Audit Committee is important to maintain the independence of the Internal Audit function. Key audit committee oversight functions include:

• The Board makes Chief Audit Executive (CAE) hiring and firing decisions based upon Audit Committee recommendations.
• The Audit Committee recommends and approves the Chief Audit Executive’s compensation.
•  Based upon the Chief Audit Executive’s recommendations, the Audit Committee decides audit scope and budget.
• The Chief Audit Executive reports all audit work to the Audit Committee who regularly monitors progress against the audit plan.
• The Audit Committee monitors the Internal Audit function including:   
  • 1) Audit Committee Chair private meetings with the CAE, and 
  • 2) Audit Committee meetings with the CAE without management at least annually.

Policy 4: Accountability for Risk Management and Internal Controls

Management Accountability: A risk culture where management is aware of and owns risks and risk mitigation strategies are keys to proactive risk management and internal control. Steps to accomplish this include:

• Implementation of an effective system of risk management and internal control.
• Management attests quarterly or annually that:
  • 1) The system of risk management and internal control is effective, and 
  • 2) They have reported all known material risks to the board with a true status of these risks.
• Internal Audit independently reviews and advises the Board on management’s attestation.
• Awareness that delegation of management’s attestation requirement to Internal Audit is not appropriate.

Policy 5: Internal Audit Maintains a High Standard

IIA International Standards for the Professional Practice of Internal Auditing (Standards): The IIA Standards provide solid guidance for effective management and operations of an Internal Audit function. Requirements of the Internal Audit function should include:

• Mandatory use of the IIA Standards.
• Audit Committee commissioning of an external quality review every five years. Internal Audit provides a plan for remediation of any issues found during the review.
• Maintenance of active IIA membership by the Internal Audit function.
• The CAE and internal auditors who issue reports maintain active IIA certification.

Conclusion

An effective, independent Internal Audit function serves as a deterrent and reduces the opportunity for risks to elevate to the level of reputational damage or erosion of shareholder value. Do you have an Internal Audit function? If so, are you getting the unaltered facts?

For any questions, contact Elaine Nissley, Principal at ENissley@macpas.com.

References

Transparency International: http://www.transparency.org/

IIA Australia: www.iia.org.au/

 

Internal Audit – Emerging Risks: Business Climate Change and Sustainability

 
New opportunities, as well as new risks accompany change.  Companies face external and internal pressures to address sustainable development in the current business climate; companies are no longer insulated from the eyes of public and private shareholders.  If you are not refocusing your risk assessment, you may not successfully weather the storm.

The article highlights the importance of addressing the business climate change and sustainability including five key risk areas for internal audit departments to consider based on an article by Ernst & Young (2010), Climate Change and Sustainability: Five Highly Charged Risk Areas for Internal Audit.

The five key areas to address include:

Strategic  - As the climate changes, so do markets and consumer preferences.  It is imperative that executive management discusses strategy with internal audit in order to build a complete and effective audit plan.

Compliance – Governments are becoming increasingly more involved in regulating business to address the growing social and environmental risks that accompany climate change and sustainability.  It is imperative that internal audit demonstrates that related risks are being incorporated into the audit plan to executive management.

Financial – Responsiveness comes at a cost.  As companies face increased sustainability costs and look to reduce costs (i.e. cutbacks) in existing areas, they are exposed to new risks.  It is imperative that internal audit reassess financial controls as operations change.

Reputational – Companies are beholden to a variety of stakeholders with increasing demands.  Technological advancement creates greater exposure in the form of information sharing.  It is imperative that internal audit takes measures to assure the integrity of information distributed to all stakeholders.

Operational – New risks put pressure on a company’s infrastructure and operations.  Sustainability impacts the supply chain directly and indirectly.  It is imperative that internal audit incorporate supply chain and operational initiatives into the audit plan to address climate change and sustainability. 

The challenge is to stay ahead of the storm when managing risk.  The article provides these takeaways for all internal audit departments.

• Make climate change and sustainability a standard part of your risk assessment.
• Identify the five categorical risks within your organization.
• Identify and assess all key risks related to climate change and sustainability.
• Evaluate risk and integrity of information across all reporting channels.
• Educate management and the board.
• Incorporate climate change and sustainability into current risk policies and procedures.
• Revisit your assessment regularly and revise as necessary.
• Ensure management is monitoring compliance.
• Maintain an open line of communication with the board.

Become an expert in all areas of risk within your company to best maximize your role as in internal auditor.  Challenge yourself to look internally in order to position yourself to successfully face climate and sustainability risks.

Please direct questions and comments to Elaine Nissley, MBA, CISA, PMP, CCSA, Principal, McKonly & Asbury, ENissley@macpas.com.

 

 

 

Internal Auditing - An Introduction

Why Internal Audit?

If you could have 5% of your annual revenue rain from the sky would this excite you? Have you ever caught one of your children with their hand in the cookie jar? Or, you know the cookies are disappearing but not why or by whom? Did you ever wonder what Internal Audit (IA) does or why your company needs an IA function?

The 2010 Global Fraud Study by the Association of Fraud Examiners retrieved from http://www.acfe.com/rttn/rttn-2010.pdf. states the typical fraud loss is 5% of annual revenue. When applied to the 2009 Gross World Product, this is a potential fraud loss of $2.9 trillion. (CFE, pg. 4) The report indicates that in 60% of the cases examined, the IA function contributed to detecting or limiting the fraud. (CFE, pg. 44)

Surprise audits conducted by IA can work for you in catching or limiting the impact of the "hand in your cookie jar" effect. The IA function does not even need to be full-time internal staff. Outsourcing the IA function may entail only several hundred hours of work each year. But before we elaborate on how internal audit can help, let's discuss what internal audit is.

What is Internal Audit?

The Institute of Internal Auditors (IIA) is the professional association that provides technical guidance, certification, education, and research in the area of Internal Auditing. The IIA's definition of Internal Auditing retrieved from http://www.theiia.org/theiia/ is as follows:

Internal Auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization's operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.

Who doesn't want a specialized group working to improve the organization?

What Does Internal Audit Do?

The two main activities are assurance services and consulting services. Assurance services are:

1. To perform an objective assessment, and
2. To render an independent opinion on systems or operations.

IA does this work on prioritized areas of review based upon the annual risk assessments and areas of greatest concern to management.

IA provides consulting services at the request of management. Consulting services are:

1. Advisory and objective in nature, and
2. Scoped based upon management's objectives.

Management uses these services to support such activities as fraud investigation, due diligence reviews, and preparation for regulatory and compliance reviews.

The optimum use of internal audit structures the audit work to reduce the costs and operational staff time related to external requirements, such as financial audits, Sarbanes-Oxley, Model Audit Rule, Market Conduct, and other external and regulatory reviews.

Conclusion

Having your own objective consultants inside your company working for you to make your operations better will help you close the gap on the 5% you are missing. These objective employees will help you better prevent the "hand in the cookie jar" effect, because after all, if your children know you are checking on them, they are less likely to take cookies from the jar without asking, right?

Internal auditor's must maintain independence and provide assurance or advisory services that include unbiased and impartial opinions. In addition, they must maintain objectivity by avoiding conflict of interest situations and not engaging in activities, such as assuming operational responsibility, which may influence their attitude.

Next Up

In the next article, we will discuss the Institute of Internal Auditor's Code of Ethics and introduce the International Professional Practices Framework (IPPF). The standards that, when followed, provide assurance to management that the IA function is following the highest standards of the profession. The last of the series will cover the External Quality Review process that is necessary for an IA function to state, "Audits are performed in accordance with the professional standards of the Institute of Internal Auditors".

Please respond to the blog or direct questions and comments to Elaine Nissley, MBA, CISA, PMP, CCSA, Principal, McKonly & Asbury at ENissley@macpas.com.

Security and Fraud Prevention Seminar

McKonly & Asbury will be hosting a Security and Fraud Prevention Seminar on Friday, September 24, 2010, at the Sheraton Harrisburg/Hershey on Lindle Road in Harrisburg, PA. The seminar will begin at 8:00am and conclude at 3:30 pm, with lunch provided at noon. There is a $35 registration fee and CPE credits are available. 

At this seminar, you'll learn more about...

• Current trends in cyber crime and identity theft, along with a discussion of the methods you can use to protect yourself from being a victim. 
• Resources available to prevent attacks on our critical infrastructure and how to report suspicious activity and crime. 
• The components of fraud, identification of red flags, and other fraud prevention tips related to financial institutions. 
• Banking fraud concerns for businesses and options for minimizing risk. 
• Practical security and the 10 Tips for Success. 
• Mortgage fraud.

Speakers include:

Scott Sutherland, Special Agent of the FBI

David Clark, Special Agent of the FBI

Julie Krause, Regional Sales Manager - Treasury Management at M&T Bank

Tom Strause, Partner with Financial Outsourcing Solutions

David Hammarberg, IT Director with McKonly & Asbury

Samuel BowerCraft, Senior Manager with McKonly & Asbury

 

Agenda:

8:00am - 8:30am: Registration 
8:30am - 8:35am: Welcome (Scott Heintzelman, McKonly & Asbury)
8:35am - 10:00am: IT Security Topic (Scott Sutherland, FBI)
10:00am - 10:15am: Break
10:15am - 11:15am: Practical Security: 10 Tips for Success (David Hammarberg & Samuel BowerCraft, McKonly & Asbury)
11:15am - 12:00pm: Banking Fraud Concerns for Businesses (Julie Krause, M&T Bank)

12:00pm - 1:00pm: Lunch

1:00pm - 1:45pm: Financial Institution Fraud (Tom Strause, Financial Outsourcing Solutions)
1:45pm - 2:00pm: Break
2:00pm - 3:25pm: Mortgage Fraud (David Clark, FBI)
3:25pm - 3:30pm: Closing (Scott Heintzelman, McKonly & Asbury)

If you would like to register, please contact Melissa Roberson at mroberson@macpas.com or by calling 717-761-7910.

Security Zen –Backing Up to Move Forward

 

The world of information technology is filled with information; emails, files, spreadsheets, reports, databases, pictures, websites, and more.  Everywhere you look there is information that was made by and is used by us, our colleagues, our friends and family.  And just as we protect our prized possessions at home by locking the front door or installing an alarm system, we need to protect the electronic data that is important to us.

Data backup is one of the easiest concepts in the information technology world; let’s make a copy!  You copy the data you have to another place so that should the unthinkable happen, the primary data is altered or corrupted or deleted, you have the copy and can use it, and you can move ahead; brilliant!  However, as easy as this concept is, there are some fundamental steps to take to in order to ensure you have a copy of the information when you need it.

1. Identify Your Data: If you don’t know what data you have, how can you know what data you should be backing up?  This process takes far less time than recreating everything you lost.
1. Have business owners make a list of all the data sources they rely on: file folders, application data, databases, etc.
2. For each source, identify if you need to back it up, i.e. yes, or no.
3. For each item you need to backup, indicate how frequently it should be backed up.  Daily?  Weekly? Monthly?
   
2. Setup Your Backups: With the listing you made in step #1, you can hand the plan to the IT department and they will quickly and efficiently setup the backup system to ensure the right things are backed up.  Since you included IT in step #1 for their areas, they won’t feel left out.
   
   
3. Backup the Data: Backups will now take place magically, but there are still items that need to happen to reduce your stress. 
   
   
4. Confirm Successful Backups: There are two parts to this process, and frequently only the first part is done.
1. Part one: Check the backup software daily to see if the backup was completed and successful.  This is a good start, and will catch some problems.  However, as we know, sometimes computers don’t tell us everything and we discover issues later, so to be sure of the backups we do…
2. Part two: Check the backup media.  Backups don’t really help us unless we can restore from the media (tape, CD, server, etc.).  This is why it is STRONGLY encouraged that backups are tested by restoring from the media.  Select a tape and see if you can pull files from it, or the database you use for your general ledger, etc.  If you can’t get files from your backups, then your tapes are good for very little, save perhaps propping up a couch with a missing leg.  This will also help you to check for hardware failures of your backup device.
   
   
5. Store Backups Somewhere Else, Securely: While it is nice to have things where they are easy to access, backup media should not reside in the same building as your datacenter or servers (in general).  What happens when that building catches fire?  You will lose your primary data and the copy in a glorious blaze and despair will set in.  So, keep the tapes somewhere else, properly stored (not in a damp basement or with your dog’s toys) and keep them locked up where they reside.  Backup tapes are good for restoring, but they also contain all your company’s information, so lock them up.

By taking these steps you will dramatically reduce the backup failures you have in your environment, helping you to have more peace of mind as you and your company move ahead.

Written by: Samuel BowerCraft

Breaking News in Information Security

 This week there is breaking news in the world of information security that you will read about in this and 50 different blogs.  It is ground-breaking stuff that will astonish and astound you, and more than likely you will read it and be amazed.  AMAZED I say!

What is this revelation in the world of security?  What could so many be writing about this week?  It is this:

Security of information is mostly about doing the basics.

If you read 50 articles on information security, you will discover a common thread among them all: in one way or another they are talking about limiting rights, locking things up, reviewing access rights, and limiting exceptions to the rules.  While this is not rocket science, it does take time to complete, and more importantly, the effort to do it.

The most surprising part is that this is not new stuff.  Last week while perusing a text1, I found the following security principles regarding coding and IT: Seven Design Principles of Computer Security: