A selection of blog posts by James Paterson.
They consider the time available for the assignment and then they issue a “Terms of Reference” (also known as an audit scope).
If the auditor is doing a good job they will spell out what is “in scope” and what is “out of scope”. Based on this they will develop an assignment work programme of things they are going to check.
Spelling out what’s in/out of scope is an important good practice for internal auditors because it helps to set expectations with stakeholders about what is going to be looked at, giving them an opportunity to challenge what work is going to be done and also setting their expectations.
Oftentimes, you will see terms of reference expressed in words. For example:
This assignment will look at the staff recruitment process. Key areas to be examined will include:
Outside of scope will be:
A. The engagement/recruitment of part-time staff and contractors.
B. Benchmarking the cost of recruitment.
The decision to exclude areas from an assignment may be based upon areas that are: i) less relevant to the key assurance needs and also ii) a lesser priority/risk, given the time available for the assignment.
But beyond this approach to communicate scopes, I am seeing increasing use of diagrams to explain this. Diagrams do not replace words but can complement them. Furthermore, if done well, a diagram can show more clearly some of the “hard choices” around the boundaries of an assignment that may be less obvious when simply expressed in words.
Thus, when you consider an area to be examined, it may be addressed by a process, but that process will often be underpinned by IT systems/applications and data flows. In turn, processes/systems may be managed by support functions (e.g. IT/HR) and their role may be more/less important to the key issues under consideration. Also, there may also be third-party service providers who support a process (e.g. recruitment agencies), and – again – their role may be more/less important in relation to the management of a risk.
A diagram can make it clear, in an instant, which process areas/systems/departments will and won’t be looked at. The power of a diagram is that it helps auditors, and managers, think carefully about what will/won’t be relevant to an assignment. And if issues are uncovered, it can be simple to “locate” these on the diagram. and many times it will be clear that issues arise between one part of a process and another, or between one department and another, rather than just in one area.
Finally, a diagram also provides a great way of helping an audit team understand the totality of what has and has not been looked at so that when planning future assignments it is easier to “join up the jigsaw puzzle”.
There is a whole body of practice to be shared about exactly how internal audit functions make robust choices around what is in/out of scope, but the starting point is to be crystal clear what is and is not being done – with diagrams an important tool to help do this.
In response to requests, I have summarised the key good practices into one manual, aligned to the IIA IPPF 2017 framework.
Key lean/agile principles are outlined:
The lean and agile internal audit methodology toolkit is written for immediate use by any internal audit team covering:
The document comprises 80+ slides explaining good practice in a granular/modular way:
The methodology toolkit also contains templates, advise on ratings, dealing with sensitive issues and how to manage advisory assignments.
It can either be used to benchmark an existing audit methodology for lean/agile ways of working or it can be used as the starting point for a new audit team that needs to write an audit manual.
The toolkit costs £500+VAT but will save those who use it many days of effort. For more information contact info@RiskAI.co.uk
This area is especially highlighted because of its key role in helping internal audit to be independent and objective.
To date, there has been a lot of training on “the basics” of ethics. However, “Ethics in the Real world” moves beyond the straight-forward aspects of ethics and considers the real-world challenges that might face auditors and how they might decide what to do. It also looks at the “real world” challenges and pressures that managers face and will help auditors to look at these issues in an insightful and value-adding way.
Internal audit challenges
“It’s a bad time for you to audit this area right now, can you come back later”?
“Rather than audit us, can you do some advisory work instead”?
“This is a really sensitive issue, do you really have to write it down? Or can you write it differently”?
“Can we have a less harsh audit rating, otherwise the rating will cause a lot of issues”.
“Can you give us more time to fix that issue, we are really busy at the moment”. Continue Reading
1. CAREER TURNING POINTS 4-Weeks Coaching (Skype or Zoom)
CAREER TURNING-POINTS is designed for those who need a burst of motivation to achieve clearly defined career goals, such as getting that new job, internal promotions, job interviews, improving self-confidence or succeeding in a new role.
Over the course of 2 months, you will receive 4 x 90-minute sessions of private coaching by Skype or Zoom.
2. CAREER STRATEGIES – 4-Months Coaching
(Skype or Zoom)
CAREER STRATEGIES is designed for those who want to explore and plan for their career, with the opportunity to focus on 2-3 key goals. Over the course of 4 months, you will receive 8 x 90-minute sessions of private coaching by Skype or Zoom.
1. BUILD A NEW DIRECTION – 4-Months Coaching
(Skype or Zoom)
BUILD A NEW DIRECTION is designed for those who want to enhance their ability to lead, with the opportunity to reflect on their current strengths and areas for improvement and focus on 2-3 key goals. Over the course of 4 months, you will receive 8 x 90-minute sessions of private coaching by Skype or Zoom.
2. GAIN MOMENTUM – 8-Months Fortnightly Coaching
(Skype, telephone or face-to-face)
GAIN MOMENTUM is designed for people who want to achieve personal, professional or business goals, with the opportunity to focus on several key areas. Over the course of 8-months, you will receive 16 fortnightly 90-minute sessions of private coaching by Skype or Zoom.
3. SHARPEN YOUR SAW– 12-Months Monthly Coaching
(Skype, telephone or face-to-face)
Designed for people who want to SHARPEN THEIR SAW via regular monthly coaching sessions and for best practice reflections and managing challenges and enhancing their current practice. Over the course of 12-months, you will receive 12 monthly 90-minute sessions of private coaching by Skype or Zoom.
3-Hours – FOCUS CLEARLY: 1 x 3-Hour Breakthrough Session (Skype or face-to-face)
Designed to explore and FOCUS CLEARLY on a major challenge or goal. This comprises 2 x 90-minute discussions is 100% tailored to you to make a practical break-through.
1-Day – BEST PRACTICES & TAKING STOCK: 2 3-hour sessions, plus a follow-up
Escape from day-to-day pressures to take stock, reflect on best practices and empower yourself. Designed to explore, clarify technical best practice issues and plan for a specific goal, aspiration or challenge.
4 x 90-minute coaching sessions (remote or face to face, depending on location), tailored to you (usually within 2-4 weeks), followed by a 90-minute telephone call one week later. (5 in total).
Prices are charged for 90-minute slots
5% discount available for purchasing > 5 sessions at a time.
10% discount available for purchasing >10 sessions at a time.
For up-to-date prices and more information contact: info@RiskAI.co.uk
An extract from James Paterson’s latest CPD technical article on the ACCA website.
It’s time that GRC professionals, regulators and Internal Audit recognised the importance of auditing culture and behaviour – the “soft stuff”
For the past six years I have been running the IIA UK training on auditing culture, I also helped write the IIA UK guidance on auditing culture. My background is worth explaining: I’m a finance professional, but did a masters’ degree in management (focusing on organisational behavior). I then left finance to work in HR (in leadership development and managing culture change). Then I became a Head of Internal Audit for AstraZeneca for seven years, and since 2010, I have been combining my passion for people and the soft stuff with my love of Internal Audit, doing training and webinars across Europe and further afield.
I am really happy that GRC professionals, regulators and Internal Audit have started to recognise the importance of the soft stuff when it comes to the effective management of risk and maintaining ethical conduct. This was caused – in a large part – by the recognition that many aspects of the financial crisis of 2007-2008 were caused by short-comings in the “bonus culture”, and underestimation of the latent risks building up. In addition, there were mis-selling scandals highlighting poor conduct in sales, which did not put the customer first.
In the UK, the importance of culture and conduct in relation to Internal Audit was formally recognised in a code of practice for Internal Audit in financial services, published in 2013, which said that Internal Audit should consider, when making audit plans: “the risk and control culture” and “the setting of, and adherence to, risk appetite” amongst other areas. In January 2020, the same points have been included in the IIA UK Code of practice for Internal Audit, applying to all sectors and not just financial services.
You can read the rest of this article on the ACCA website