Appendix – Illustrative Kano Analysis Regarding Internal Audit

BOARD AND AUDIT COMMITTEE PERSPECTIVES ON VALUE ADD (ILLUSTRATIVE)

Seen to be value adding:

Delivering the audit plan within the year;
Delivering assurance over key concerns or areas of interest for the board/audit committee;
Providing comfort over core control and compliance areas;
Providing timely and tailored briefings on the position of the organization in relation to topical issues;
Offering insights into emerging risks;
Identifying themes and trends in audit findings;
Being seen to be influential with senior management.

Seen not to add value:

Failing to deliver the audit plan;
Having a major issue occur in an area that was recently audited (e.g. “Why didn’t you spot that issue when you audited that area last year?”);
Appearing un-influential with senior management (and expecting the board to do the running) or appearing in the pocket of management;
Audit receiving negative feedback in a quality review or from a regulator or from the external auditor;
Audit “Pushing the nuclear button” on an issue which proves to be relatively minor;
Indications that management are not remediating audit recommendations;
The CAE being unable to answer an obvious question when the matter is discussed at the board/audit committee.

Seen to be value adding:

Audit being on hand to do targeted work for some senior managers;
Audit delivering advisory assignments that are seen to support the achievement of priority objectives;
Audit producing short, balanced reports on a timely basis;
Audit working in a joined up way with other functions, including the external auditor, to manage the burden of assurance activities across the organization;
Audit delivering the audit plan to (or under) budget;
Audit identifying inefficiencies or cost savings.

Seen not to add value:

Audit reports with negative ratings that do not align with senior management’s risk appetite;
Audit report wording that is either inflammatory or that might be unhelpful if disclosed to a regulator or in litigation;
Anything that comes as a surprise;
Anything communicated out of chain;
Audit reports that simply repeat known issues in more detail;
Audit reports that are issued too late to do anything with.

Seen to be value adding:

Audit showing flexibility concerning the timing of the assignment in relation to other priorities;
Offering something in the assignment that would be of value to them;
Keeping management fully on board throughout the process;
Taking opportunities to suggest that some control activities are wasteful and can be removed to make processes slicker.

Seen not to add value:

Auditor coming across as poorly prepared during an assignment;
Auditors asking follow on questions, or requesting additional information, after interviews or initial requests for information, that appear to be a “second bite at the cherry”;
Anything that suggests audit does not have a firm grip on the key facts;
Not communicating proposed findings on a timely basis;
Poor audit ratings, or poor wording which can imply management negligence or incompetence;
Audit having an emphasis on procedures and paperwork in such a manner that the importance of points made is being lost;
Being so prescriptive about remediation actions that management do not feel able to move things forward in a way that suits them or reflects other organizational changes.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.