Prof. Hernan Huwyler, MBA CPA

The recent release of The Institute of Internal Auditors Inc. "Vision 2035" report has reignited concerns about internal audit's image. In fact, a stunning 48% of survey respondents said internal audit was viewed as "police" in their organizations. I have written on this topic many times over the years including the attached article. The bottom line: we are responsible for most of our image issues! https://lnkd.in/ggHHx9Yc

140

25 Kommentarer

🌟 SSAE No. 23: Aligning Attestation Standards with AICPA Quality Management 🌟 In June 2024, the Auditing Standards Board issued SSAE No. 23 to amend attestation standards to be consistent with the AICPA's standards on quality management. This important update modifies several existing standards: SSAE No. 18: Clarification and Recodification, AT-C section 105 SSAE No. 19: Agreed-Upon Procedures Engagements, AT-C section 215 SSAE No. 21: Direct Examination Engagements, AT-C section 205 SSAE No. 22: Review Engagements, AT-C section 210 🛠️ Key Changes Introduced 🛠️ New Terminology: The term “other practitioner” is replaced by “participating practitioner” and “referred-to practitioner,” clarifying their roles and responsibilities. Quality Management Standards: These alignments ensure that the attestation engagements adhere to the updated AICPA quality management standards, enhancing the consistency and reliability of the engagements. 📅 Effective Date 📅 SSAE No. 23, along with the quality management standards, will be effective for engagements performed on or after December 15, 2025. 🔍 Detailed Amendments 🔍 1. SSAE No. 18, AT-C Section 105: Emphasizes the responsibility of firms to establish and maintain a system of quality management. Clarifies the relationship between attestation standards and quality management standards. 2. SSAE No. 19, AT-C Section 215: Updates documentation requirements, including the need for timely preparation of engagement documentation. Specifies that procedures should be performed by the engagement team, including participating practitioners. 3. SSAE No. 21, AT-C Section 205: Revises requirements for using the work of a practitioner’s specialist and internal auditors. Details the documentation needed to support the practitioner’s findings and conclusions. 4. SSAE No. 22, AT-C Section 210: Includes new requirements for engagement documentation and quality reviews. Emphasizes the importance of planning and performing engagements with adequate supervision and review. 📌 Conclusion 📌 SSAE No. 23 ensures that the attestation standards are up-to-date with the latest AICPA quality management guidelines. This alignment not only enhances the quality and consistency of attestation engagements but also provides clear guidance on the roles and responsibilities of practitioners. For more detailed information and specific amendments, refer to the full SSAE No. 23 document in the link in the comment below. #itgrc #itgrcadvisory #bwadvisory #akademiaitgrc #qualitymanagement #attestationstandards #AICPA #audit

4

1 Kommentar

Norman Marks writes thoughtfully about risk management from the perspective of an enlightened risk management and internal audit expert. Personally, I think organizations whose approach to risk management and risk taking depends fundamentally on IA raising the alarm in its assurance process (for instance, on the items in green in the "fan" below) are already far behind the eight ball. Nevertheless, I think his comments here and elsewhere in his blog are required reading for: 1. Audit professionals interested in risk, and risk professionals working alongside IA 2. Risk-enlightened business leaders who are successfully incorporating risk thinking in decisionmaking and oversight in large parts of their business, but struggling to get traction in pockets 3. Board members and other stakeholders frustrated with slow uptake of thoughtful risk approaches and wondering how to overcome organizational resistance.

4

1 Kommentar

✅ New #PCAOB staff report highlights good Practices and other observations related to Auditor Independence. Good practices discussed in the Spotlight include the following: ✔ Technology-based tools – Some audit firms increasingly use technology-based tools to promote early detection of potential independence violations. ✔ Personal independence representations – Certain audit firms are increasing the frequency (e.g., to a quarterly or semi-annual basis) that personnel must provide independence compliance representations. ✔ Enhanced processes – Certain audit firms are employing enhanced processes (e.g., mandatory meetings with firm personnel skilled in independence matters) to ensure proper considerations are given to reporting all financial holdings. ✔ Disciplinary actions – Audit firms have put in place specific policies and procedures providing sanctions for personal independence policy violations. ♂ Indian audit firms should also imbibe these good practices. ☑ The report also contains some reminders for auditors. For detailed reports, please click on the given link: https://lnkd.in/gvvsBBHi

7

🚀 Did you know that The IIA recently launched an AI Knowledge Centre? AI is rapidly becoming a critical focus in internal audit, both in auditing and practical use. In response, The IIA has created a centralized resource hub on theiia.org, providing members with essential tools and insights. New resources will be added regularly to keep you ahead of the curve. Check out the three new tools released with the launch: 🔍 IIA’s Updated AI Auditing Framework: Understand risks and discover best practices for AI internal controls. 📚 Artificial Intelligence 101 for Internal Auditors: Get a foundational grasp of AI and the language needed to start building your knowledge. 💬 ChatGPT for Internal Auditors: Explore use cases, sample prompts, and key considerations for using NLP tools in your audit processes. https://lnkd.in/dfsjr_iE Stay informed and equipped with The IIA's latest resources! #InternalAudit #AI #ArtificialIntelligence #Auditing #IIA

5

Why do I keep stressing the need for a "risk universe" instead of an "audit universe"? I explain with real-life examples in today's blog post. #risk #audit #IIA #GIAS #GRC #ISACA #governance

43

7 Kommentarer

The official publication of the IIA Puerto Rico Chapter, April 2024 | Issue 7, Magazine News: 2024 IT Conference: Digital Evidence Techniques & AI in Internal Audit event. #fraud #ethics #auditor #privacy #business #government #AI #businessethics #riskmanagement #risk #collaboration

2

According to AuditBoard's Internal Audit's Expanding Role - The Foundation for Connected Risk research report, 15–20% of survey respondents' time is allocated to advisory-type services. According to The Institute of Internal Auditors Inc. and Internal Audit Foundation Vision 2035 report, survey respondents stated the ideal future balance between advisory and assurance services is 40% to 60%, respectively. And even yesterday at AuditBoard's Connected Risk Summit in Toronto, Richard Chambers proposed that generative AI might eventually replace a substantial portion of assurance work, leaving Internal Audit to primarily focus on advisory services in the future. For those looking to adopt this trend in the near future, here's a framework highlighting the types of assurance and advisory services Internal Audit can provide. This framework is based on your organization's awareness of the risk in focus, and the maturity of its related processes. - If a key risk is known and processes already exist to manage it, Internal Audit can audit those processes. - If a key risk is known and processes are being established to manage it, Internal Audit can provide assurance that the processes will be designed to manage the risk as intended. - If a key risk is known and relevant but there are no plans to manage it, Internal Audit can advise and help establish governance processes if needed. This includes advising on and documenting a pilot program and roles and responsibilities, as well as monitoring and reporting on the performance of the pilot program. - If a risk could be key, and it is unknown to the company, Internal Audit can research, create awareness of, and understand if the risk could have significant impact on the companies success through interviews with key personnel internal and external to the company. Research reports included in the comments below. AuditBoard #InternalAudit #EnablingPositiveChange

59

7 Kommentarer

The Association of Fraud Examiners affirms that internal audit can offer more value through prevention rather than detection. Effective internal audit programs play a crucial role in reducing both the extent and duration of fraud losses. Read article: https://bit.ly/3UsrL5A #InternalAudit #Fraud #Prevention

11

The completeness of the risk assessment process has a direct impact on audit quality.  The latest AI tools already allow auditors to conduct risk assessments on 100 percent of the accounting entries before the audit begins.  However, auditors are limited by the time and cost required to review business process data.  In this article, learn how an intelligent financial data management platform overcomes these challenges by simplifying data collection and automating the initial source document review, enabling auditors to reduce audit risk and enhance audit quality. Learn how: https://bit.ly/4deuk3T #vigilantai #ai #audit

1

The completeness of the risk assessment process has a direct impact on audit quality.  The latest AI tools already allow auditors to conduct risk assessments on 100 percent of the accounting entries before the audit begins.  However, auditors are limited by the time and cost required to review business process data.  In this article, learn how an intelligent financial data management platform overcomes these challenges by simplifying data collection and automating the initial source document review, enabling auditors to reduce audit risk and enhance audit quality. Learn how: https://bit.ly/4deuk3T #vigilantai #ai #audit

2

In a recent webinar poll conducted by AuditBoard, 94% of over 2,000 attendees stated that they plan to conform to the IIA standards, to varying degrees. For many, the process includes conducting an internal gap assessment, validating the assessment with additional perspectives from an external service provider, and implementing necessary changes for conformance. If you are just beginning your conformance journey, or have not yet started, here are some points to consider: - Your team will need to dedicate 50 - 60 hours to read through the standards, perform an initial gap assessment, and discuss the findings. - Many teams adopt a "divide and conquer" strategy, assigning various domains, principles, or standards to different members. This helps them identify differences between the new IIA standard requirements and recommendations compared to their existing state. - Individual gap assessments are reviewed during team meetings to reach a consensus and to formulate action plans for areas that require changes. - Many teams, having already completed their initial gap assessment and aiming to conform by January 2025, plan to implement all action plans by 9/30. They intend to use Q4 to re-validate the proper implementation of these plans and as a buffer period. For those who haven't started or completed their gap assessment but plan to conform by January 2025, it is achievable. However, time might be constrained depending on the number of internal audit methodology changes needed to implement or the level of effort needed to coordinate with the Board and Senior Management for their required actions. If you're in this position, you might want to register for AuditBoard's webinar happening on Thursday. The webinar, titled "Front Line Perspectives on Adhering to The IIA's New Global Internal Audit Standards," will feature Adam Heppe, Jon Taber, CPA, CIA, CFE, CFF, Kristen Kelly, and myself. We'll share perspectives on the implementation plans of our peers, standards or principles requiring an increased level of effort to change, and other Internal Audit methodology changes resulting from gap assessments. AuditBoard #InternalAudit #EnablingPositiveChange

55

2 Kommentarer

Having scanned though The IIA's newly published "Vision 2035" document (it's over 50 pages), I was struck by four key takeaways for myself ... 1. What is being said now is what has been said about the profession before (but I do grant that the pace of needed change will only continue to accelerate). 2. I was left with the conclusion that all the things being said IS TRUE IN 2024, and not in the lead up to 2035. 3. Are we, as a global profession, ever going to stop playing catch-up to where we need to be in the present moment? We always seem to be playing catch-up to where we need to be. 4. Are we, as a global profession, ever going to stop being harder on ourselves than our stakeholders are on us? (It's not a bad thing to expect more from yourself than others expect of you, as long as you don't obsess about it.) I need to read it more closely, and I look forward to the free webinar on the topic The IIA is holding later this month, but my initial reaction is a bit of a "so what?"

26

17 Kommentarer

Evidence has long indicated that (aside from employee tips) the most likely source to detect of fraud in an organization is the internal audit function. But do internal auditors always know what to do when fraud surfaces during an engagement. Check out my new blog to learn more. #internalaudit #fraud #fraudinvestigation #risk #riskmanagement Association of Certified Fraud Examiners (ACFE) https://lnkd.in/eeQ8hdvi

157

16 Kommentarer

🌟 Exciting Update for Internal Auditors! 🌟 The 2024 Internal Audit Standards have just been released, and they're packed with important updates that Chief Audit Executives (CAEs) need to know about. These changes aim to enhance our practice and ensure we remain at the forefront of governance and risk management. 🔍 We've taken a close look at the new standards and compiled some key insights that can impact or transform your auditing strategies. Whether you're a seasoned auditor or new to the field, understanding these updates is crucial for your success and compliance. I encourage all fellow CAEs and auditing professionals to dive into these changes. #InternalAudit #AuditStandards2024 #RiskManagement #Governance #CAE

12

This white paper from the IIA is a good document for data analytics that all internal auditors should use.

46

6 Kommentarer

In the newly released 2024 Global Internal Audit Standards, Domain I is dedicated to defining and underscoring the Purpose of Internal Auditing. This domain is pivotal as it lays the foundation for the standards, highlighting the strategic role internal auditors play in enhancing organizational governance, risk management, and control. Key Insights: • Clear Definition: Domain I articulates the purpose of internal auditing, emphasizing its role in providing assurance and advisory services that add value and improve an organization’s operations. • Strategic Importance: It stresses the necessity of aligning the audit function with the strategic goals of the organization, making every audit activity relevant and impactful. Why This Matters: A well-understood and clearly defined purpose is essential for internal auditors to effectively support their organizations’ objectives and make a tangible impact through their work. #InternalAudit #AuditStandards2024 #PurposeOfAuditing #StrategicAlignment #OrganizationalGoals #IIAStandards #AuditImpact #ProfessionalDevelopment

4