Upload
david-mallard
View
1.548
Download
0
Tags:
Embed Size (px)
DESCRIPTION
This paper was presented at the national IIA Conference (SOPAC) in Brisbane in March 2013 - it talks to the issue of Internal Audit's role in Auditing business strategy.
Citation preview
Internal Audit and Organisational Strategy
Increasing the influence, relevance and
value of Internal Audit
David Mallard
Topic
1 The impact of strategic risk
2 Are we doing enough?
3 Recent research into the profession
4 The standards
5 Three common strategy failure points
6 Auditing strategy development
7 Auditing strategy execution
8 The Australia Post experience
9 Saying it right
10 Insight over the journey
11 Implications of auditing strategy
12 Auditing strategy is only part of the story
WHAT WE WILL SHAREWHAT WE WILL SHARE
Strategic risks pose a much more significant threat to companies than more easily auditable risk areas
Strategic risks cause 68% of severe market capitalisation decline
THE IMPACT OF STRATEGIC RISK THE IMPACT OF STRATEGIC RISK
Strategic risks account for 68%
of severe market declines
Strategic risks account for 68%
of severe market declines
Risk Categories
68%68%
7%7%
12%12%
13%13%
Percentage of Risk Failures Leading to Significant Market
Decline
6%6%
13%13%
49%49%
32%32%
Percentage of Time Spent By Audit Departments on
these Risk types
Audit departments
report spending only 6% of their
time auditing strategic risks
Audit departments
report spending only 6% of their
time auditing strategic risks
ARE WE DOING ENOUGH?ARE WE DOING ENOUGH?
RECENT RESEARCHRECENT RESEARCH
To deliver real value, audit plan’s must be responsive, flexible
and aligned with company strategy
To deliver real value, audit plan’s must be responsive, flexible
and aligned with company strategy
61% of survey respondents said
Internal Audit did not have a mandate
aligned to business strategy
61% of survey respondents said
Internal Audit did not have a mandate
aligned to business strategy
Top Priority - be more relevant to achieving
the organisation’s objectives
Top Priority - be more relevant to achieving
the organisation’s objectives
TOP PRIORITY?TOP PRIORITY?BE MORE RELEVANTBE MORE RELEVANT
TOP PRIORITY?TOP PRIORITY?BE MORE RELEVANTBE MORE RELEVANT
RECENT RESEARCHRECENT RESEARCH
2130. A1 – The internal audit activity must evaluate the adequacy and effectiveness of controls in responding to risks within the organisation’s governance, operations, and information systems regarding the:
1.Achievement of the organisation’s strategic objectives2...3...
2130. A1 – The internal audit activity must evaluate the adequacy and effectiveness of controls in responding to risks within the organisation’s governance, operations, and information systems regarding the:
1.Achievement of the organisation’s strategic objectives2...3...
INTERNATIONAL STANDARDS FOR THE INTERNATIONAL STANDARDS FOR THE PROFESSIONAL PRACTICE OF INTERNAL PROFESSIONAL PRACTICE OF INTERNAL AUDITING OCTOBER 2012AUDITING OCTOBER 2012
THREE COMMON STRATEGYTHREE COMMON STRATEGY FAILURE POINTSFAILURE POINTS
Flawed Business Assumptions: Management assumptions may not be rigorously tested resulting in organisational objectives that are inconsistent with the enterprise’s capabilities or the realities of the business environment.
Flawed Business Assumptions: Management assumptions may not be rigorously tested resulting in organisational objectives that are inconsistent with the enterprise’s capabilities or the realities of the business environment.
Business Unit Misalignment: Lack of communication or a strategy development framework for business units can result in business unit objectives and operating plans that fail to align to enterprise objectives.
Business Unit Misalignment: Lack of communication or a strategy development framework for business units can result in business unit objectives and operating plans that fail to align to enterprise objectives.
AUDITING STRATEGY AUDITING STRATEGY DEVELOPMENTDEVELOPMENT
1. Strategic Planning Process Audit: Review the strategic planning process to ensure there is a common framework for the development of business unit strategic plans and assess the alignment between business unit, department, and corporate level strategic plans.
1. Strategic Planning Process Audit: Review the strategic planning process to ensure there is a common framework for the development of business unit strategic plans and assess the alignment between business unit, department, and corporate level strategic plans.
Are enterprise level strategic
objectives documented and
measurable?
Are enterprise level strategic
objectives documented and
measurable?
Does the company have a documented process for strategic
planning? Has the process been
complied with?
Does the company have a documented process for strategic
planning? Has the process been
complied with?
Are Business Unit objectives reasonably related to enterprise objectives?
Are Business Unit objectives reasonably related to enterprise objectives?
Is there alignment between
enterprise and business level
strategies?
Is there alignment between
enterprise and business level
strategies?
2. Audit of Assumptions: Identify and validate assumptions about the internal and external environment made at the enterprise, business unit, and project level.
2. Audit of Assumptions: Identify and validate assumptions about the internal and external environment made at the enterprise, business unit, and project level.
Are key assumptions underpinning the plan
for achieving objectives documented?
Are key assumptions underpinning the plan
for achieving objectives documented?
Are key assumptions reasonable given all the
evidence?
Are key assumptions reasonable given all the
evidence?
AUDITING STRATEGY AUDITING STRATEGY DEVELOPMENTDEVELOPMENT
Do incentives and/or performance criteria
link to strategic objectives ?
Do incentives and/or performance criteria
link to strategic objectives ?
To what extent do employees believe in
the strategy?
To what extent do employees believe in
the strategy?
What level of awareness do employees have in
the strategy?
What level of awareness do employees have in
the strategy?
AUDITING STRATEGY AUDITING STRATEGY DEVELOPMENTDEVELOPMENT
4. Strategic Execution: Evaluate major initiatives at critical points in the project lifecycle against key factors of project success beyond execution and timeline, such as leadership capability, business readiness, sustainability and value investment.
4. Strategic Execution: Evaluate major initiatives at critical points in the project lifecycle against key factors of project success beyond execution and timeline, such as leadership capability, business readiness, sustainability and value investment.
Evaluate confidence levels in the successful
execution of strategy
Evaluate confidence levels in the successful
execution of strategy
Assess project management
capabilities and processes
Assess project management
capabilities and processes
Identify talent or development gaps to meet
execution goals
Identify talent or development gaps to meet
execution goals
Identify gaps between
objectives and strategy
outcomes
Identify gaps between
objectives and strategy
outcomes
AUDITING STRATEGY AUDITING STRATEGY DEVELOPMENTDEVELOPMENT
Test elements of strategy development and communication in regular audit engagements to provide ongoing monitoring of the strategic planning process
Test elements of strategy development and communication in regular audit engagements to provide ongoing monitoring of the strategic planning process
Evaluations of strategy development and communication can be incorporated into every audit to monitor the effectiveness of strategy deployment in between assessments of the strategic planning process
Evaluations of strategy development and communication can be incorporated into every audit to monitor the effectiveness of strategy deployment in between assessments of the strategic planning process
AUDITING STRATEGY AUDITING STRATEGY DEVELOPMENTDEVELOPMENT
AUDITING STRATEGY EXECUTIONAUDITING STRATEGY EXECUTION
My experience at Australia PostMy experience at Australia Post
Strategy Execution
AUDITING STRATEGY EXECUTIONAUDITING STRATEGY EXECUTION
AUDITING STRATEGY EXECUTIONAUDITING STRATEGY EXECUTION
Failures are not for lack of a well-defined strategy but due to the absence of a well-
orchestrated implementation plan bridging the gap to execution.
Failures are not for lack of a well-defined strategy but due to the absence of a well-
orchestrated implementation plan bridging the gap to execution.
Fortune Magazine famously stated that organisations fail to
successfully implement strategy, not because of bad strategy, but because of bad
execution.
Fortune Magazine famously stated that organisations fail to
successfully implement strategy, not because of bad strategy, but because of bad
execution.
AUDITING STRATEGY EXECUTIONAUDITING STRATEGY EXECUTION
‘Large Program’ Risk is in the bottom quartile of ‘well managed’ risk
‘Large Program’ Risk is in the bottom quartile of ‘well managed’ risk
82% of stakeholders regarded Internal
Audit’s role as very important or important
82% of stakeholders regarded Internal
Audit’s role as very important or important
AUDITING STRATEGY EXECUTIONAUDITING STRATEGY EXECUTION
Regularly polled senior Regularly polled senior executives and Board executives and Board members about their members about their perception of Internal perception of Internal
Audit – particularly Audit – particularly their sense of value their sense of value received from Auditreceived from Audit
Regularly polled senior Regularly polled senior executives and Board executives and Board members about their members about their perception of Internal perception of Internal
Audit – particularly Audit – particularly their sense of value their sense of value received from Auditreceived from Audit
AUDITING STRATEGY EXECUTIONAUDITING STRATEGY EXECUTION- THE AUSTRALIA POST - THE AUSTRALIA POST EXPERIENCEEXPERIENCE
Stakeholder Stakeholder feedback resulted in feedback resulted in
the question:the question:
How does Internal How does Internal Audit address Audit address
strategic risk more strategic risk more effectively?effectively?
Stakeholder Stakeholder feedback resulted in feedback resulted in
the question:the question:
How does Internal How does Internal Audit address Audit address
strategic risk more strategic risk more effectively?effectively?
AUDITING STRATEGY EXECUTIONAUDITING STRATEGY EXECUTION- THE AUSTRALIA POST - THE AUSTRALIA POST EXPERIENCEEXPERIENCE
We viewed the organisation's strategic plan as an inventory of organisational change
programs
We viewed the organisation's strategic plan as an inventory of organisational change
programs
Ranked each program by importance to company objectives, complexity, scale etcRanked each program by importance to
company objectives, complexity, scale etc
Diagnosed history of previous investments, where they had struggled and/or been
successful, and understood the organisational capability ‘soft spots’
Diagnosed history of previous investments, where they had struggled and/or been
successful, and understood the organisational capability ‘soft spots’
AUDITING STRATEGY EXECUTIONAUDITING STRATEGY EXECUTION- THE AUSTRALIA POST - THE AUSTRALIA POST EXPERIENCEEXPERIENCE
• In-Flight – Real Time Assessment PIR’s not optimising limited Audit resources and
unhelpful to operating the day to day business
• In-Flight – Real Time Assessment PIR’s not optimising limited Audit resources and
unhelpful to operating the day to day business
• Rapid arms-length feedback – ‘contemporary assurance’ and actionable
• Rapid arms-length feedback – ‘contemporary assurance’ and actionable
• An Integral view – considered typical technical issues in conjunction with humanistic elements – collective and individual
• An Integral view – considered typical technical issues in conjunction with humanistic elements – collective and individual
• Relevant to objectives of stakeholders, both organisationally and personally
• Relevant to objectives of stakeholders, both organisationally and personally
AUDITING STRATEGY EXECUTIONAUDITING STRATEGY EXECUTION- THE AUSTRALIA POST - THE AUSTRALIA POST EXPERIENCEEXPERIENCE
The Integral Framework makes clear that every event or situation may be
understood within the context of interior and exterior dimensions in both the
individual and the collective
The Integral Framework makes clear that every event or situation may be
understood within the context of interior and exterior dimensions in both the
individual and the collective
Regardless of the scope and depth of the organisational situation, by applying the Integral Framework, we are able to
analyse and assess even the most complex issues in a balanced and
comprehensive manner.
Regardless of the scope and depth of the organisational situation, by applying the Integral Framework, we are able to
analyse and assess even the most complex issues in a balanced and
comprehensive manner.
This holistic process is what makes This holistic process is what makes this approach so powerful and this approach so powerful and
leading-edgeleading-edge
This holistic process is what makes This holistic process is what makes this approach so powerful and this approach so powerful and
leading-edgeleading-edge
AUDITING STRATEGY EXECUTIONAUDITING STRATEGY EXECUTION- THE AUSTRALIA POST - THE AUSTRALIA POST EXPERIENCEEXPERIENCE
THE INTEGRAL FRAMEWORKTHE INTEGRAL FRAMEWORK
Project Health Checks include assessments from multiple perspectives in order to provide a balanced evaluation.
Designed to deliver ‘contemporary assurance’ on in- flight strategic project implementation.
A 360 O STRATEGIC PROJECT HEALTH CHECK REVIEW
1. Project Team Members
Direct participants in the project team provide the inside view of the status
of project execution2. Impacted Process
Owners
Future end users provide an outsiders
perspective on execution,
communication and sustainability.
3. Management or other key stakeholders
Key members of the senior management team provide perspective on the value contribution of the project.
4. Internal Audit
Audit offers an independent appraisal of the project including its effect on the risk and control environment.
AUDITING STRATEGY EXECUTIONAUDITING STRATEGY EXECUTION- THE AUSTRALIA POST - THE AUSTRALIA POST EXPERIENCEEXPERIENCE
AUDITING STRATEGY EXECUTIONAUDITING STRATEGY EXECUTION- THE AUSTRALIA POST - THE AUSTRALIA POST EXPERIENCEEXPERIENCE
Online polling of stakeholder
perceptions/confidence levels horizontally and
vertically in the organisation
AUDITING STRATEGY EXECUTIONAUDITING STRATEGY EXECUTION- THE AUSTRALIA POST - THE AUSTRALIA POST EXPERIENCEEXPERIENCE
Triangulate stakeholder feedback - deep dive on the
‘hot spots’
AUDITING STRATEGY EXECUTIONAUDITING STRATEGY EXECUTION- THE AUSTRALIA POST - THE AUSTRALIA POST EXPERIENCEEXPERIENCE
Independent of Project
Management Office – leverage PMO’s
work
AUDITING STRATEGY EXECUTIONAUDITING STRATEGY EXECUTION- THE AUSTRALIA POST - THE AUSTRALIA POST EXPERIENCEEXPERIENCE
KEY SUCCESS FACTORS ASSESSED:
AUDITING STRATEGY EXECUTIONAUDITING STRATEGY EXECUTION- THE AUSTRALIA POST - THE AUSTRALIA POST EXPERIENCEEXPERIENCE
AUDITING STRATEGY EXECUTIONAUDITING STRATEGY EXECUTION- - ‘SAYING IT RIGHT’‘SAYING IT RIGHT’
Audit Headline Conclusion Is HereAudit Headline Conclusion Is Here
AUDITING STRATEGY EXECUTIONAUDITING STRATEGY EXECUTION- - ‘SAYING IT RIGHT’‘SAYING IT RIGHT’
AUDITING STRATEGY EXECUTIONAUDITING STRATEGY EXECUTION- - ‘SAYING IT RIGHT’‘SAYING IT RIGHT’
AUDITING STRATEGY EXECUTIONAUDITING STRATEGY EXECUTION- INSIGHT OVER THE JOURNEY- INSIGHT OVER THE JOURNEY
EXAMPLE OF INFLUENCE, RELEVANCE AND VALUE
AUTOMATE THE PROCESSAUTOMATE THE PROCESS- www.projectaudits.com- www.projectaudits.com
THE IMPLICATIONS OF THE IMPLICATIONS OF AUDITING STRATEGYAUDITING STRATEGY
Finance
Compliance
Operational
Strategic
Operational Risk
Compliance Risk
Strategic Risk
Financial Risk
Traditional Audit Skills
ExpandSkills
Enhance Engagement
A focus on auditing organisational strategy is very important, however is only part of the story to being influential,
relevant and more valuable
A focus on auditing organisational strategy is very important, however is only part of the story to being influential,
relevant and more valuable
AUDITING STRATEGY IS ONLY AUDITING STRATEGY IS ONLY PART OF THE STORYPART OF THE STORY
• D. Goleman, Emotional Intelligence: Why It Can Matter More Than IQ (Bantam Books, 1995)
Requires higher levels of systems and people
thinking
EQ is twice as important as
technical competence*
OPTIMISING TECHNICAL AND OPTIMISING TECHNICAL AND RELATIONAL CAPACITY IS KEYRELATIONAL CAPACITY IS KEY
In my presentation this afternoon I will be discussing a key foundational issue for becoming more relevant, influential and
valuable – addressing non-technical capability development with the aim of achieving ‘Trusted Advisor’ status in your organisation.
[email protected]@davidmallard.com