Co-Develop Expectations

1. Co-Develop Expectations

2. Communicate Results Understand the Auditee Assess Risk Develop Audit Plan Execute the Audit Co-Develop Expectations

3. The key activities under this phase are the following: Understand Stakeholders’ Expectations Commit and Plan

4. A. Understand Stakeholders’ Expectation Main Activities • In the initial period of the Auditee’s internal • audit engagement, and at least once a year • thereafter, the team should inquire about • the Auditee’s expectations for the overall • scope of Internal Audit services.

5. A. Understand Stakeholders’ Expectations (continued) Main Activities • Part of the team’s responsibility in the Understand Stakeholders’ Expectations activity is to identify: • What the critical risks are • How these risks are controlled • How internal audit adds value

6. A. Understand Stakeholders’ Expectation (continued) • Auditors’ challenge - • Broaden management’s understanding of the internal audit function by: • Recommending ways to build cost effective controls into new systems and processes • Identifying redundant or inefficient controls and activities embedded in existing systems and processes

7. A. Understand Stakeholders’ Expectation (continued) • Determining if operating objectives are being realized • Assisting in information gathering activities for fraud investigations • Auditing information technology • Reviewing performance measures

8. A. Understand Stakeholders’ Expectation (continued) • The expectations meetings can be used to increase management’s understanding of the full potential value of internal audit services and to expand IADs understanding of management’s needs and expectations.

9. A. Understand Stakeholders’ Expectation (continued) • Expectations discussion may also serve to refresh a merely satisfied, stagnant or vulnerable relationship between the IAD and the Auditee • It will also refine the prior understanding and update expectations for changes in the operational situation of the auditee if there were previous meetings.

10. Who to meet? • Its the Senior Management! • The Internal Audit team meets with Senior Management to understand the stakeholders’ expectations and to emphasize the value of the services the team can provide. • Discussions is on preliminary basis to decide how the additional expectations discussion will be conducted. A process for combining expectations from multiple locations into a “consolidated’ set of expectations may be the most practical approach.

11. Procedures: • Clearly communicate the commitment to total satisfaction and continuous improvement. • 2. Discuss with the Oversight Body and senior management to emphasize the auditee and control risks, with less emphasis on process and more on results and the implications to the Auditee. • Use the Auditee Risk Model (ARM) (Audit Tool 300) to effectively integrate Oversight Body and senior management responsibility with Auditee risk and discuss the role of internal audit.

12. Procedures (continued) • 3. Use non-technical, commonly understood terms to discuss audit and Auditee risks and the audit team’s responsibilities. Avoid use of audit vocabulary or audit jargons

13. Hints • - Offer to meet with new senior management members to bring them up-to-date on important areas. • This might include a review of the IAD audit focus and key risk areas as well as potential future concerns discussed in prior meetings. This is often a great opportunity to strengthen an early relationship.

14. Objectivity Concerns • 1. Objectivity is impaired when internal audit audits any activity for which they had authority or responsibility. This impairment should be considered when reporting audit results. Preferably, the internal audit team should not perform the work.

15. Objectivity concerns( continued) • Persons transferred to, or temporarily engaged by the internal audit team should not be assigned to audit those activities they previously performed until a reasonable period of time has elapsed.

16. Procedures: • In preparing for a meeting with senior management, the following procedures are performed: • Obtain an understanding of the Auditee’s operations by reviewing Auditee background information. Review- • Vision/mission statement • Oversight body (thru the Audit Committee, if possible) • Critical success factors • Strategic Plan • Existing Internal Audit Mission and Audit Process

17. Procedures(continued) • Depending on the level of knowledge of the Auditee and the engagement team, the team may need to follow the steps outlined in the Understanding the Auditee phase to obtain an adequate understanding of the organization/Ministry. • 3. Considering the above information, define discussion • categories. Anticipate the senior management’s agenda items. Develop expectations questions.

18. Procedures(continued) • 4.Define what IA expects from the senior management and determine how the team will explain these expectations to the senior management. • 5. Determine how to document the expectations agreement, measure the results, and communicate progress back to the senior management. • 6. Identify meeting goals, outcomes, deliverables, and measures.

19. Procedures (continued) • 7. Determine who should attend from the senior management and from the audit team • - Include all key decision makers for internal audit services and relevant senior management personnel involved in the service delivery process. • - Include key members of the audit team.

20. Procedures (continued) 7. Determine who should attend from the senior management and from the audit team (continued) • - Consider if an external facilitator would make the meeting more effective. The facilitator’s role is to moderate the discussion and reach consensus among meeting participants. • - Designate one of the audit team members as the note-taker.

21. Procedures (continued) • 8. Prepare meeting agenda. Include a statement of goals and a list of performance measures that describe how the goals will be met. • 9. Send pre-meeting materials to the attendees well in advance of the meeting. This may include: • a. The agenda • b. An introductory cover letter discussing the process of determining expectations • c. Preliminary questions, based on survey results or review of information obtained

22. Procedures (continued) 10. Conduct meeting with senior managementto gain a clear understanding of the Auditee’s expectations of Internal Audit Department. 11. In the meeting, develop a list of action items which management or the Internal Audit team should follow up. Assign responsibilities for procedures to be completed before the senior management or an Oversight body expectations discussion.

23. Procedures (continued) 12. The IA team evaluates the results and progress of the meetings. Make any necessary adjustments to the expectations meeting process. 13.Using the information obtained from senior management, prepare for the expectations meeting with the Head of the Auditee or Oversight body.

24. Expectations Meeting with Auditee Head • Review the IAD guide to anticipate some of the Head of the Auditee or Oversight body’s expectations. • Prepare a proposed discussion outline. • Meet with the concerned senior management to discuss the proposed discussion outline for the Head of the Auditee meeting.

25. Expectations Meeting with Auditee Head • Complete the final discussion outline and any presentation material. • Send to the Head of the Auditee copies of the final discussion outline and presentation material. Distribute in advance to allow adequate time to review the material. • Conduct the expectations discussion with the Head of the Auditee.

26. Expectations Meeting with Auditee Head • In the initial phase of the IA service, or if not previously discussed, discuss with Head of the Auditee the perception of their roles and responsibilities. • Ask the Head of the Auditee to state their expectations of the internal audit services, especifically how the IAD can help them fulfil their oversight role and responsibilities. Focus on high-value areas and expectations.

27. B. Commit and Plan • The results of the Expectations Discussion should be analyzed to: • Evaluate potential unexpressed wants • Summarize value areas • Prioritize strategies for addressing each expectation. in order to create a Mission for the Audit Team

28. B. Commit and Plan The Internal Audit Team mission A subset of the activities that provides direction on the primary areas of audit focus and communication requirements based on senior management’s input. A more flexible, informal set of objectives and it needs to be re-evaluated to correspond with the needs of senior management and the Head of the Auditee.

29. B. Commit and Plan (continued) • 2. Compared to the Internal Audit Manual, • The IAD mission is an agreement between the audit team and management regarding the nature and extent of audit work. The mission may be an implicit agreement between the parties or an explicit agreement in the form of a letter or other document.

30. B. Commit and Plan (continued) • 3. The determination of the mission comes, in large part, as a result of the expectations discussion, when the team determines the stakeholder’s’ expectations for the IAD work. • The objectives of the Commit and Plan step are to: • Document and agree with the management the identified expectations • Plan specific activities • Assign responsibilities • Determine timing for steps to be taken to ensure that expectations are met.

31. Hints 1. Developing a plan requires that: the IAD help senior management set their expectations b. senior management expectations be understood and agreed, with key value points being the focus of the IAD plan c. senior management expectations are exceeded

32. Hints 2. Meeting management expectations for lower priority value points and exceeding management expectations for higher priority value points helps ensure the IAD’s overall success. 3. Completing expectations discussion is likely to raise expectations. If the expectations are set at a level we can just meet, but not exceed, senior management is likely to perceive that we did not deliver adequate value.