When Woodforest National Bank wanted to test whether employees were properly destroying physical data, it hit on an idea that would require internal auditors to roll up their sleeves and get messy.
I was reading an interesting article the other day about Artificial Intelligence (AI) and cognitive computing. I thought it might be worth sharing some of the thoughts with you in case you had ever contemplated using automation in the compilation of one of your reports.
Internal auditor spotlight with Tony Redlinger of IHS Markit: We recently sat down with Tony to talk about the challenges of being an IT auditor, what's next for cybersecurity, integrated auditing, and more.
It is not uncommon for CAEs to read thought leadership that highlights internal audit’s inability to meet stakeholder expectations and room for improvement (e.g. here, here, and here)...
According to a recent MISTI survey, internal auditors say their internal audit seniors and managers most lack data analytic skills, understanding of IT auditing concepts, and ability to influence and persuade.
BP paid more than $25 billion; Volkswagen shelled out $19 billion; Anadarko Petroleum, $5.1 billion; and GlaxoSmithKline ponied up $3.75 billion. No, these aren't prices paid for major acquisitions, they are the penalties these companies paid to resolve environmental, health, and safety issues during the last seven years with a raft of U.S. federal agencies, including the Environmental Protection Agency, the Occupational Safety and Health Administration, and 11 others that deal with EHS issues.
Being a Brit of a certain age and fortunate to have a very good English teacher in my early years I have always pushed back on the use of a comma before the word "and". Indeed. I spent the better part of 20 years working for American firms desperately trying to convince my betters in the US that they really shouldn't be there and removing them from audit reports.
The FCA is encouraging firms to make cyber security training more interactive by introducing mock scams and rewarding sharp employees.
Internal auditor spotlight with Tony Redlinger of IHS Markit: We recently sat down with Tony to talk about the challenges of being an IT auditor, what's next for cybersecurity, integrated auditing, and more.
One telling sign of a maturing internal audit department is when the CAE proposes audit topics that are organizationally-focused around key projects and initiatives (e.g. evaluating the make-or-buy decision for a material for a key part or performing an assessment of a recent new product introduction) versus a generic audit topic (e.g. payroll or procurement cards).
After years of belt tightening and cost cutting, companies may finally be starting to increase budgets and staffing for internal audit. As part of our inaugural internal audit study on planning and staffing priorities, we asked internal auditors about the resources, including budget and staff, they are allocated and if they are sufficient to get the job done and if those budgets are increasing or declining.
Why do some internal auditors effectively prepare workpapers and write audit reports with ease, yet stumble when it comes to most other forms of communication?
I went to a client the other day to run a 'Report Writing' course and we discussed “House Style”, including the font choice for audit reports. They were, like many large organisations, very clear on what was and what was not acceptable. I was delighted to hear that their choice fitted with the research I had done several years ago, but before I tell you what it was, let’s discuss the options.
As regular readers will know, I run audit report writing courses for a living. For the past couple of years, I have included a small module I call "the hashtag generation". It was originally intended as a little light relief from the rigours of grammar but as time passes the subject has the potential to become a serious threat to the audit report.
I find myself reading a lot of information each week on the subject of fraud, in its many different forms, and it has started me thinking about what is the best way to address it. Everybody talks about putting controls in place to stop it, but do they really work?
Adopting a customer service mindset for internal audit starts at the top. Chief audit executives and other internal audit leaders who want to change the perception of internal audit must create a culture of treating auditees as customers that includes changes to internal audit processes, communication of what is expected of rank-and-file internal auditors, and examples of taking a customer service approach through actions.
Internal audit leaders continue to fret about hanging on to their top talent. In a recent survey, they ranked staffing concerns, including retention, as among their greatest worries.
The high-publicity WannaCry attack has many companies reviewing their protections against ransomware and other cybersecurity attacks. Here we provide five preventative controls that IT auditors should ensure are functioning properly.
Those of us who have been associated with audit and investigations in one form or another over the years will always be on the lookout for something that gives us the edge over the fraudster.
More internal audit departments are calling the functions, units, and subsidiaries they audit by a new name—customers—and treating them as such.
