Managing Your Audit Function Webinar Series October 6th – 10:00 to 12:00 CST Presented by Del Rush...

Managing Your Audit FunctionWebinar Series

October 6th – 10:00 to 12:00 CST

Presented by Del Rush

ABA: Managing Your Audit Function Webinar: October 6, 2011 © Frost, PLLC


Topics Review of FDIC Rules for Auditors and Audit Committees – Part 363

What Impacts the Internal and External Audit Function?

Audit Committee Oversight Responsibilities

Management Responsibilities

Evaluating External Auditors

Evaluating the Internal Audit Function


Topics Indicators of Issues with the Audit Function

Best Practices in Managing the Audit Function

Risk Oversight – Who is responsible?

Balancing Audit Cost with Benefits and Risk

Performance Measurements for Internal Audit

NACD – Ten principles of Effective Audit Committee Oversight

Session Objectives

• Inform the participants about key responsibilities, roles and evaluation criteria in order to manage the audit function

• Discuss issues, changes and trends impacting the oversight of the audit function


Key Challenges • Current Economy – Need for profitability

• Regulatory and Compliance

• Changes to Financial Reporting – More complex

• Impact due to Larger Company Issues

• Anxiety at the Board Level – Legal


Part 363 Annual Reports and Other Required Reports

Section 36 of the Federal Deposit Insurance Act (FDI Act) and Part 363 of the FDIC's regulations impose annual audit and reporting requirements on insured depository institutions with $500 million or more in total assets


The Impact of Asset Size on Compliance Requirements

FDICIA has two main categories that are based on the asset size of the institution at the beginning of the institution’s fiscal year. The two main categories are: >$500 million to $1billion in assets, referred to here as Tier II. >$1 billion in assets, referred to here as Tier I.


Specifics of Part 363

• Annual Reporting Requirements

• Independent Public Accountants

• Filing and Notice Requirements

• Audit Committees

• Scope



• Management assessment

• Internal Control Framework

• Disclosure of Material Weaknesses

• Independence Standards for Auditors



• Specifies the duties of the Audit Committee

• Required Communications

• Retention Requirements for Working Papers



• Documentation and Guidance for AC Independence

• Compliance with Part 363 at the Holding Company Level

• Included Illustrative Reports


Tier II Institutions

1.Audited comparative annual financial statements with the independent public accountant’s audit report.

2.A management report containing management’s responsibilities.


Tier I Institutions – Additional Requirements

1.Management Assessment of ICFR at Year-end

2.Disclosure of Material Weaknesses not Remediated

3.Public Accountant Attestation on ICFR


Audit Committee Impacts of 363

1.Independent Outside Directors – depends on size

2.Annual independence evaluation of AC members

3.Compensation

4.Auditor engagement


What Impacts the Internal and External Audit Function?


Corporate Governance - defined

Governance can be defined as the processes for managing an organization’s affairs or for ensuring accountability. Governance can include various activities such as setting business strategies and objectives, determining risk appetite, establishing culture and values, developing internal policies, and monitoring performance.


Key Items Impacting Auditors• Tone at the Top and with Executive Management

• Involvement of Owners

• Is the AC really Effective and Trained? Involved with Management?

• Business Changes – Internal and External

• How Management Addresses Issues - Skills


Factors Causing Change Today • Indirect impact from PCAOB, SEC, AICPA

• Regulatory – FHA – Dodd-Frank Act

• Other – Risk Management and Testing

• GAAP – Impact of IFRS and Fair Value

• Economic Environment


Trends Impacting the Internal Audit Function

• Risk-Centric Mindset

• A Real-Time Dimension

• Shortage of Audit Talent

• Technological Advancement


Oversight Committees - Basics• Know the People

• Understand the Business

• Exercise Skepticism

• Insist on Accountability for Management and the Board


Audit Committee Oversight Responsibilities

• Financial Reporting• Overseeing the Annual Audit• External Audit• Internal Audit• Risk Management & Internal Control• Maintaining & Measuring Effectiveness• Communicating & Reporting• Regulatory, Compliance & Ethical Matters


Management Responsibilities

• Primary Corporate Governance Responsibilities Rest with Management

• Include Internal Control, Ethics, Risk Management, Compliance with Laws and Regulations

• Every Manager’s Responsibility



• Industry Experience

• Support Network

• Independence

• Reasonableness of Audit Plan

• Ability to Toe the Line



• Form and Frequency

• Lack of Surprises

• Partner and Manager Time

• Quality Control Procedures

• Using the Work of Others



• Usefulness of Recommendations

• Team Chemistry


Evaluating the Internal Audit Function

• Routine oversight by the Audit Committee

• Appraising the quality of the IA staff

• Inquiries of the independent auditor

• Metrics


Evaluating the Internal Audit Function - Questions

• Proper funding/Cost Effective• Responsive based on current environment• Up-to-date• Experts in the field• Are expectations between CAE, Sr. Mgmt and the AC reconciled• Viewed as objective and competent• Complies with IIA standards


Indicators of Issues with the Audit Function

• Unexpected Adjustments• Material Weakness or Significant Deficiency• Delays in Meeting Financial Statement Deadlines• Lack of Communication or Meetings• Partner Involvement/Manager Involvement• Out of period adjustments – Not just at year-end• Everything is Great and There are No Issues or Problems


Indicators of Issues with the Audit Function

• Turnover – Internal or External • Refiled Regulatory Reports

• Employee Fraud • Inability to Meet Annual Audit Plan or Getting Pulled into Other projects


QAR - Common Problems Found in Internal Audit Departments

• Incomplete Risk Assessments

• Policies and Charters were Outdated

• Time Management and Productivity

• Professional Education


Best Practices for Audit Committees

• Assess Management• Be Informed• Review AC Charter• Hold at Least Quarterly Meetings• Keep Minutes


Best Practices for Audit Committees

• Review AC Membership• Meet with Outside Auditors and Counsel• Stay Engaged• Ask the Tough Questions• Have Open Communication


Best Practices in Managing the Audit Function

• Define the Role of Internal Audit• Routine and Regular Communication • Identify a process when issues arise that will impact cost or execution• Discuss Areas for Improvement at the end of the Audit • Set Fees on an Engagement Basis • Evaluate Both Internal and External Audit •Functions


Risk Oversight – Who is Responsible?

• Greater Board Involvement

• ERM Process

• Impact to Management



• Drivers of Risks

• Traditional Approach vs ERM

• Meant to be value adding



• Role of Audit Committees

• Tone at the Top

• Explicit Responsibilities

• Considered by Debt Rating Agencies



• Developing Audit Committee Processes

• Best Practices and Training

• Evaluation of Risk Information Received


Balancing Audit Cost with Benefits and Risk

• Compare your institution to peers and leading companies• Consider the impact of non-compliance• Evaluate the value received• Don’t try to be an expert in everything• Understand situations that cause problems• Communicate, plan and then communicate again• Understand that everyone has a job to do (Internal, External, Management and BOD)


Performance Measures for Internal Audit

• IIA Practice Advisory 1311-2 – recommends a balanced scorecard approach

• Three Broad Categories to Track Performance

1. Stakeholder Expectations2. Audit Process3. Innovation


Reasons for Performance Measures

• Clarify the mission and vision of the organization • Assist in translating its strategy into measurable objectives • Allows the organization to measure progress • Understand what improves results • Improved accountability and decision making • Alignment of operational activates and resources with strategic objectives • Encouragement of dialogue • A shared understanding of activities planned to deliver objectives • Clear communication of expectations to all organizational levels


Identifying Performance Category Strategies & Measurements

• Stakeholder Expectations – Internal vs External• Risk Assessment/Audit Planning• Planning and Performing the Audit Engagement• Communication and Reporting• Innovation and Capability• Training• Use of Technology• Industry Knowledge


Measurements - Stakeholder• At least 70% of the time is spent on direct audit hours • Over a three year cycle, at least 1,000 hours will be spent on:

o Compliance audits o Consulting o Information technology audits o Performance measurement o Operational auditing o Risk Management o Value for money audits

• Fraud Investigations are concluded within 60 days of employee being suspended • Client survey is conducted for every operational audit and results summarized for the Audit Committee.


Measurements - Processes• An in-depth risk assessment will be conducted every three years • Risk Assessment profile will be updated annually • Over a three-year cycle, some aspect of every department will be audited even if no activity is identified in risk assessment ranking • All audit assignments over 50 hours have an audit plan • Audit projects are within 10% of the approved budget or maximum of 50 hours over budget • Operational Audit Reports are issued within six weeks after exit interview • Final reports are issued two weeks after management responses received • Management implements over 75% of the recommendations within two years of audit report issuance • Management accepts over 90% of the recommendations in the audit reports.


Measurements - Innovation• All staff at Associate level and higher will have at least one auditing designation [CIA, CFE, CFI, CISA, etc]

• At least 10% of the staff time is spent on professional development • All staff proficiently use data analysis tools [ACL, IDEA, etc] • Staff understand the role of Legislation, Regulation, Policy, directives, and program procedures in relation to employees and public.


NACD – Ten Principles of Effective Audit Committees

1. Focus

2.Transparency

3.Communications



4.Question and Be up-to-date

5.Risk Management

6.Set Expectations



7.Resources

8.Tone at the Top



9.Change and Risk Management

10. Evaluate AC Effectiveness


Looking Ahead – External Auditor Oversight

•Speech by James Doty, Chairman of the PCAOB•April 4, 2011•Even Though the PCAOB Regulates Audit Firms Serving Public Clients – Wider Impact is Likely


Key Topics in the Speech • The Role of the Auditor and Value of an Audit

• Cost of a Failed Model

• Future of Auditor Oversight• Analysis of Audits Affected by the Economic Crisis• Firm Management and Monitoring• Enhancing the Auditor Reporting Model


Terminology • NACD – National Association of Corporate Directors

• IFRS – International Financial Reporting Standards

• ERM – Enterprise Risk Management

• QAR – Quality Assurance Review (IIA)


Resources

www.nacdonline.org

www.aicpa.org/ForThePublic/AuditCommitteeEffectiveness/

www.theiia.org

www.coso.org


http://www.nacdonline.org/

Contact

Del Rush501.975.0233

[email protected]


mailto:[email protected]

Managing Your Audit Function Webinar Series October 6th – 10:00 to 12:00 CST Presented by Del Rush...

Documents

Transcript of Managing Your Audit Function Webinar Series October 6th – 10:00 to 12:00 CST Presented by Del Rush...