Robert L. Mainardi - Beyond Audit

Published simultaneously in Canada.

No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning, or otherwise, except as permitted under Section 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, Inc., 222 Rosewood Drive, Danvers, MA 01923, (978) 750-8400, fax (978) 646-8600, or on the Web at www.copyright.com. Requests to the Publisher for permission should be addressed to the Permissions Department, John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030, (201) 748-6011, fax (201) 748-6008, or online at www.wiley.com/go/permissions.

Limit of Liability/Disclaimer of Warranty: While the publisher and author have used their best efforts in preparing this book, they make no representations or warranties with respect to the accuracy or completeness of the contents of this book and specifically disclaim any implied warranties of merchantability or fitness for a particular purpose. No warranty may be created or extended by sales representatives or written sales materials. The advice and strategies contained herein may not be suitable for your situation. You should consult with a professional where appropriate. Neither the publisher nor author shall be liable for any loss of profit or any other commercial damages, including but not limited to special, incidental, consequential, or other damages.

For general information on our other products and services or for technical support, please contact our Customer Care Department within the United States at (800) 762-2974, outside the United States at (317) 572-3993, or fax (317) 572-4002.

Wiley publishes in a variety of print and electronic formats and by print-on-demand. Some material included with standard print versions of this book may not be included in e-books or in print-on-demand. If this book refers to media such as a CD or DVD that is not included in the version you purchased, you may download this material at http://booksupport.wiley.com. For more information about Wiley products, visit www.wiley.com.

Library of Congress Cataloging-in-Publication Data is Available:

ISBN 9781119789604 (Hardback)

ISBN 9781119789611 (ePub)

ISBN 9781119789628 (ePDF)

Cover Design: Wiley

Cover Image: Photo by Oliver Buchmann on Unsplash

Author Photo: Courtesy of the author

To my parents, Angelo and Lucy, who watch over me. I hope they are proud of the son, brother, friend, and father they raised. And to my children, Robert and Gabrielle, I will never stop loving and supporting you…always believe in yourselves .

FOR OVER THREE DECADES, I have been actively working in an internal audit department or partnering with them to create the most effective and efficient audit operations. That operational efficiency measure has given way to determining if these departments are truly focusing on the most critical risks their company is, might be, or could be facing. Too often, internal audit departments get caught in a “drone army” mentality and focus on moving the audit coverage forward without building any additional business process knowledge or providing guidance to improve the overall business process. While coverage is important and should be considered, examining all aspects of an internal audit operation will prove to be invaluable.

At the time this book was written, companies and their employees are developing plans in the hopes of resuming normal business operations and activities. This is an excellent opportunity for internal audit departments to pause and consider not only how effectively they execute their corporate responsibilities, but also how much risk permeates in each phase of their audit process as well as their entire audit methodology and the successful compliance and execution of same. Throughout this book, there are references to the Beyond Audit methodology, which has been developed to provide insight, guidance, techniques, suggestions, and templates to improve your current audit methodology. Additionally, it will introduce the Audit Risk Barometer, which was created to allow audit departments to independently and objectively assess their operations through a review of six individual and distinct categories and deliver an overall audit process risk assessment to focus and create targeted action plans to address opportunities for improvement. The risk barometer facilitates an in-depth view of your current audit function from the current methodology to the delivery of your audit products, which generates the detailed support for the overall risk score and blueprint to address the most impactful enhancements to improve the audit function.

This book addresses the need for internal audit departments to focus on improving their own process in the new remote audit environment to ensure they are working in partnership with the business owners to gain a clear understanding of the business objectives and gather all pertinent information and data to provide value-based recommendations which result in real change. The only way to facilitate change is to ensure that the audit department recognizes the critical skills required to be successful in the execution of remote audits and continues the development of those skills to improve audit performance.

It should be noted that at the conclusion of each chapter, there will be a link provided that will allow the reader to view a video summary of a particular skill, technique, or template discussed in the chapter and or an interview with a subject matter expert examining the concept that was detailed in the chapter.

Chapter 1provides a discussion regarding the current state of internal audit departments around the globe and the corresponding challenges they are encountering when trying to execute and complete their audit plan, often with only virtual access to their business partners. It also explains the critical role the business partner plays throughout an audit and how internal audit needs their participation.

Chapter 2takes an in-depth look and analysis of being assigned to a remote audit, especially for the first time, and all the challenges that executing a remote audit engagement will present through each phase of the audit. Included in the discussion will be suggested targeted techniques that provide the audit team with the tools to stay on track and produce value focused results and an introduction to the importance of the internal audit and business partner relationship.

Chapter 3outlines how to successfully market the internal audit department to ensure all business partners understand what internal audit does and, more importantly, why they do it. More than ever in this remote audit environment, a clear communication of internal audit's mission statement, purpose, and partnership will be required to complete the audit engagement requirements.

Chapter 4introduces the Beyond Audit Learning Map and personal development plan process as well as the critical skills necessary for every auditor to develop and foster to be successful at their level in the department. And while communication will always be a critical skill for auditors to continually develop, there are seven other skills discussed to consider in any development plan.

Chapters 5through 8provide the methodology details for the three main audit phases: (1) planning, (2) fieldwork, and (3) reporting, plus the action plan implementation phase to facilitate change in the business process. Each chapter defines the phase and the specific objectives and corresponding requirements needed to comply with the audit methodology.

Chapter 9presents and explains the audit dashboard process from the objective of the dashboard, to development, to reporting, to required actions needed to address gaps identified using audit performance data. Also included in the dashboard discussion are techniques to identify specific metrics to be tracked from your existing audit methodology and the corresponding metric criteria requirements to score metric performance.