Audit Committee Reporting:

Trends and Best Practices

Claudio de los Rios CPA, CA

November 9, 2016

Claudio de los Rios

2

• Canadian CPA,CA

• Public accounting and Tax in Vancouver, Canada• Deloitte, PwC, KPMG

• Internal Audit• Hewlett Packard, eBay, PayPal, OmniVision Technologies, Activision

Blizzard

• Wolters Kluwer TeamMate• Sr. Director, Strategic Market Development

Agenda

• Key Concepts

• 2014 Audit Committee Reporting Survey Results

• 10 Opportunities to Enhance Your Audit Committee Materials & Reporting

3

Key Concepts

“An effective relationship between the audit committee and the (organization’s) internal auditors is fundamental to the successof the internal audit function.”

“Are reports and other communications from internal auditors to the audit committee of an appropriate standard and do they provide value?”

Audit Committee Resource Guide, Deloitte, January 2013

4

Key Concepts

• “…to be successful, internal audit is less about presenting audit

results and more about engaging executives and board members in

thoughtful consideration of current challenges….”

• Key Questions to Address:• Can your organization take data and turn it into useful intelligence?

• Can your organization provide comparative information?

• Is your organization showing value of insights delivered by internal audit?

“Insight: Delivering Value to Stakeholders” IIA Research Foundation, 2011

5

Key Concepts

• Note strong focus on concepts:

• “providing value”

• “thoughtful considerations”

• “useful intelligence”

• “providing comparative information”

• Do not focus on report formats!

6

2014 Audit

Committee Reporting

Survey Results

7

Survey Background

• More than 300 audit executives surveyed regarding the following areas:

• Format of audit committee reporting

• Content provided to the audit committee

• Extent of current reporting practices

• Frequency of specific reporting activities

• Survey Data Augmented with insights from over half a dozen interviews with IA Leaders including current and former heads of COSO as well as current Audit Committee heads.

• Developed a set of 10 recommendations to enhance audit committee reporting methods, communications and content.

8

Survey Background & Demographics

9

1%

8%7%

19%65%

Location

Central or South America

Africa

Asia/Pacific Region

Europe and the Middle East

North America

1% 4%7%

22%

24%

42%

Organization Type

Partnerships

Educational Institutions

Not-for-profit Organizations

Government Agencies

Private Companies

Public Corporations

2%

8%12%

26%

28%

25%

Department Size

Depts with more than 100 members

Depts with 51-100 members

Depts with 26-50 members

Depts with 11-25 members

Depts with 6-10 members

Depts with 1-5 members

Polling Devices

10

Everyone should have a polling device

Your responses are anonymous –only group statistics are captured

Please return at the end of the session

Do you provide the audit committee with: (Check all that apply)

A. Copies of all audit reports

B. Summaries of all audit reports

C. Only audit reports with certain ratings or significant findings

D. Summaries of audit reports with certain ratings or findings

11

A. B. C. D.

26%

37%

0%

37%

Do you provide the audit committee with: (Check all that apply)

12

35%

12%

49%

43%

0% 10% 20% 30% 40% 50% 60%

Summaries of audit reports withcertain ratings or significant findings

Only audit reports with certain ratingsor significant findings

Summaries of all audit reports

Copies of all audit reports

Does this help the AC

focus?

Average total time to compile,

prepare and distribute audit

committee package is:

A. 1-4 hours

B. 5-8 hours

C. 1-3 days

D. More than 3 days

13

1-4 hours

5-8 hours

1-3 days

More

than 3 d

ays

6%

29%

59%

6%

Average total time to compile,

prepare and distribute audit

committee package is:

14

30%

49%

16%

5%

0% 10% 20% 30% 40% 50% 60%

More than 3 days

1-3 days

4-8 hours

1-4 hours

How satisfied are you with the

quality of your Audit

Committee materials?

A. I believe we have a leading edge package

B. Generally very satisfied

C. Somewhat satisfied

D. Our format is set and it is adequate

E. Not really satisfied15

A. B. C. D. E.

5%

47%

5%5%

37%

How satisfied are you with the

quality of your Audit

Committee materials?

16

According to KPMG's 2015 Global Audit Committee Survey, audit committee members rate much of the information they receive as good but are searching for more and better information

10 Opportunities toEnhance Your Audit Committee

Materials & Reporting

17

Framing the 10 Opportunities

• Focus on identifying knowledge and information that is

valuable to the audit committee as opposed to report formats.

• Note connections & interrelationships between opportunities.

• Tailor reporting and materials to the specific needs and

expectations of your audit committee.

• Approach as a strategic, relationship-building opportunity and

not a tactical exercise.

18

1. Share materials with the Audit

Committee more frequently

To better inform your audit committee, provide members with periodic information and updates between committee meetings

• Good communications is an iterative process focusing on: Valuable information and knowledge … not formats Building relationships and trust

• Think broadly about what kinds of materials and information would be of value to the audit committee: Audit committee articles and practices Risk and business-related materials Look beyond audit results

19

Reassess the type, nature and

frequency of communications

with the AC Chair

Goal – establish a clear and effective channel between the two parties

• 60% of respondents indicated they hold discussions with the AC Chair to help the AC set priorities BUT half of these do this by email

• Audit committees prefer timely and candid verbal communications

20

David Landsittel, a former COSO chair

There is much to gain from conducting executive sessions between audit chairs and CAEs. Such meetings provide the opportunity for the type of candid and constructive conversations that build rapport and strengthen the relationship

Enhance Relationships and

Build Confidence

• Expand the range of internal audit presenters to the audit committee - include direct reports to the CAE and other IA staff as appropriate.

• Informal meetings or events involving the audit committee and members of the internal audit staff.

• Have members of the audit committee conduct a critical review of internal audit's reports.

• Do they provide valuable insight?

• Do they reflect a strong knowledge of the organization and your primary areas of operation?

21

D

2. Utilize more automated

reporting support

• Leverage technology to enhance information-sharing and expand scope of activities

• Consider board portals

• Take your corporate culture into account

• Assess director receptivity to newer technology

• Meet with audit committee to review options

22

How are audit committee

materials provided to the

members

A. In hard copy only

B. Electronically plus hard copy

C. Only Electronically

D. Made available on a website

23

In h

ard co

py only

Elect

ronica

lly p

lus h

ard co

py

Only E

lect

ronica

lly

Made a

vailable

on a

websit

e

0% 0%

41%

59%

Ways to Enhance Audit

Committee Materials: Current

Considerations

24

3. Conduct a formal review of

your audit committee

materials and format

A. Yes

B. No

25

Yes No

28%

72%During the last 2 years, have you conducted a formal review of the format and/or content of your audit committee materials with the audit committee to identify possible enhancements

Executive Review of AC

Materials

26

Why not?

Gain advance support on key issues from management and the external auditor

Bob Hirth – COSO Chair

Do you review AC material with executive management BEFORE sending

it to the Audit Committee?

4. Pursue greater Management

involvement in follow-up on

reporting issues

• Ample opportunity for internal audit to foster greater involvement from management in the reporting process.

• Though hard to achieve, can significantly enhance the stature and positioning of internal audit.

27

How do you handle open audit issues,

including management responses & follow

up?

28

TeamMate 2014 Survey Results

Internal audit develops an updated status-report on open audit issues, including management responses and follow-up, and discusses the report with the audit committee

71%

Management develops an updated status-report on open audit issues BUT internal audit briefs the audit committee on report findings

16%

Management develops an updated status-report on open audit issues AND reviews report with audit committee

4%

Other 8%

Increase management’s responsibility for reporting the status of audit issues

29

Since management is responsible for following up on reporting activities, take steps to reinforce that responsibility

1. Find a champion within management to assist with

the follow-up reporting process

2. Reposition internal audit as function providing

assurance on actions as opposed to group responsible

for the actions

3. Assist management by providing a streamlined

technology solution to track and report on corrective

actions

D

5. Provide More Periodic

Trending Information

30

Audit Committees gain significant value from trending types of information:

• helps them gain a sound overall assessment of an organization’s systematic and thematic risk and control issues.

• predictive capabilities

Types of Trending

Information Provided

31

TeamMate Insight: Audit committees find trending information extremely valuable in assisting them to see broader thematic and systemic issues.

How to improve?

32

• Analyze trending information currently being provided to the audit committee. Does it seek to identify thematic and systemic issues?

• Ask senior management and members the audit committee what types of trending information they would find most valuable

• Revise internal audit processes to capture trending data as part of your ongoing procedures

Sometimes, it’s just about presentation…

“Playable” graphs and tables

33

6. Provide more Risk Information to the Audit Committee

34

CAEs have significant opportunities to step up and position themselves as trusted advisors to their audit committees

Consider how to acquire and share information on emerging risks

As an opportunity, consider the types of risk reporting only being used by a minority of survey respondents (next slide)

Demonstrate the direct linkage between changes to the organization’s risk profile and changes to the audit plan

The need to understand an organization’s risks and risk

management practices is a fundamental challenge for audit committees.

Types of Risk Information

Provided

35

D

7. Explore Combined Reporting Opportunities

• Audit committees appreciate and value combined reporting that contributes to consensus-building and the development of sound, enterprise-wide profiles of risks and controls.

• Only 28% of survey respondents prepare any materials on a combined basis with other risk-and-control functions.

• Suggests potential for many internal audit groups to increase stakeholder value by exploring additional opportunities for combined reporting.

36

Areas Where Internal Audit Prepares Audit

Committee Materials on a Combined Basis

with other Risk & Control Functions

37

When it comes to collaborating with other risk-and-control functions for combined audit committee materials, Enterprise Risk Management (ERM) leads the way for those following this practice.

Combined Reporting - Key

Success Factors

• Play the role of catalyst: • Develop a common framework

• Think about cooperation and working together – not about changes in organizational structure

• Be aware of potential silo issues

38

View the exploration of combined-reporting activities as an opportunity to increase information and knowledge sharing with other risk and control functions

D

8. Determine what types of internal audit

opinions are valued by the audit

committee

• When it comes to providing an annual opinion to the audit committee only 40% of survey respondents do so.

39

The experts interviewed in our process believe there is more value in selective assurance (wherein internal audit provides an opinion on a specific area or process) rather than an overall blanket opinion.

Overall Internal Audit Opinions

40

Key Considerations: Providing an annual opinion

• Would your audit plan support issuance of an overall opinion?

• Ask whether management sees value in an opinion • If yes, determine what type of opinion that might be

• Per previous chart, top area of focus for respondents providing an opinion: Assessing Adequacy/Overall System of Controls

• Also consider areas such as risk management and adequacy of financial controls

• Discuss opinion value with audit committee chair

41

D

9. Enhance reporting on

internal audit quality and

performance.

A. Yes

B. No

42

Yes No

36%

64%Do you provide the audit committee with any type of annual internal audit report on quality or performance?

Types of information reported

annually

43

10. Help the audit committee

focus and set priorities

• Basic challenge facing audit committees: the need to sift through volumes of materials to determine what really matters to their work.

• For internal auditors looking to provide value to their primary stakeholders, this challenge spells opportunity.

44

Techniques to Help the Audit

Committee Set Priorities

A. Yes

B. No

45

Yes No

53%47%

Do you have any specific techniques to help the audit committee set priorities?

Techniques to Help the Audit

Committee Set Priorities

46

* Other, including (1) Developing Matrix of Audit Committee Responsibilities, (2) Ranking Audits by Degree of Impact on Organization, (3) Use of Audit Ratings, and (4) Identifying the Severity of Each Audit Finding

Discussions with the Audit

Committee Chair

CAEs, in particular, can help facilitate audit committee discussion on key Issues.

• a pre-meeting call between the CAE and audit committee chair provides the CAE with an opportunity to play the role of advisor and recommend specific areas of focus for the audit committee agenda

• Well before meeting dates, send out deep-dive background information to the audit committee

47

Visual Analytics

Purpose

• Tell the story / communicate the message

• Assist the reader in thinking/reasoning about the topic

• Enable rapid comprehension / interpretation

• Support decision making

• Inform / provide insight

• Establish credibility

48

Visual Analytics examples

49

Visual Analytics examples

50

51

Visual Analytics examples

52

High Risk Issue by City

Visual Analytics examples

Claudio.delosrios@wolterskluwer.com

53

Resources Available www.teammatesolutions.com

Thanks for your

time

Claudio.delosrios@wolterskluwer.com