Internal Audit Plan Preparation –

Providing Value for the Organization

Richard Arthurs CMA, MBA, CIA

My Background20+ Years of International Finance, Audit and Risk Management Experience

13 Years with General Mills Inc. in Canada, US and UK

Managed audits, investigations, and risk in over 40 countries.

Now CAE with AltaLink/Berkshire Hathaway Energy in Calgary

Chair of IIA Canada - National Thought Leadership Committee

Chair of Benchmarking Committee - Strategic Risk Council – Conference Board of Canada

ERM Facilitator - Institute of Corporate Directors

1. Your Internal Audit

Value Proposition

Value starts with the strategy

and objectives of the business

Achieving Strategy = Effective Controls + Risk Management

(Make the connection easy to see)

Supporting Corporate Strategy

20xx Company Strategy

Internal AuditSupporting Strategies

Drive Profitable Growth in

Developed Markets

Aggressively Capture

Growth

Assure Organizational

Readiness to Resource

Future Growth

1. World-Class Risk

Assessment and Insight

2. Integrated Assurance

Partnerships

3. Optimized Resource and

Technology Utilization

Addressing Accelerating Change

3yr. GIA LRP

Supporting Strategies

1. World-Class Risk

Assessment and Insight

2. Integrated Assurance

Partnerships

3. Optimized Resource and

Technology Utilization

Acquisitions Globalization

Emerging Technology

3rd Party RelianceEconomic Uncertainty

Emerging MarketsAccelerating Change

If you do not make it simple

for leaders to value Internal

Audit they probably won’t.

Past Year Accomplishments(Market Your Internal Audit Value)

• Recovered $M Due to 3rd Party Billing Errors

• Supported Key Strategic Decisions

• Reduced Work Time Required by # Hours/Month

• Significantly Enhanced Cyber Security Controls

• Identified & Investigated Fraud Cases

2. Optimize Your Continuous

Risk Assessment Agility

Never before has the risk

universe of a business seen so

much constant change.

New emerging risk is

becoming very common.

Key Strategy 1: World-Class Risk

Assessment & Insight

1. World-Class Risk

Assessment and Insight

2. Integrated Assurance

Partnerships

3. Optimized Resource and

Technology Utilization

Risk Universe (Excluding Fraud & IT)

* Ernst & Young

Governance Risk� Board Performance

� Tone at the Top / Corporate Culture

� Enterprise Risk Management – Risk Mitigations

Planning & Resource Allocation Risk� Organizational Structure Change

� Strategic Planning

� Long Term Planning

� JV’s, Alliances and Partnerships

� Decision Speed

Technology change Risk– AMI, smart grid

� Industry Changes (Gas Generation)

Customer Demand Changes Risk� Customer Demand Changes

Competition Risk� Client Services / Satisfaction

� Communication Strategy and Plan

Enterprise Portfolio Risk� Alliance/Partnerships

� Trademark/Brand Name

� Wholly Owned Affiliates

Government Policy Risk� Regulatory Changes

Political Risk� Political Changes

Lifecycle Risk� Industry & Demand (30+ Year Rate Base Projection)

Organizational Structure Risk� Performance Management (STIP/LTIP)

Business Development Risk� Mergers and Acquisition and Divestiture

� Opportunity Capture

� Executing Captured Opportunity

� Due Diligence: Risk Assessment & Management

Major Initiatives Risk� Planning and Execution

� Measurement and Monitoring

� Technology Implementations

� Business Acceptance

Communication/Investor Relation Risk� Government/Media/Public Relations

� Land Owner Consultation & Relations

� Stakeholder/Investor Relations

� Reputation Management

� Crisis Management

� Regulatory/Legal Response Plan

� Employee Communication

People Risk� Employee Fraud and Investigations

� Organizational Capacity & Capabilities

� Employee & labor relations

� Contractor Management & Excessive Usage

� Health & Welfare & Safety

� Excessive Recruitment and Turnover

� Timely & Effective Training and Development

Project/Operations Management Risk� Contract Commitments

� Scheduling & Forecasting

� Documentation & Standards

� Design, Mapping and Drafting

� Procurement / Competitive Bidding

� Vendor Selection / Contract Management

� Vendor / Contractor Management

� Project Execution (Stage Gate) & Management

� Change Notice & Management

� New Technology: Smart Grid

� Client & Service Interaction

� Quality Assurance & Control

� Incident Management & Investigation

� Safety & Reliability

� Fleet Purchases, Maintenance and Management

� Asset Management

� Environment Management Strategy

� Land Management Strategy

� Performance Management Gaps/KPI’s

� Physical Security/Disturbance Analysis

� Privacy & Confidentiality

� Business Continuity / Disaster Recovery

External Risk� Catastrophic/Natural Disaster/Weather

� Sabotage / Terrorist

� 3rd Party Contractor Mgmt./Reporting (Earned Value)

� Customer/3rd Party/Land Manager Fraud

� Supplier Performance

� Supplier Availability /Sole Source

� Availability of Goods and Services

IT & Control Center Risk� Third Party Suppliers and Outsourcing

� Control Center Operations

� Programs and Change Management

� Security and Privacy (Firewalls, Access Management)

� Physical Environment

� Staffing/Operations/Disaster Recovery

� Data Security

� Infrastructure

� Applications and Databases

� Legal and Regulatory

� Telecommunications

� Load and Demand Balancing

� Outage Scheduling & Management

� Safety and Environmental Systems

Strategic Operational

Enterprise Risk UniverseCompliance

Code of Conduct Risk� Ethics / Conflict of Interest

� 1-800 Ethics Line Management

� Fraud (Anti Fraud Program)

Legal Risk� Contracts

� Stranded Asset Issue

� IP and Patents

� Liability Protection, Regulation & Insurance

� Anti-Corruption

Regulatory Risk� Due Diligence Process

� GTA Hearing, IR & Processes

� AESO/AUC/Prudency Audits & Enforcement

� Alberta Reliability Standards

� Labor Standards

� Engineering Standards

� Environment

� Quality, Health and Safety

� Data Protection, Availability, and Privacy

� International Laws and Standards (I.e. FCPA)

� Tax Compliance

� Customs

� Discriminatory Practices

Financial

Rate Base and Cost Recovery Risk� Regulated Tariff: Unapproved Costs/Prudency

� Deferral (DACDA) and Reserve Accounts

� Capital Budgeting and Cost Management (ABC)

� Transmission and Miscellaneous Revenue

� Customer Deposits

Financial Accounting & Reporting Risk� Accounts Payable / Receivable

� Inventory, Prepaid Expenses & Deposits

� Budget & Planning Forecasts

� Accounting/External Reporting - IFRS

� Fund Investment & Evaluation

� Management/Internal Reporting

� Inter-affiliate Transactions (SNC-ATP)

� ICFR: C-SOX / Disclosure Controls

� Payroll & Expense Reporting

� Capital Overhead Allocation (I.e. E&S)

� Taxes and Insurance

Liquidity, Credit, and Equity Risk� Corporate Funding / Equity Management

� Access to Capital Markets

� Debt Maturity Profile

� Flexibility in Capital Spending Budget

� Contingency Funding

� Collateral Requirements

� Capital Availability

� Fund Diversification

� Credit Risk Management/Credit Downgrade

Cash Flow Risk� Daily Operational Funding

� Cash Flow Projections/Forecasting

Profitability Risk� Return on Capital / Debt

Market Sensitivity Risk� Commodity Price

� Commodity Volatility

� Interest Rates

� Security Prices

� Foreign Exchange

Volume Risk � Attrition

� Economic Factors

� Variable Load

Market Liquidity Risk� Market Tightness, Depth, and Resilience

Investment Performance Risk� Pension Fund

IT Risk

Universe

Operations

Security &

Privacy

Staffing

Third-party

Suppliers &

OutsourcingLegal &

Regulatory

Applications

& Databases

Infrastructure

Data

• Non-compliance with

regulators

• Non-compliance with

software license

contracts

• Poor service levels

• Data leakage

• Inadequate support

• Lack of assurance• Budget overruns

• Significant delays

• Poor quality of deliverables

• Ineffective change control

• Intrusion of malware

• Virus attacks

• Website attacks

• Poor patch

management

• Utilities failures

• Natural disasters

• Labour strikes

• Environmental

sanctions

• Loss of key resources

• Inability to recruit IT

staff

• Mismatch skills

• Lack of business

knowledge

• Operator errors

during backup or

maintenance

• Breakdown of

operational processes

• Disclosure of

sensitive data

• Corruption of data

• Unauthorized access

• Failure to mine

information

• Damage to services

• Inflexible IT

architecture

• Theft

• Obsolete technology

• Unsupported

applications

• Critical system

failures

• Unable to handle

load

• Configuration issues

* Ernst & Young

IT Risk Universe

Assess Risk Prioritize RiskK

no

wle

dg

e a

nd

Pri

or

Au

dit

Re

sult

s SurveySurvey

InterviewsInterviews

WorkshopWorkshop

SurveySurvey

InterviewsInterviews

WorkshopWorkshopFinancialFinancialFinancialFinancial

ComplianceComplianceComplianceCompliance

OperationsOperationsOperationsOperations

StrategicStrategicStrategicStrategic

Identify RisksMgmt

(Exec. & BU)

Key Initiatives & Changes in Business

Fraud & Geographic

Risks

External / IndustryIssues

External Auditor

Value proposition:

• Demonstrate linkage between risk assessment and audit plans

• Clear linkage to business strategy, ERM and IA priorities

• Justifiable audit plan coverage to Audit Committee, External Auditors, etc.

• Provide proactive risk prevention & management advisory services

*Ernst & Young LLP

Audit Plan Development

Prioritized

Risks from

Risk

Assessment

C-SOX/SOXCompliance

Managementand Audit

CommitteeExpectations

RotationAnd

Follow-Up

Prioritize Projects

SpecialProjects orUnplanned

Audits

Re

con

cile w

ith A

ud

it Co

mm

ittee

Not all risks are

covered in the Plan

Allocate Against

Available Resources

Finalize Audit Plan

Projects

* Ernst & Young

Audit Plan Development

3. Independent Risk Assessment

Internal Audit

Independent

Risk AssessmentTop 10 Risk Areas

1.

2.

3.

4.

5.

6.

7.

8.

9.

10.

Top 10 Risks vs. ERM Top Risks

3. Define Your Role as The

Trusted Strategic Advisor

It takes time to build trusting

relationships.

Becoming the Trusted

Strategic Advisor requires

consistent value delivery.

Control &

Compliance

Business

Insights

Strategic &

Value-added

Advisory

Non-Negotiable

High Performing

World-Class

Value

� Financial and Compliance Assurance

� Corporate Governance

� Maintain Independence

� Pipeline of Leadership Talent for Finance

� Utilize ERM Intelligence

� Emerging Risk Advisory Projects

� Comprehensive Audits and Data Analytics

� Operational Audits

IA Strategies:

1. World-Class Risk Assessment and Insight

2. Integrated and Specialized Assurance Partnerships

3. Optimized Resource & Technology Utilization

Align IA Strategy to Value Added Advisory

Strategic

Risk

Operational Risk

Financial and Compliance Risk

A Trusted Strategic Advisor is

Aware of Risk Appetite,

Capacity and Tolerance.

Advise on Intelligent Risk Taking

Being the Trusted Strategic

Advisor requires partnership

with all assurance providers.

26

1. World-Class Risk

Assessment and Insight

2. Integrated Assurance

Partnerships

3. Optimized Resource and

Technology Utilization

Key Strategy 2: Integrated Assurance Partnerships

4. Link Value and Risk, to Your

Planned Audit Activity

Never Assume Anyone

Understands the Value an

Audit or Advisory Can Deliver

Standard

Risk

Coverage

New Risk

Focus or

Process

Emerging

Risk

Traditional Assurance

Non Traditional Assurance

• Undefined Risk and Controls

• High Level of Change / Future Focus

• IA Focus: Risk Advisory

• Example: Cyber Security

• Moderately Defined Risk and Controls

• Medium Level of Change / Present & Future Focus

• IA Focus: Assurance Audits & Risk Advisory• Example: Integration

• Highly Defined Risk and Controls

• Medium to Low Level of Change / Past & Present Focus

• IA Focus: Assurance Audits• Example: Financial Audits

Define Audit vs. Advisory

Internal Audit

Independent

Risk AssessmentTop 10 Risk Areas

1.

2.

3.

4.

5.

6.

7.

8.

9.

10.

Plan Every Audit to Ensure it

Will Deliver Obvious Value

Internal Audit PlanAUDIT

ADVISORY

Standard Risk Coverage New Risk Focus or Process Emerging Risk

AUDIT

AUDIT

ADVISORYAUDIT

Traditional Assurance Non Traditional Assurance

Risk Based Audits

& Advisory

AUDIT

ADVISORY

ADVISORY

Compliance Activity

External AuditsAUDIT

AUDIT

AUDIT

AUDIT

Audits x

Advisory x

AUDIT

ADVISORY

IT/Data Analytics AUDIT AUDIT

AUDIT ADVISORY

ADVISORY

Internal Audit

Independent

Risk AssessmentTop 10 Risk Areas

1.

2.

3.

4.

5.

6.

7.

8.

9.

10.

AUDIT

AUDIT

ADVISORY

AUDIT

AUDIT

AUDIT

AUDIT

ADVISORY

20xx 20xx (Subject to Change) 20xx (Subject to Change)

AUDIT

AUDIT

AUDIT

AUDIT

AUDIT

ADVISORY

AUDIT

AUDIT

AUDIT

ADVISORY

ADVISORY

AUDIT

ADVISORY

ADVISORY

AUDIT AUDIT

AUDIT

AUDIT

AUDIT

AUDIT

AUDIT

AUDIT

ADVISORY ADVISORY

ADVISORY

AUDIT

AUDIT AUDIT

ADVISORY ADVISORY

AUDIT AUDIT AUDIT

ADVISORY

AUDIT

High – Med Risk

Med – Low Risk

Emerging or

New Risk Focus

AUDIT AUDIT

AUDIT AUDIT

3 Year Audit Plan

4. Resource Optimization

Recruit Leaders & Help Them

Become Passionate About the

IA Value Proposition

1. World-Class Risk

Assessment and Insight

2. Integrated Assurance

Partnerships

3. Optimized Resource and

Technology Utilization

Key Strategy 3:

Optimized Resource and Technology Utilization

The Best Internal Audit Shops

Only Recruit Future Leaders

Who Love to Learn

6. Professional Development

Undergraduate Degree:

MBA:

Emphasize Professional Credentials

If You Cannot Deliver Value

Efficiently then Consider Data

Analytics

Executive Dashboards

5. Continuous Improvement

The Best Way to Manage

Audit Client Expectations is by

Gaining Alignment on a

Maturity Assessment

Maturity Maps

Control Environment

Risk Assessment

Control Activities

Information &

Communication

Monitoring Activities

1. Demonstrates commitment to integrity and ethical values

2. Exercises oversight responsibility

3. Establishes structure, authority and responsibility

4. Demonstrates commitment to competence

5. Enforces accountability

6. Specifies suitable objectives

7. Identifies and analyzes risk

8. Assesses fraud risk

9. Identifies and analyzes significant change

10. Selects and develops control activities

11. Selects and develops general controls over technology

12. Deploys through policies and procedures

13. Uses relevant information

14. Communicates internally

15. Communicates externally

16. Conducts ongoing and/or separate evaluations

17. Evaluates and communicates deficiencies

New COSO Model

IIA Quality Assessment

6. Reporting & Grading

Great CAE’s Must Perfect the

Art of Managing Expectations

Audits Completed - 2013

Audit Tracking Audit Grade # of Audit Comments

Audit FocusWell

ControlledSatisfactory

Needs

Improvement

Audit

Committee

Senior

Management

Continuous

ImprovementDue Notes

Q1

Q1

Q1

Q1

Q1

Q2

Q2

Q3

Q3

Q3

Q3

Q4

Q4

Advisory

Q1

Q1

Q2

Q2

Q3

Q4

PMO OPS IT FIN LEGAL HR CUST SERV EXT REL BD

# AUDITS

# COMMENTS

Tracking

20xx 20xx YTD

Well

ControlledSatisfactory

Needs

Improvement

Well

ControlledSatisfactory

Needs

Improvement

42%

27%

31%

0

1

2

3

4

5

6

5.5

3.5

4

• •

57%14%

29%

0

1

2

3

4

5 4

1

2

Audit Committee Update

A High Value

Audit Shop is a Development

Engine for Future Leaders

Questions ??