Content Quarterly
Q3 2019
2
Content Quarterly is published the first month of every quarter. This issue summarizes content released during Q2 2019
and content planned for release during Q3 2019, by topic.
Contents Audit Practices ........................................................................................................................................................................ 3
Published Q2 2019 .............................................................................................................................................................. 3
Audit Practices ........................................................................................................................................................................ 5
Coming Q3 2019 .................................................................................................................................................................. 5
Governance ............................................................................................................................................................................. 6
Published Q2 2019 .............................................................................................................................................................. 6
Governance ............................................................................................................................................................................. 7
Coming Q3 2019 .................................................................................................................................................................. 7
Leadership ............................................................................................................................................................................... 8
Published Q2 2019 .............................................................................................................................................................. 8
Leadership ............................................................................................................................................................................... 9
Coming Q3 2019 .................................................................................................................................................................. 9
Risk ........................................................................................................................................................................................ 10
Published Q2 2019 ............................................................................................................................................................ 10
Risk ........................................................................................................................................................................................ 11
Coming Q3 2019 ................................................................................................................................................................ 11
Technology ............................................................................................................................................................................ 12
Published Q2 2019 ............................................................................................................................................................ 12
Technology ............................................................................................................................................................................ 13
Coming Q3 2019 ................................................................................................................................................................ 13
3
Audit Practices
Published Q2 2019
Assurance
Title Description Department Internal Audit's Technology Challenge Is No Easy Road
Two recent reports should raise serious concerns about internal audit’s slow progress in adopting technology.
Magazine
It's Not as Bad as It Seems Internal audit is a profession where it is easy to hit the wall, believing things will never get better.
Magazine
Did the "Watchdog" Bark Too Much in Glendale, Ariz.?
Outsourcing internal audit in the way envisioned in Glendale can undermine the independent assurance that internal audit provides.
Magazine
The Blockchain Conundrum Internal auditors should understand the risks and opportunities that blockchain presents so they can be prepared to respond when the technology becomes operable.
Professional Knowledge
Insights to Quality Data Analytics Support Successful Internal Audit Practices Quality
Breaking down the Standards This course explores the International Professional Practices Framework (Standards) with a focus on how its content relates to, and impacts the pivotal role of chief audit executives (CAE) in ensuring conformance with the Standards.
Training
Beyond the Basics: Essential Skills and Practices
In this updated course, you will learn several of the essential skills and practices that will help you identify opportunities to improve the efficiency and effectiveness of the internal audit process. Consultant-owned, not available ONA.
Training
Auditing Grants in the Public Sector This course provides participants with the knowledge needed to understand internal audit's role in grants, including understanding common terminology related to grants, and providing assurance in accordance with the rules, regulations, and restrictions as stipulated by the grantor or any legal or jurisdictional requirements.
Training
Audit Program
Title Description Department Auditing External Business Relationships
This guide provides internal auditors with guidance in auditing external or extended business relationships (EBRs). Management also may use this guide in managing and monitoring the risks associated with these relationships.
Standards & Guidance
Quality Assurance and Improvement Program
Title Description Department
The Oregon Success Story During the 2019 Virtual Symposium for the IIA Public Sector Audit Center, Jamie Ralls shared her story of auditing the internal audit function of Oregon, providing auditors at the local, state, and federal level some key takeaways.
Professional Knowledge
Small Audit Function Success This knowledge brief provides lessons and strategies from CAEs of small internal audit functions who are successfully conforming to the Standards.
Professional Knowledge
4
Reporting
Title Description Department Common Audit Reporting Mistakes With issues ranging from report focus to time spent on the
composition process, several missteps can diminish audit reporting effectiveness. Trainer and consultant Margie Bastolla reviews the dos and don’ts of creating an audit report.
Magazine
Reporting the Right Way What separates relevant audit reports from those that fall by the wayside? Trainer and consultant Margie Bastolla explains how to make sure report content resonates with stakeholders and results in concrete action.
Magazine
It's Not About You! What separates relevant audit reports from those that fall by the wayside? Trainer and consultant Margie Bastolla explains how to make sure report content resonates with stakeholders and results in concrete action.
Magazine
The Fallacy of Follow-up Audits I recommend a practical approach before undertaking follow-up audits that ensure the wisest use of internal audit’s scarce resources.
Magazine
Actionable Reports What can internal auditors do to help ensure their audit recommendations are acted upon? Trainer and consultant Margie Bastolla shares best practices and explains what stakeholders most want to see in an audit report.
Magazine
Your Work Isn't Done Yet There is a reason all findings should include all 5 C's. Magazine
Boredom Is Not an Option Reports should be compelling. If not, why write them? Magazine
Writing an Impactful Audit Report: 6 Tips for Being More Persuasive
The ultimate objective of internal audit reporting is not to describe what we found or to make recommendations for improvement — it is to persuade readers to take action.
Magazine
Innovative Approach to Audit Reports
The purpose of this knowledge brief is to document the steps one team took on its journey to bring more user-friendly, communications-focused ideas to the traditional audit report format.
Professional Knowledge
Formulating and Expressing Internal Audit Opinions
This document provides practical guidance to internal auditors who wish to form and express an opinion on some or all of an organization’s governance, risk management, and internal control systems.
Standards & Guidance
5
Audit Practices
Coming Q3 2019
Assurance
Title Description Department Liquidity This course gives an overview of how liquidity risk
management is fundamental to maintaining liquid capital position, which is crucial to the health of the greater financial system and the economy.
Training
Auditing Model Risk Management This course outlines internal audit's key role in assuring senior management and the board that the internal control system contained within the model risk management framework is operating at optimal levels and the results are interpreted accurately throughout the organization.
Training
Auditing Capital Adequacy and Stress Testing for Banks
This course provides an overview of the international standards and principles of capital adequacy management and explores the role of internal audit in evaluating the capital planning process.
Training
Consulting
Title Description Department
The Future Role of the Internal Auditor
Series one of three 20-page reports exploring the future role of internal auditors.
Foundation
Planning
Title Description Department Auditing Procurement in the Public Sector
The purpose of this project is to develop a practice guide to assist public sector internal auditors plan and execute internal audits of the procurement process. This will be achieved by promulgating meaningful background information on the topic, including insights into unique aspects of the risks and controls of the public sector procurement process.
Standards & Guidance
Quality Assurance and Improvement Program
Title Description Department
QAIP: Internal Assessment To maintain credibility and respect for the opinions, recommendations, findings, actions, and assurance an internal audit activity provides, The IIA requires internal audit functions to have in place an effective quality assurance and improvement program (QAIP). This guide will help internal audit activities remove the barriers – whether real or perceived – to enable them to not only comply with the requirement for the sake of compliance, but to build a better internal audit function that will help organizations achieve their goals and objectives.
Standards & Guidance
6
Governance
Published Q2 2019
Audit Committee
Title Description Department A Board's-eye View of Digital Disruption
Organizations fear keeping up with born-digital competitors. Magazine
The More You Say Many audit committees are voluntarily disclosing information about their oversight and performance.
Magazine
Board Problems With stakeholders' growing emphasis on corporate culture, boards could benefit from ethics expertise.
Magazine
Generating and Bringing Accurate Information to the Board (Issue 82)
Organizational success often depends on the decisions and guidance provided by the board. But even the most thoughtful decisions are only as good as the information people rely upon to make them.
North American Advocacy
Tone at the Top: Tiptoes the Line Between Audit and Risk Management (Issue 93)
Internal audit executives report on all sorts of things, and that’s not going to change. To whom all those things should be reported, however, is an open question.
North American Advocacy
Compliance
Title Description Department Willful Subversion of Second Line of Defense Can Land You in Jail
Recent headlines regarding two former drug company executives reflect the high stakes associated with control and compliance failures.
Magazine
Internal Audit: Are You ESG Ready? Internal auditors can help ensure their organizations provide the reliable and accurate environmental, social, and governance reports that investors increasingly demand.
Magazine
How to Audit Social Media By reviewing compliance with social policies, internal auditors can help their organizations assess risks.
Magazine
US Environmental Regulatory Update: Rhetoric vs. Reality in 2019
Recent regulatory and enforcement data released by the EPS could help us to better understand where we are presently as a country, and where we might be headed. This article explores these trends in some detail.
Professional Knowledge
Culture
Title Description Department Culture, Engagement, and Business Success
Employees' perceptions of workplace culture hinge on their leaders' actions.
Magazine
The Healthy Corporate Culture CAEs increasingly are being asked to assess, monitor, and report on the health of the organization's culture.
Magazine
The 5 Cs That Should Be Keeping Boards (and Auditors) Awake at Night
Internal audit must educate stakeholders on the complex web of risks facing the organization and be prepared to help navigate them.
Magazine
Getting a Handle on Harassment Organizations must keep a close eye on workplace behavior and make sure employees are protected.
Magazine
Auditing Culture: Bumps in the Road
Numerous obstacles can arise during culture audits, requiring that practitioners understand how best to navigate them.
Magazine
Auditing Culture IIA President and CEO Richard F. Chambers and former IIA Managing Director of CAE Solutions Doug Anderson team up to provide a comprehensive examination of organizational culture.
Training
7
Ethics
Title Description Department 3 Dynamics of Unethical Behavior Internal auditors need to be prepared to identify and address
unethical behavior, however it occurs. Magazine
Whistleblower Hotlines - A Clear Return on Investment
A whistleblower system can have a positive economic impact on the organization if it protects callers and takes their concerns seriously.
Magazine
Internal Audit Charter
Title Description Department It's Your Government, Too What's happening in your local government, and is internal
audit allowed to be part of the solution? Magazine
Governance
Coming Q3 2019
Audit Committee
Title Description Department The Internal Audit/Audit Committee Relationship
In 2019, Internal Auditor magazine introduced a new department, “Board Perspectives.” Its content is unique to the magazine in that it presents the audit committee’s view of its relationship with internal audit.
Training
Culture
Title Description Department Auditing Culture This guidance is intended to assist internal auditors in
understanding and evaluating the culture of the organization and the conduct resulting from that culture.
Standards & Guidance
Auditing Conduct This guidance is intended to assist internal auditors in understanding and evaluating the culture of the organization and the conduct resulting from that culture. Including an examination of new regulatory requirements regarding conduct risk management in the financial services industry.
Standards & Guidance
Ethics
Title Description Department Ethics for Internal Auditors The primary focus of this course is to provide you with an
overview of ethics and how they apply to internal audit utilizing the implementation guides supporting the code of ethics.
Training
8
Leadership
Published Q2 2019
Soft Skills
Title Description Department The Upside of Risk Internal auditors can provide greater value by also focusing on
the positive. Magazine
Thinking About Thinking Critical thinking is a core skill for internal auditors, but do we understand what it really means?
Magazine
7 Qualities of an Effective Critical Thinker
Internal auditors should challenge themselves to improve their critical thinking skills. Here's how to do it.
Magazine
Playing to Secure Our Next Move Family game nights can teach internal auditors a lot about communication and addressing risk.
Magazine
What Do They Think When the Internal Auditors Are Coming?
People have a tendency to see internal auditors as cold and impersonal. By honing our people skills, we can combat this harmful stereotype.
Magazine
Stakeholder Relations
Title Description Department Internal Auditing: Adding Value Across the Board
Competitive pressures demand that today's organizations squeeze the most they can from all their resources — and as this brochure indicates, the internal audit process is clearly among the most critical. In addition to their responsibility for assessing and recommending internal controls, internal auditors' skills in risk management and their broad-based perspective of the organization uniquely position them as a valuable resource for strong corporate governance.
Global Advocacy
Navigating Expectations Internal auditors can use a multifaceted approach to manage the diverse needs of stakeholders.
Magazine
Internal Auditors: Don't Sink Ships. Save Them
Follow six tips to demonstrate the positive force of internal audit.
Magazine
"I Have To" or "I Get To"? Viewing activities with a positive mindset can lead to a more satisfying experience and better outcome.
Magazine
Trying to Define Trusted Advisor We spend a lot of time talking about trusted advisors, but do we know what we're talking about?
Magazine
5 Common Misconceptions About Small Audit Functions
Small audit functions can accomplish big things by transforming negative perceptions into strategic advantages.
Magazine
Making Sure We Have a Pulse The numbers continue to come in; internal audit is not living up to its customers' expectations.
Magazine
Internal Audit's Customer Service Gap
Of course we provide excellent customer service. And our customers would assuredly agree.
Magazine
9
Stakeholder Relations (continued)
Title Description Department Internal Auditing: Adding Value Across the Board
Competitive pressures demand that today's organizations squeeze the most they can from all their resources — and as this brochure indicates, the internal audit process is clearly among the most critical. In addition to their responsibility for assessing and recommending internal controls, internal auditors' skills in risk management and their broad-based perspective of the organization uniquely position them as a valuable resource for strong corporate governance.
North American Advocacy
The Art of Getting Heard The purpose of this knowledge brief is to provide internal auditors with strategies on how to get their voices heard, through personal communication and writing, and prompt necessary actions by stakeholders that minimize organizational risk.
Professional Knowledge
Strategy
Title Description Department Events in the Mirror May Be Less Relevant Than They Appear
Hindsight bias greatly inhibits our ability to assess the effectiveness of our decision-making abilities.
Magazine
2019 North American Pulse of Internal Audit: Management Metrics and Audit Planning
To provide insights specifically for CAEs in financial services, FSAC conducted a separate analysis on 2019 Pulse responses from financial services participants. This report focuses on internal audit management metrics and audit planning.
Professional Knowledge
Talent Management
Title Description Department What Did You Learn Today? Internal auditors can take a variety of routes to pursue a
lifelong love of learning about the profession. Magazine
4 Steps to Becoming a Contagiously Confident Auditor
A well-prepared internal auditor can soar to new professional heights to serve the organization.
Magazine
Step Forward IIA's 2019–2020 North American Board chair, Benito Ybarra, says internal auditors can do more to enhance and protect organizational value.
Magazine
Intern Training Is Key to Good Beginnings
A well-planned training program can establish the foundation for a successful internal audit internship.
Magazine
Audit Team Transformation This knowledge brief examines additional strategies to retain talent, use talent to its fullest, and build a talent pipeline of multigenerational, multi-departmental sources.
Professional Knowledge
Leadership
Coming Q3 2019
Nothing planned.
10
Risk
Published Q2 2019
COSO
Title Description Department Don't Manage Risk — Manage Value
Changing risk standards pave the way for organizations to bring their experts together to pursue opportunities and cope with threats.
Magazine
Enterprise Risk Management
Title Description Department The Velocity of Risk In a time of instant crises, internal auditors and their
stakeholders need a sense of urgency to identify and manage risk.
Magazine
Anticipating Surprises Emerging and atypical risks are an opportunity for internal audit, says Jim Pelletier, vice president, Standards and Professional Knowledge, at The IIA.
Magazine
5 Tips for Tackling Third-party Risks Internal audit has an opportunity to help the organization address third-party risk, but many departments aren't allocating resources to it.
Magazine
In Line With Risk Implementing a risk management program can better align an organization's risk profile with its overall strategy.
Magazine
What's New Is Old Again Many new risks are just old risks wrapped in new technologies. Magazine
To Be Good Leaders, Internal Auditors Must Also Follow
I often encourage internal auditors who seek my advice to be followers in three fundamental areas.
Magazine
Fraud
Title Description Department The Social Engineering Fraud National culture plays a part in a whaling fraud that snares the
controller at an overseas subsidiary. Magazine
Every "Where Was Internal Audit" Moment Presents an Opportunity
Let’s examine what lessons we can take from the recent college admissions scandal and how internal audit could have made a difference.
Magazine
Whistleblower Shines Light on Fake Data
Researchers may turn to fraudulent methods to win lucrative grants.
Magazine
Diagnosing Health-care Fraud Government officials should strengthen data analysis and provider inspections to root out potential fraud in patient care.
Magazine
Books Bring Down the Mayor Strengthening ethics codes can deter government officials from using their positions to profit from inappropriate business deals.
Magazine
11
Fraud (continued)
Title Description Department Fuel for Fraud A recent case underscores ongoing fraudulent activity in
biofuel subsidy and compliance programs. Magazine
The Opportunistic CFO When a small, growing company hires an internal auditor, it discovers the chief financial officer embezzling profits.
Magazine
The Digital Land Grab In the Internet of Things era, fraudsters are cashing in on the scarcity of Internet Protocol numbers.
Magazine
The Cover-up One fraudster is bad, but multiple people carrying out separate schemes can be particularly costly without appropriate controls.
Magazine
Internal Control
Title Description Department Banks and Bitcoin A financial giant’s recent foray into digital coin could mean
increased cryptocurrency use — and the risks that accompany it — in commercial banking.
Magazine
Dissent in Risk Management Employee communication of constructive challenges can affect the organization's risk management program.
Magazine
Areas of Deficiency To inform the audit committee on external audit quality, internal auditors need to be familiar with the PCAOB inspection process and recurring findings.
Magazine
Risk
Coming Q3 2019
Enterprise Risk Management
Title Description Department Foundations of Financial Services Auditing
This guidance will inform and educate internal auditors who may be new to the financial services industry to understand the regulatory environment in which these organizations operate. This guide also provides internal auditors and other key stakeholders with an overview of how managing an internal audit function within the financial services industry differs from other industries in terms of regulatory interaction, governance, and risks.
Standards & Guidance
12
Technology
Published Q2 2019
Artificial Intelligence
Title Description Department Bias in the Machine Organizations that depend on artificial intelligence models
must control for factors that could expose them to discrimination risk.
Magazine
Audit Applications for AI Microsoft’s head of internal audit reveals some of the ways his department is applying AI technology to its audit work.
Magazine
AI Competencies and Courage Microsoft CAE Brian Foster examines the competencies internal auditors should possess when tackling AI audits and explains why practitioners shouldn’t be intimidated by the technology.
Magazine
Assessing AI Initiatives Brian Foster, Microsoft’s general manager of Internal Audit, discusses how to evaluate AI initiatives, including assessments of the reliability of data on which AI decision-making is based.
Magazine
Cybersecurity
Title Description Department Auditing the Smart City Increasingly sophisticated municipal technologies introduce a
host of risks that must be addressed. Magazine
Crime's Digital Transformation Fraudsters and cybercriminals are bringing innovation to wrongdoing, harnessing mobile, digital platforms, and advanced technologies to commit disruptive crimes
Magazine
Facebook Data Exposure Offers Critical Lesson for Internal Auditors
Practitioners must cultivate and maintain a keen understanding of how their organizations collect, manage, protect, use, and share data.
Magazine
2019 North American Pulse of Internal Audit: Cybersecurity and Information Technology Risk
This report focuses on risks associated with cybersecurity and information technology that are of importance to internal audit functions within the financial services sector.
Professional Knowledge
Data Analytics
Title Description Department Assessing Data Reliability Internal auditors can follow practical steps to ensure reports
are complete and accurate. Magazine
13
IT General Controls
Title Description Department The Single Point of Failure The death of a CEO highlights the risks of only one person
controlling access to corporate data. Magazine
Fit for Digital A new report suggests ways internal audit and other risk functions can help transformation initiatives succeed.
Magazine
Peace in Our Time Audit results shouldn't drive the IT department's strategy and priorities.
Magazine
Privacy
Title Description Department GDPR is Just the Beginning It is no surprise that cybersecurity and data protection remain
top worries among CAEs responding to this year's IIA North American Pulse of Internal Audit report. What is surprising is that CAEs are far less concerned about compliance with new data protection rules.
Magazine
A Matter of Privacy Internal auditors can assess data privacy governance within their organizations.
Magazine
GDPR's Global Reach Internal auditors around the world are starting to learn the impact of Europe's data protection regulation on their organizations and their role in compliance.
Magazine
Internal Audit and Data Ethics With organizations capable of collecting stunning amounts of data on people, internal auditors can help them draw the line between what is appropriate and what goes too far.
Magazine
Technology
Coming Q3 2019
Artificial Intelligence
Title Description Department Artificial Intelligence and Machine Learning
Feature article Magazine
Cybersecurity
Title Description Department Blockchain and Internal Audit Written in collaboration with Crowe, this research report is
intended for all internal auditors to help them assess their current level of preparedness regarding blockchain technology.
Foundation
Internet of Things Vulnerabilities Feature article Magazine
Cloud Security Feature article Magazine
14
Data Analytics
Title Description Department Data Analysis and Sampling Simplified: A Practical Guide for Internal Auditors
This is a book about data - about how to reduce large data sets down to the critical few high-risk subsets and how to select items or transactions for testing.
Foundation
Analytics Tips and Tricks Online only feature article Magazine
IT General Controls
Title Description Department Auditing Social Media, 2nd Edition This second edition addresses the rapid changes in technology
and communications and provides guidance on auditing social media and identifying possible risks.
Foundation
Audit of the Future: Audit 2.0 Written in collaboration with PwC, this report will advance readers' knowledge in several key emerging technology areas.
Foundation