Internal Audit Support of Audit Committees

1
Internal Audit Support of Audit Committees What
Works Best

• The Institute of Internal Auditors
• Webcast Series on Sarbanes-Oxley
• Session 5 September 9, 2003

2
The IIA Webcast Moderator

• Jim Key, CIA
• Managing Partner
• Shenandoah Group, L.L.P

3
Disclaimer

• The views expressed in this webcast are solely
  those of the panelists and moderators and do not
  necessarily reflect the views or policies of The
  Institute of Internal Auditors or its directors,
  officers, employees, and members.

4
Series 2 Emerging Trends and Best Practices in
Implementing SOA

• May 21 - Section 404 Readiness Review How to
  document your system of internal control.
  (Archived)
• June 10 - Helping your audit committee implement
  complaint handling. (Archived)
• July 8 - Leveraging the COSO framework to meet
  Section 404 requirements (Archived)
• August 12 - Project Administration Setting and
  revising priorities in the wake of the Final 404
  Rules (Archived)
• September 9 - Internal Audit support of Audit
  Committees What works best
• September 30 - The Road Ahead Meeting the
  challenges in complying with The Sarbanes-Oxley
  Act

5
Webcast Series on SOA

• Fostering Compliance with SOA Internal
  Auditors Role
• Four sessions archived on IIAs website and
  available on CD
• Originally aired January 28 April 15, 2003

6
Agenda

• 100 Introductions and Overview
• 110 Managing the Auditors Janice Wilkins
• 120 Managing the Audit Committee Schedule -
  Norman Marks
• 130 Educating the Audit Committee Jerry
  Ferenczy
• 140 Break
• 145 Questions and Answers - Panel
• 225 Wrap up - Jim Key

7
Managing the Auditors -How Internal Audit
Supports the Audit Committee

• Janice Wilkins
• Vice President
• Director, Internal Audit
• Intel Corporation

8
Supporting the Audit Committee

• Competency Assessment
• Services Fees
• Audits Reporting
• AC Operations
• Regulatory Compliance

Board of Directors
Management
Audit Committee
Compliance with Applicable Laws Regs
Effectiveness Efficiency of Operations
Reliability of Financial Reporting
Internal Audit
External Audit
Oversight of Financial Reporting Process
Internal Control
9
Competency Assessment

• Independence and objectivity
• Client and industry knowledge
• GAAP and GAAS expertise
• Proactive communications/responsiveness
• Domestic and international staff quality
• Internal quality control
• Litigation
• Negative press

10
Services and Fees

• Regulatory compliance verification
• Non-financial audit pre-approvals
• Audit scope review
• EA budget coordination and reporting
• IA budget and staffing reviews
• Benchmarking
• EA contract re-bid
• EA partner rotations
• EA engagement team employment

11
Audits and Reporting

• Enterprise, business unit and financial reporting
  risk assessments
• Controls evaluation and opinion
• EA and IA audit coordination
• Management Letter Comments coordination
• Focus topic discussions
• Anonymous reporting administration
• Fraud investigations

12
Audit Committee Operations

• AC charter development and review
• Meeting agenda setting
• Facilitate pre-earnings calls
• Meeting minutes review
• Annual planner
• Annual AC self-assessment
• Financial expert independence assessments
• DO questionnaires review
• Annual EA and IA assessments

13
Regulatory Compliance

• Regulatory and emerging issues updates
• Ethics and compliance oversight and evaluation

14
Agenda

• 100 Introductions and Overview
• 110 Managing the Auditors Janice Wilkins
• 120 Managing the Audit Committee Schedule -
  Norman Marks
• 130 Educating the Audit Committee Jerry
  Ferenczy
• 140 Break
• 145 Questions and Answers - Panel
• 225 Wrap up - Jim Key

15
Managing the Audit Committee Schedule

• Norman Marks
• Vice President, Internal Audit
• Solectron Corporation

16
Outline

• Demands on the Audit Committees time
• Demands on managements time
• The role of the CAE
• Tips and techniques
• Conclusions

17
Demands on the A/C time

• Expectations? Detail?
• Per Korn-Ferry, A/C time doubled
• Sarbanes-Oxley, SEC, Listing Standards
• Courts expect best practices
• Greater liability (?)

18
Demands on the A/C time

• Oversight of
• Financial Reporting
• EA and IA (Internal Controls)
• Whistleblower Process
• Ethics Program
• Risk Management
• Member training

19
Demands on Management

• Preparation before presentations at every
  meeting
• Actions after/between meetings
• Board focus on governance vs. management

20
The Role of the CAE

• Advisor to Audit Committee
• Advisor to Management
• Help identify Best Practices
• Often manage Audit Committee agenda
• Often prepare Audit Committee materials

21
Tips and Techniques

• Delete unnecessary charter tasks
• Audit Committee checklist from charter
• Lay out agendas for full year
• Pre-reading materials and expectations
• Reviews, etc. through e-mail
• Information between meetings

22
Delete Tasks

• Are all Committee activities necessary?
• Eliminate historic tasks
• Focus on governance vs. management
• Prioritize activities

23
Committee Checklist
March
January
24
Lay out year

• Meetings with a theme (e.g., year-end)
• Move meetings to avoid calls (e.g., to coincide
  with 10-Q review)
• Long meetings once a year (e.g., for training)

25
Pre-reading materials

• Provide hard and soft copy well in advance
• Members expected to read before meeting
• Questions to CAE, etc. by e-mail before meeting

26
Reviews prior to meeting

• Draft 10-Q, proxy, etc. sent to members early
• Questions posed and answered via e-mail
• At meeting, limit to confirmation that questions
  answered

27
Between meetings

• Dont wait to share important information and
  handle through e-mail (e.g., audit reports)
• Stay in touch and talk to members

28
Conclusions

• The Audit Committees load considerably increased
• Members do not want to limit their activities and
  spend double the time
• They, management, and CAE can make meetings
  efficient with discipline and imagination

29
Agenda

• 100 Introductions and Overview
• 110 Managing the Auditors Janice Wilkins
• 120 Managing the Audit Committee Schedule -
  Norman Marks
• 130 Educating the Audit Committee Jerry
  Ferenczy
• 140 Break
• 145 Questions and Answers - Panel
• 225 Wrap up - Jim Key

30
Educating the Audit Committee

• Jerry Ferenczy, CPA, CISA, CPCU

31
Audit Committees the Past

• Met 3.3 times a year for less than 1 hour
• 1/3 did not regularly meet with IAD 10 never
  met with them
• Had no required pre-existing skill sets most
  committee members had no formal training or
  education plan

32
Audit Committees the Present

• Meet average of 6 times a year some as many as
  16
• Are required to review IAD and risk management
  must perform self evaluations
• Must have some degree of financial literacy

33
The Effect

• Boards must look at more stuff in more detail
  than ever before
• Boards typically have two different types of
  members
• Each type has different perspectives and needs
• CAE must be prepared for both types

34
Suggestion 1

• Know Your Committee Members
• WHERE WEVE BEEN HAS A LOT TO DO WITH WHERE WE
  ARE GOING.

35
Suggestion 2

• Know Whats Important
• These facts, if true, suggest that the directors
  consciously and intentionally disregarded their
  responsibilities. . .
• They simply did not care if they were making a
  material decision with adequate information.
• - the Disney decision

36
Suggestion 3

• Share What You Know
• "You got to be careful if you don't know where
  you're going, because you might not get there."
• Yogi Berra

37
Conclusion

• Those who fail to learn from the past are doomed
  to repeat it.

38
Webcast Summary

• Internal Audit must support the Audit Committee
  in its new role as manager of the external
  auditors
• Assisting the Audit Committee in managing its
  schedule is now critical with impact of Sarbanes
  Oxley
• Educating the Audit Committee to serve its
  broadened role is essential

39
Thank you for your participation!

• Dont miss our next Webcast series
  beginningSeptember 30, 2003