State of Internal Audit Pakistaninternalauditclub.com/.../Ist-Survey-Report-State-of-Internal-Audit... · STATE OF INTERNAL AUDIT IN PAKISTAN – FIRST SURVEY REPORT 2 Message from

STATE OF INTERNAL AUDIT IN PAKISTAN

STATE OF INTERNAL AUDIT IN PAKISTAN – FIRST SURVEY REPORT 1

Table of Contents

Message From CEO ......................................................................... 2

Key Findings-Analysis and Insights………..........……………...…….3

The Ambition of Internal Audit Functions… ................................. 4

Process Improvement and Value Addition .................................. 4

Implementation of Outstanding Recommendations .................... 5

Effective Stakeholder Engagement ............................................... 6

Areas For Improvement .............................................................. 7

Factors Differentiating The Value Providers With Others .......... 8

Risk Based Work ...................................................................... 8

Staff Skill Set Diversification ..................................................... 9

Effective Stakeholder Engagement ........................................... 10

Detailed Survey Responses…………………………………...…...…11

People and Organization.…………………………………...……11

Work Management………………………….……...……….….…16

Issues and Challenges……………………………….………….…24

Survey Demographics ................................................................... 31


Message from CEO

Internal Auditors carry a unique role in the organizations they serve. The role gives them the right to understand, analyze and provide input for improvement in the way the organization functions. However, with the luxury of having such an opportunity at hand, they are seldom considered as the integrators of value addition. The need to turn this around was never more required!

To contribute in meeting this challenge, we engaged more than 100 organizations across various industries and sizes in Pakistan and conducted a survey to see where the Internal Audit functions stand today. The initiative built on the theme of “Better Governance Prosperous Pakistan” is the first of its kind in the country and envisions to make strong Internal Audit functions for better governed organizations and the country. The report aims to provide self-assessment opportunity to the Internal Audit functions, and suggest ways to move forward for meeting the challenges they encounter in today’s world. Each individual company can assess as to where it stands in comparison to the rest operating in the same environment. Further, insights and opinions of the subject matter experts, practitioners and stakeholders are made part of the report. These can be used as a source of guidance for setting the future course of action. I would like to add here that the pace with which the new business models are emerging, the battle which the organizations are fighting on the data security front, complexity in operating models, free and rapid flow of information with a blink of an eye and increased awareness amongst the customers coupled with strong regulatory regimes are just the few challenges organizations have to cope with. Unless and until Internal Auditors’ work is related to these; they would just be considered as a cost of doing the business and nothing more. I sincerely hope that Internal Auditors, Management and members of the Audit Committees would find this report useful in making their organization more effective.

.


1Key Findings


The Ambition of Internal Audit Functions

Process Improvement and Value Addition More focus on process improvement and value addition is the top priority according to the survey results. Audit functions have been generally guilty of being compliance oriented and there are chances of them becoming irrelevant if they do not pursue that goal with full zeal. While pursuing this goal the key is to maintain a right balance between the risk mitigation and the significance of business objectives. As an Internal Auditor one needs to be aware of the linkages between the control and the risks, does that align with the risk, is it too much, too low or at a sufficient level. Removing the unnecessary steps in a process could be a big relief for the process owners/managers.

Secondly, Internal Audit functions should strive to understand the linkages of business processes with the organizational key objectives. For example, if an organizations key strategic objective is the improvement in customer service, understanding of the end to end process which have connections with the customer is critical. The process will definitely not end at the Customer service department but cascade down to Technology, Finance and others as well. Understanding the complete value chain is thus of paramount importance to contribute something in the achievement of business objectives. Last, but not the least Audit report is the product through which Internal Auditors will be recognized. Whether the value has been added to organization or not does not end in identifying the issue, in fact it begins from there, the real success will be gauged by how practical the recommendation is. During our discussion with Sardar Muhammad Abubakr, he highlighted the same point and provided a simple barometer of assessing whether you have added the value or not by saying: “If your recommendations outshine the observations in an Audit report, it means you have added value”

Sardar Muhammad Abubakr (Director Strategy and former Internal Audit Head, Telenor)


Implementation of Outstanding Recommendations

This goal which seems more like an issue has emerged as the 2nd top most priority for Internal Audit functions to pursue in the coming years. There are two key dimensions which the Internal Auditors in our opinion need to look at to assess their own situations.

Creating the acceptability

In order to create the acceptability of the observations one need to look at as to How interactive the process is between Internal Auditors and the management to conclude the recommendations While the management can always argue about the auditors’ judgment and their lack of business understanding, Internal Auditors should strive to create a true level of management’s acceptability for the implementation of recommendations on timely basis. Recommendations must be well thought out considering the business dynamics and are open to discussion with management. Another dimension which we tend to over look is the magic of positive reporting. More often than not Internal Audit report begins with all the red marked observations. It creates the perception as if Internal Auditors sole objective was to to identify all the wrong doings. Surely, there must be something good happening and that also needs to be highlighted in the report to create a comforting environment with the management.

“Internal Audit reports should be a balanced depiction of processes and controls, not just the issues. The tangible positives should also be highlighted in the Internal Audit report”

Sardar Muhammad Abubakr (Director Strategy and former Internal Audit Head, Telenor)

The Follow up process

The effectiveness of a follow up process has direct relationship with the implementation of outstanding recommendations.

Outstanding recommendations can sum up to hundreds with multiple people carrying on the responsibility. Most of the organizations which we have talked to on the subject have manual process where excel sheets are maintained and emails are required to be sent to the auditees. Internal Auditors should actively look to bring improvement and automation in their own processes. They may consider to use an Internal Audit Management Solution for the purpose. One which can tackle the follow up process by sending out the automated reminders on a given date to the auditees and provide a complete status of outstanding recommendations by various dimensions at a click of a button.

Internal Auditors can also look into the option of holding regular meetings with the departmental heads to provide the status of their respective departments.


Effective Stakeholder Engagement

Internal Audit is perhaps the only function in an organization which almost deals with each component of the organization be it the Audit Committee, Departmental heads, CEO or the functional teams.

There is a need to have a genuine awareness that each one identified above are the stakeholders for Internal Auditors, their expectations need to be understood and an effort should be made to eliminate the gaps in them, if any. As rightly put by Norman Marks “Internal Auditors need to remember these 5 words “WIIFM” which stand for “What’s in it for me”. It is of critical importance that the points highlighted by Internal Auditors also demonstrate as to how addressing them will help the management in the achievement of their business objectives. If we are to influence others, we need to show that it is in their own best interests, whether as an individual manager or the leader of a team, to implement our recommendations. We need to appeal to their "WIIFM". If there is no value to them, why would they make a change?”

Norman Marks CPA, CRMA Author, Evangelist and Mentor for Better Run Business OCEG Fellow, Honorary Fellow of the Institute of Risk Management

The same views were echoed by Mr. Nadeem Khan, CFO Ufone. According to him “Internal auditors need to explain the relationship of controls with the achievement of objectives of the relevant department/function. This is critical to foster effective stakeholder engagement."

“Internal Auditors provide an additional comfort to CFOs' when they give visibility on the effectiveness of controls which operate outside finance function but have a financial impact for the organization."

Mr. Nadeem Khan (CFO, Ufone)


Areas For Improvement


Factors Differentiating the Value Providers with Others

Risk Based Work

The internal audit heads were asked whether they are satisfied with their internal audit plan being risk based and covers the critical risks faced by the organization including the strategic, operational, reporting and compliance.

Amongst those Internal Audit functions which are perceived as Trusted Business Advisors & Improvement catalysts (Value Providers), 69% of them were satisfied that their plan is risk based in comparison to 40% satisfaction amongst the group of compliance oriented functions (Others). An important aspect of value creation is the identification, assessment and response to the risks that are faced by the organizations. As a trusted business advisor Internal Audit function ensures that it provides valuable input regarding the management of all major risks that the organization faces. This is the role that has to be effectively taken up by the Internal Audit functions around the globe in the modern day business environment, an environment that keeps evolving; exposing the organization to greater challenges.

Risk Based Work Staff Skill set

Diversification


69%

40%

31%

60%

0% 20% 40% 60% 80% 100% 120%

Value Providers

Others

Satisfied Not Satisfied


Staff Skill Set Diversification

True value can only be delivered if you have the right set of people who possess the knowledge, experience and skills that can provide the organization with cutting edge services. Hiring in internal audit should be directed towards establishing a team that has the ability to deal with the strategic role that internal audit has these days. While Finance and audit skills are an imperative for the Internal Audit function, they should also have people with background in IT, risk and change management, fraud prevention and detection, project management etc. A diversified skill set enables the internal audit function to see the broader picture and provide well balanced recommendations.

In the light of the survey it can be comfortably said that Value providers (Trusted Business Advisors & Improvement Catalysts) are rich in having diversified skill set and have not limited themselves to the finance and assurance professionals.

57%

65%

87%

43%

35%

13%

0% 20% 40% 60% 80% 100% 120%

No of resources with expertise in Finance, Internal Controls and

Assurance

No of resources with expertise in Information security and Technology

No of resources with expertise in any other Business domain

Comparison of the number of resources wrt Skillset

Percentage of Employees in Value Providers Percentage of Employees in Others



Client Satisfaction lies at the center stage when it comes to delivering the optimal value. For Internal Auditors their clients are the top management, process owners and those responsible for execution. While some benefit from the useful insight that the internal audit function bring, others might consider the Internal Audit’s involvement in the affairs of their department as disruptive and their recommendations, offensive. In order to effectively manage stakeholder expectations there is a need amongst others of regular communication with them. The tool that can be used for the purpose is client satisfaction survey.

Feedback from auditees enables the Internal Audit function to gauge its current performance and also acts as a stepping stone to set its future direction, a direction that is more aligned to client expectations. This alignment can only be achieved when the internal audit interacts with its clients and determines what sort of role it can play to improve the process efficiency and how it can effectively advise different functions in a value adding capacity.

In the light of the survey conducted 30% of the Internal Audit functions perceived as Road Blockers & Compliance oriented (Others) obtained feedback though client satisfaction surveys whereas for Trusted business advisor and improvement catalyst (Value Creators) the same was around 40%. We are of the opinion that more and more Internal Audit departments need to make this as a regular feature of their operational work.

70%

30%

Other Functions

No

Yes

63%

38%

Value Providers

No

Yes


2People and Organization


Q. What is the total number of permanent staff in internal audit department within your organization (excluding head of internal audit)?

Q. Composition of resources in the Internal Audit Department with respect to skill set?

Most of the organizations have audit team of 5.

NUMBER OF EMPLOYEES

There are encouraging signs with respect to diversity in skillset.

COMPOSITION OF RESOURCES


Q. Cumulative number of years of experience of Internal Audit team?

Q. Number of resources in the Internal Audit department having the following qualification?

Most of the organizations have well experienced teams in place.

TEAM EXPERIENCE

Reasonable percentage of resources have professional qualifications. With the significance of Information Security in the current age there is a need to have more CISA qualified in Internal Audit departments.

QUALIFICATIONS


Q. Number of trainings attended by Internal Audit staff during the last 12 months?

Q. Trainings attended by the Internal Audit staff were in the domain of?

Almost quarter of the organizations surveyed did not have any training.

TRAININGS

There seems to be a balanced mix when it comes the nature of trainings.

TRAININGS DOMAIN


Q. Internal Audit department is headed by?

Q. Head of Internal Audit functionally reports to?

Most of the internal audit heads are Chartered Accountants.

INTERNAL AUDIT DEPARTMENT

HEAD

Majority of the respondents report to the audit committee

REPORTING LINES


3Operational Management


Q. Some of the tasks of Internal Audit function in our organization are outsourced?

Q. If answer to the above is yes, what are the areas which are outsourced?

Quarter of the organizations surveyed have outsourced tasks in one way or another.

OUTSOURCING

To dive into nontraditional areas and bring value to the organization there is a trend to make use of specialized resources as and when required.

AREAS OUTSOURCED


Q. Internal Audit tasks are outsourced primarily due to?

Q. Are you satisfied with the quality of work of outsourced service provider?

To meet the growing expectations from stakeholders Internal Audit tasks are outsourced for different reasons, the key amongst them is the skill or staff shortage.

AREAS OUTSOURCED

Internal Audit outsourcing providers need to raise the bar for meeting client expectations.

SATISFIED WITH THE OUTSOURCE


Q. Percentage time spent on the types of assignments conducted during the last year was?

Q. With respect to full year activities what was the distribution of work?

Approx. one third of the time is spent on compliance activities and very negligible on Information Security.

PERCENTAGE TIME SPENT

To a degree Internal Audit functions are acting as an advisor to management through special consulting assignments.

DISTRIBUTION OF WORK


Q. How satisfied are you that your company’s Internal Audit Plan is risk based & focuses on the critical risks to the enterprise including strategic, operational, financial reporting & compliance risks?

Q. During the planning phase Audit universe is created based on?

Having risk based audit plan is a pre requisite for becoming a value adding function in the organization. There is still a sizable number of organizations that need to work on that.

RISK BASED INTERNAL AUDIT PLAN

Organizations are using all the modes available to develop a comprehensive audit plan which is positive.

AUDIT UNIVERSE


Q. As an Internal Auditor, in your opinion, which of the following risks pose the greatest threat to achievement of objectives of your organization?

Legal and Regulatory has emerged as the most common risk factor. While very few consider business model disruptions and cyber security as a risk, organizations need to be more vigilant on these in the coming days.

GREATEST THREATS


Q. Does your function regularly obtain client satisfaction survey?

Q. During the last 1 to 3 years has your department been independently assessed for quality assurance?

To better manage the stakeholder’s expectations and become a value integrator, more Internal Audit functions should give due care to satisfaction surveys.

CLIENT SATISFACTION

There is a trend towards undergoing independent QA assessment specifically observed in organizations which are perceived as trusted business advisors in their organizations.

QUALITY ASSURANCE


Q. Is your function using any software for Internal Audit management?

In this age of automation and technology Internal Audit functions in Pakistan are far behind other countries when it comes to implementing Audit Management Solution.

INTERNAL AUDIT SOFTWARE


4Issues and Challenges


Q. Currently Internal Audit function within an organization is perceived as?

Q. Do you believe that the perception of Internal Audit function within your organization has improved during the last couple of years?

Approx. 40% of the companies surveyed have a work to do when it comes to how they are perceived.

PERCEPTION OF INTERNAL AUDIT

Majority of the companies are positive; however, it does not corroborate very well with the last question’s response.

PERCEPTION


Q. Major Initiatives that were undertaken by the Internal Audit department to improve that perception were?

Linking the audit work with what the organisation intends to achieve is the key.

INTERNAL AUDIT PERCEPTION


Q. In your organization, Internal Audit recommendations which are implemented on a timely basis are in the range of?

There are very few organizations where sizable no. of observations is implemented on timely basis.

Internal Audit functions can consider implementing an integrated audit management solution which can assist in resolving the issue.

RECOMMENDATIONS


Q. In the last 2 years Internal Audit issues were related to (Rank with respect to number of issues. Most issues being rated as 1 and the lowest as 6)?

While most of the issues relate to procurement, internal audit functions can play their part in assessing how practical and effective procurement policies are in their respective organizations.

TOP THREE INTERNAL AUDIT ISSUES


Q. For the next year key strategic goals of Internal Audit department in terms of priority?

Internal audit functions have set the right objectives. They also need to have the right tools and mindset to achieve these.

KEY STRATEGIC GOALS


Q. Please rate your understanding of the following aspects of the business?

Internal Auditors need to improve their knowledge in current and emerging technology issues, risk management programme and industry dynamics.

UNDERSTANDING OF BUSINESS


5SurveyDemographics


Revenue

Types of Organizations Number of Employees


o

Sector C

lassification


Our Vision: Use our expertise to improve the lives of people We help organizations make the right investment decisions to create job growth. We help improve clients’ processes which could translate into an extra hour being spent by parents with their

children. We develop business models through which access to financial resources is enhanced for the poor. We provide Internal Audit services and help clients to develop sustainable business practices. Practices that improve the bottom line, while contributing to the economic prosperity of the country the client operate within. Every day through these and utilizing many of our other expertise we are raising the bar for individuals and organizations.

Faheem Piracha 16 years of diversified experience within Big 4 and corporate sector is his unique edge for leading a world

class consulting practice, which promises to offer practical and balanced solutions to the issues organizations are faced with today. He has worked with world’s renowned organizations like PwC (Pakistan and Malaysia), BHP Billiton and Telenor and his expertise lies in Governance, Performance Management, Internal Control, Risk Management, Business Process Improvement, and Strategic Planning. Khawaja Tasneem Murad He brings along an experience ranging over two decades in industry, assurance and advisory. Within the organizations in Pakistan and overseas he has been instrumental in setting the strategic direction, managing investor relations, optimizing cost structures, enhancing shareholders value and leading from the front in turn around situations. He is a fellow member of the Institute of Chartered Accountants of Pakistan and has previously worked for Fauji Fertilizer Bin Qasim Ltd, Pak MarocPhosphore(PMP) S.A. Morocco, PwC and EY Saudi Arabia.

Line of Services

§ Advisory

§ Assurance

§ Outsourcing

§ Technology

What is Hyphen Consultancy?

Who manages it?

The Team that made the survey possible Rafey Jamal Analyst Mujtaba Khan Senior Analyst Sohaib Nouman Senior Analyst


The first Internal Audit Software made in Pakistan.

Abilite came into existence to cater the local market and offer a tailor made and cost effective solution.

A Product of Hyphen Consultancy

For more details contact: [email protected]


To have more insight on the subject, please feel free to contact: Faheem Piracha, Principal Consultant Contact Number: +92 345-8503314 E-mail: [email protected] Khawaja Tasneem Murad, Principal Consultant Contact Number: +92 300-0771767 E-mail: [email protected]

© 2015 Hyphen Consultancy. All rights reserved. Please see http://www.hyphenconsultancy.com for further details. This content is for general information purposes only, and should not be used as a substitute for consultation with professional advisors.

Documents

State of Internal Audit Pakistaninternalauditclub.com/.../Ist-Survey-Report-State-of-Internal-Audit... · STATE OF INTERNAL AUDIT IN PAKISTAN – FIRST SURVEY REPORT 2 Message from