CHEIA Presentation 09 05

CHEIA Conference: 

CHEIA Conference Continuous Improvement of Internal Audit Craig Wright – Director Risk Assurance Services 9 September 2005

Agenda: 

Agenda Modern Internal Audit Impact of Strategic Risk on Internal Audit IA Self Assessment Tool

CHEIA Conference: 

CHEIA Conference Modern Internal Audit

Slide4: 

B A Scenario – HEI has project objective of getting from A to B

Scenario A – Traditional Internal Audit: 

Scenario A – Traditional Internal Audit Undertakes an ‘after the event’ cyclical audit Doesn’t get involved in project as it compromises independence Comes in 9 months after the event and issues a 28 page report two months after the fieldwork saying: Shouldn’t have done it as the activity was too risky The umbrella proved an ineffective control Didn’t comply with health and safety regulations Should have known about the crocodile Recommends that not pursue opportunities in future

Scenario B – Risk Based Internal Audit: 

Scenario B – Risk Based Internal Audit Manager invites in internal audit (IA) to discuss opportunity before the event IA evaluates the risks identified by the manager and the proposed risk management processes IA advises the manager on additional risks and the adequacy of risk mitigation and agrees actions IA facilitates a workshop in agreement with manager to explore other ways of getting to the other side

Scenario C – Holistic Internal Audit: 

Scenario C – Holistic Internal Audit Management has established the risks and risk management processes to seize the opportunity IA explores the adequacy of management’s proposals and advises management, so the company can manage the risks better than the competition IA looks at the wider implications for the business of success or failure in seizing opportunity, including reputation, employee morale and shareholder value IA explores with management team how the risks involved fit into corporate risk appetite and includes this in its holistic reporting on risks

Internal Audit and Risk Management (1): 

Internal Audit and Risk Management (1) Increased emphasis on risk management What role is appropriate for internal auditor? Maintain independence but not hide behind it There is no ‘right’ answer Choose how you can add value to risk management processes

Internal Audit and Risk Management (2): 

Internal Audit and Risk Management (2) Responsibility for Risk Management lies with: Board of Governors and Audit Committees Management’s prime responsibility All staff have some responsibility Sound and effective risk management processes Functioning as intended

Internal Audit and Risk Management (3): 

Internal Audit and Risk Management (3) Continuum of internal audit’s role: From Core Assurance Focusing on key risks Auditing risk management processes To Proactive support and involvement in the risk management process To Training, coaching and educating management To Co-ordinating risk reporting at Board level This is not an exhaustive list

Internal Audit and Risk Management (4): 

Internal Audit and Risk Management (4) Impact of risk management on modern internal audit

CHEIA Conference: 

CHEIA Conference Impact of strategic risk on Internal Audit

Risks facing the Sector: HEFCE’s view: 

Risks facing the Sector: HEFCE’s view Insufficient additional demand – to meet participation target by 2010 Supply of places – does not match the demand from students Dependence on international income – via overseas student recruitment Teaching quality declines – through poor recruitment & retention of key staff Deterioration of research infrastructure – from failure to recover FEC Inadequate strategies – mean HEIs’ fail to build on their key strengths Failure to manage change – impacts on HEIs’ ability to achieve their mission Poor stakeholder perception – of governance leads to increased accountability HEFCE would assert there are more than three key risks:

Risks facing the Sector: Another perspective: 

Three Key Risks: 1. STUDENT RECRUITMENT 2. STUDENT RECRUITMENT 3. STUDENT RECRUITMENT Risks facing the Sector: Another perspective

Risks facing the Sector: Another perspective: 

Three Key Risks: 1. STUDENT RECRUITMENT - Home / EU 2. STUDENT RECRUITMENT - International 3. STUDENT RECRUITMENT - Retention Risks facing the Sector: Another perspective

Key Risks / Challenges – Internal Audit’s Response: 

Challenges Response Recruitment (Home / Overseas) Key Risks / Challenges – Internal Audit’s Response Review of Branding and External Relations Evidence Based Marketing Detailed review of management information and change systems (existing & new provision) International Health Check Review of processes which support effective marketing Detailed Benchmarking Detailed reviews of commercial income activities Student Retention Detailed review of student care arrangements Detailed review of information systems (student participation) Facilitation of student surveys

Does this approach add value?: 

Audit strategically aligned with HEI’s objectives Focuses on key strategic and operational risks Assurances to the Audit Committee Major business risks are being managed appropriately Internal control framework is operating effectively Robust, unequivocal reporting Advisory role to management Share knowledge of best practice from elsewhere within the sector Using IA’s knowledge and experience to tackle urgent issues Does this approach add value?

CHEIA Conference: 

CHEIA Conference Promoting Continuous Improvement - IA Self Assessment Tool

IA Self Assessment Tool (1): 

Working with HEFCE to develop self assessment tool for in-house providers Complimentary to periodic peer review Resource for HIA’s to regularly appraise IA function Resource for audit committees and designated officers to obtain confidence in their IA functions HEFCE will gain confidence (may even supplant own peer reviews) IA Self Assessment Tool (1)

IA Self Assessment Tool (2): 

Tool designed to evaluate provision against GIAS, IIA and HEFCE Standards in the first instance: Self Assessment to cover six themes: Due Professional Care Strategy Methodology People Independence Quality Assurance IA Self Assessment Tool (2)

IA Self Assessment Tool (3): 

IA Self Assessment Tool (3) Example:

IA Self Assessment Tool (4): 

Each question will carry a weighting leading to an overall score for each theme: IA Self Assessment Tool (4)

IA Self Assessment Tool (5): 

The Next Step is to consult with CHEIA: Wishing to seek genuine constructive feedback Are the questions right? Are there too many? Agree weightings Agree evidence base Roll out to include: Guidance Details of where it will be hosted (HEFCE/CHEIA?) IA Self Assessment Tool (5)

CHEIA Conference: 

CHEIA Conference Thank You Questions?