Auditing The Corporation Governance

Course Outline

DAY 1

The Corporate Governance Requirements

The Key Aspects of Corporate Governance

• What is Corporate Governance?

• 6 Core Principles of Governance
• The Governance Warning Signs
• New Corporate Governance Insights Paper will be Given
• Auditing Corporate Governance – new supervision
• Meeting Stakeholder Conditions
• How the organization is managed on behalf of the stakeholders?
• The Key Individuals within Governance
• Audit Committee
• The Board
• Regulators
• Customers
• Suppliers 
• A New Governance and Accountability Tool will be Given
• Promoting Terms of Reference for the Task
• A New Audit Program will be Given
• New Guide on IA Standard 2120
• Corporate Governance Audits

Exercise 1 – The challenges in carrying out a Governance Audit

Governance Assessment Techniques

• COSO Advisory Paper – improving organizational performance and Governance
• Governance and Approach
• Governance Principles
• Codes of Governance Requirements
• Financial Reporting Connections
• International vs. National Governance Criteria
• The 3 Routes of Defense
• Who should cover what?

Exercise 2 – Determining the Governance framework in place

The Business Environment 

• The Standards, Processes, and Structures
• The Tone at the Top Regarding the Influence of Internal Control
• Proposed Standards of Conduct
• Management Reinforcement of Expectations across the Organization
• The Integrity and Ethical Values of the Organization
• Governance Oversight Responsibilities
• The Appointment of Authority and Responsibility
• The Method for Attracting, Developing, and Retaining Staff
• Establishment of Performance Measures, Incentives, and Premia

Exercise 3 – Evaluating the business environment

Analyzing and Assessing the Effectiveness of Governance Controls 

• Business Process Analysis Techniques
• Method Objectives and Risk
• The Need to Get Business Objectives
• Developing a Program to Reflect these Objectives
• Defining and Mapping Strategic Objectives
• Determining Process Components
• The Link between Goals and Risk
• The Link between Risks and Directions
• Method and Business System Controls
• The Link between Inputs and Outputs
• Trigger Events

Exercise 4 – Building a picture of the Governance controls

DAY 2

Preparing for the Governance Audit

Scoping a Governance Audit

• Governance Structure
• Reporting Lines
• Strategy and Risk Appetite
• Leadership and Culture
• 3 Lines of Defense Process
• Communication with Regulators
• Intensification
• Delegated Authorities
• Whistleblowing
• Accountabilities
• Data Integrity
• Devotion to Governance
• Strategies

Exercise 5 – Scoping the Governance audit

The Need for Governance Audit of the Board

• The Key Function of the Board in Governance
• The Want to Assess the Risks at this Level
• Fixing the Key Risks and Causes
• The Audit Approach in this Sensitive Area
• How do gather the evidence?

The 15 Key Governance Board Risks being reviewed

• The actions of the Board are taken without due consideration of the impact on the organization and the stakeholders
• Independent members of the Board are unable to give a robust challenge to the executive / senior management
• The Board does not have sufficient, complete, or timely information on which to base its decisions
• The Board is not monitoring or taking action on the most significant risks to the organization
• Evidence of the decisions made by the Board, including the challenge process, is not transparent
• Actions agreed by the Board are not implemented on a timely basis
• Committees set up by the Board may not fulfill their obligations or there are too many committees such that the oversight is fragmented
• The Board is not effective in covering the risks relating to remote sites or does not have responsibility/oversight for all parts of the organization
• Policies, procedures, and projects are not aligned with the organization’s objectives
• The culture of the organization is not sufficiently defined or does not support the organization in achieving its objectives
• Risks are accepted or taken which are outside of the organization’s risk appetite
• The organization’s risk appetite may conflict with the objectives and values of the organization
• In the event of a significant incident, there is an adverse effect on the wider economy or society
• The governance requirements of any regulatory or legislative requirements are not met leading to increased regulatory sanction, censure, or closure of a business
• Communications from the Board are not effective such that parts of the organization may not be operating in line with board expectations and may not support the organization in achieving its objectives

Exercise 6 – Evaluating Board Governance

Auditing the Overall Risk Management Process

• Establishing the Position Regarding RM in the Business
• Establish Corporate Targets and Monitor Overall Progress
• Risk Management using ISO 31000 Paper from IIA
• Keeping the Board Apprised of the Most Significant Risks
• Assessment of RM Capabilities
• Strategic Risk Assessment
• Review of Risk Evaluations in each Function
• Ensuring Actions to Treat Exposures Implemented
• Ensuring All Functions Evaluate their Risks Consistently
• Evaluating the Results and Challenging where Necessary
• Identification of Exposures
• Reviewing Risk Registers
• Imperatives for Change – RBA Planning
• Basing Audit Program on Most Significant Risks
• Comparing Perceived vs. Actual Controls
• A Risk Management Evaluation Tool will be provided

Exercise 7 – The audit of the overall risk environment

Evaluating Risk Appetite

• Evaluating the Risk Appetite Statement
• Defining Risk Limits
• Risk Profiling
• Ensuring the Risk Appetite is defined for each type of risk
• Ensuring Target Risk for Each Event

Exercise 8 – Evaluating the risk of appetite

DAY 3

Reviewing the Key Aspects of Governance

Auditing the Audit Committee Process

• The Audit Committee Role
• Structure and Independence
• Does the Committee Approve (but not direct) internal audit strategy, plan, and performance?
• Do the Committee review summary IA reports and the main issues arising and seek assurance that action has been taken?
• How does the Committee consider the reports of external audits and other external agencies?
• How is the effectiveness of relationships between IA and EA and other bodies reviewed?
• How are the effectiveness of the risk management environment and anti-fraud arrangements assessed?
• The Audit Committee / IA Relationship
• New Paper on How the Audit Committee should Assess IA
• A case Study and Audit Program will be provided
• How does the Committee satisfy itself that assurance statements and the annual statement of accounts properly reflect the risk?
• An Audit Committee Checklist will be shared
• Audit Committee Report Example

Exercise 9 – The Audit Committee challenges 

Auditing Reputation 

• The Rise of Reputation as a Key Risk
• The Increasing Importance of a Positive Image – the need to be admired
• Where does reputation come from?
• How do you measure it?
• The Magnifying Effect on Reputation of Business Failures
• Global Brands
• How to judge reputation?
• The Explosion of Regulation and External Assurance
• Identifying Reputational Risks
• A Checklist for Reviewing Reputational Risk will be provided to all delegates

Exercise 10 – Auditing Reputational Risk

Corporate Social Responsibility

• The Increasing Importance of Corporate Social Responsibility (CSR)
• New IIA Standard 2110 Re-auditing of Ethics
• What constitutes CSR?
• The Wider Aspects of CSR and the Implications for IA
• Doing Responsible Things Responsibly
• A Paper on Auditing Ethics will be provided
• Redefining IA Role with CSR in Mind
• An Audit Framework
• How to audit CSR? – Key Steps
• Is communication with the main stakeholders taken seriously?
• Are the expectations of these stakeholders accurately understood, and what are the risks that these will not be met?
• Are opportunities taken to develop the ethical reputation of the business?
• How do we ensure that the staff has and display the right attitudes?
• Has the business assessed its reputation for social responsibility and its impact on our business prosperity?
• Is the Board, and in particular the Chief Executive, sensitive and responsive to the concerns of customers?

Exercise 11 – The CSR audit challenges

Sustainability and Environment Audit

• The Need for Environmental Auditing
• The Key Requirements for the Sustainability of Resources
• Why Environmental Audit is valuable even if you do need to comply with ISO 14001
• Carrying out an Environmental Site Review
• Reviewing the Audit Trails
• Meeting Regulatory Requirements
• Ensuring Consistency

Exercise 12 – Challenges of environmental audit

DAY 4

Auditing Technology Governance and Regulatory Compliance

Reviewing Key Controls over Technology

• Risk and Control Matrices to Document Technology Dependencies
• Evaluating End-User Computing
• Implementing or Monitoring Control Activities when Outsourcing IT Functions
• Configuring the IT Infrastructure to Support Restricted Access and Segregation of Duties
• Configuring IT to Support the Complete and Accurate Processing of Transactions and Data
• Administering Security and Access
• Applying a System Development Life Cycle over Packaged Software

Exercise 13 – Assessing technology controls

Assessing Management Information Governance 

• Inventory of Information Requirements
• Validating Information from External Sources
• Information from Non-Finance Management
• Creating and Maintaining Information Repositories
• Enhancing Information Quality Though a Data Governance Program
• Identifying, Protecting, and Retaining Financial Data and Information
• Adoption of ISO 27000

Exercise 14 – Assessing information management

Communication Internally and Externally

• External Financial Reporting Disciplines
• Responsibilities and Guidelines for Communication to the Board of Directors
• Communicating a Whistle-Blower Program to Company Personnel
• Communicating through Alternative Reporting Channels
• Establishing Cross-Functional and Multi-directional Internal Control Communication
• Surveys for External Parties

Exercise 15– Assessing communication management

Ongoing Evaluations to Ascertain Whether the Components of Internal Control are Present and Functioning

• Develop a Baseline for Effective Internal Control Processes
• A case study will be provided
• Have a Mix of Evaluations from Different Sources
• Use the Most Knowledgeable Personnel
• Adjust Scope and Frequency
• Change the Monitoring Processes as the Business Activities and Risk Profile Changes
• Develop Metrics
• Consider a Continuous Monitoring / Audit Approach

Exercise 16 – Determining a continuous governance

DAY 5

Auditing Other Key Governance Activities

Auditing IT Governance

• Global Technology Audit Guides (GTAGs)
• The Need to Determine the Boundaries
• Defining the IT Audit Universe
• Focus on High-Risk Areas
• Assess IT Vulnerabilities
• Target Areas Where You are Focusing on Process rather than Technical Aspects
• Use of Audit Frameworks such as CoBIT and ISO 27000
• IIA New Standard on IT Governance
• Risk-Based Audit of General Controls (GAIT)
• IIA Guidance re GAIT
• An ISO 27000 Audit Checklist will be shared

Exercise 17 – Challenges of IT Governance audit

Auditing Joint Ventures and Partnerships

• Ensuring that there is a Risk Strategy for JV’s
• What protocol is in place?
• What is the review mechanism?
• Is it effective?
• What frequency is there for review by management?
• What mechanism is there to guide management in attending JV meetings?
• Does anyone know the number of JV’s and partnerships you are involved in and how much money and other resources are invested in them?
• Has each JV been risk reviewed?

Reviewing a Current JV or Partnership

• Rationale
• Added Value
• Decision-making
• Performance
• Finance
• Problems
• Termination

Exercise 18 - Select two JV’s or partnerships – one you regard as successful and another less so. Complete the checklist and try to identify the main differences

Auditing Business Continuity Planning 

• The Importance of BCP
• The Need to Recognize BCP is not just about IT Recovery
• Reviewing the Different Types of Disaster – have all been considered?
• Does the organization’s leadership understand the current business continuity risk level and the potential impacts of likely degrees of loss?
• Can the organization prove the business continuity risks are mitigated to an approved acceptable?
• Are they tested effectively?
• Is the Board well-set-up to respond swiftly and capably in a crisis?
• The Transition from an Emergency to a Disaster and the Questions to Ask at Each Stage
• Is there an appropriate contingency plan ready to be used to manage a crisis?
• Communication Testing
• Alternative Site Testing
• A Paper on BCP Resilience will be shared

Exercise 19 – BCP Audit Discussion