Internal Audit in 2021 and Beyond

1 A Profession in the State of Material ChangeIIA Calgary Virtual MeetingApril 28th,2021 Internal Audit in 2021 and Beyond business takes youRichard Arthurs, FCPA, FCMA, MBA, CFE, CIA, CRMA, QIAL Partner, Enterprise Risk Services National Leader Internal Audit ServicesPast Chair IIA Canada BoardPast Roles:VP Audit , Risk & Compliance Berkshire Hathaway Energy, CanadaGlobal Director of Audit & Risk General Mills | business takes ContinuousRiskAssessmentandScenarioPlann ing IntegratedAssuranceandAdvisory RiskAnalytics AIContinuousMonitoring AgileInternalAudit(ChangeinIACulture) VirtualAuditing,Meetings,andNetworking Hyper&ContinuousLearning DataGovernance,Monitoring&Security Environment,Social,andGovernance ThirdPartyRiskManagement business takes you199020002020 SOX Legislation Started2002 COSO & ERM 2003 onwardsY2K & Dot Com Crash1999 DigitalTechnologyRegulationData AnalyticsThoughtLeadershipEconomic & Political EventsData Analytics & Continuous Monitoring2004 onwardsInternet LaunchedLate 1980 siPhone Launched & Cloud Boom2008 Visual Analytics, Cloud & IA2010 onwards2010 COVID192020 Dodd Frank Act2010 Financial Crash2008IA Consulting Role1995 onwardsAgile IA2019 onwardsIA Advisory Role2008 onwardsIntegration of AI, ML.

2 RPA & IA2015 onwardsIIA Three Lines of Defence2008-10 onwardsSocial Media Boom2008 OnwardsGDPR & Privacy Policy2018 SEC Increases FCPA Enforcement1995 onwardsApplied Data & Robotics2015 onwardsUS Election2016 Internal Audit Report Leading Practices Financial Focused Long and Detailed Reports Minimal Use of Technology 100% Audits Most Auditors are CPA s Compliance Focus Instead of Risk Risk Focused Shorter Issue Focused Reports Data Analytics Experimentation 70% Audits & 30% Advisory IA Leading SOX Implementations Most Auditors are CPA s Growing Operational Audits Increasing Focus on IT & Cyber Security Risk & Value Focused Shorter & Concise Reports Data Analytics Expertise 40% Audits & 60% Advisory IA Becoming Trusted Advisor Multi Discipline Audit Teams Growing Technology & Data Audits Increasing Focus on Disruption & Impact From Technology Co-Source and Out-Source Models Agile Risk & Value Focus Real Time Continuous Monitoring, UBER Audits & Data Analytics Dashboard Reporting Virtual Remote Auditing Extensive use of Analytics and AI Extreme Change Driving Risk Increasing Focus on Business Models , Sustainability & ESG Co-Source Model Very business takes youPolling Question 11.

3 Risk in business takes youAnticipating Future Risk Maturing Intelligent Digital Technologies OngoingGlobal Pandemic RiskMitigation Self-Disruption is aCompetitiveAdvantage WarforLeadershipSuccession Talent ExtremeGenerationalDifferences in Preferences ConstantIncreaseinESGE xpectations Data Insight Competitive Advantage NeverEndingCyberThreatInnovation Virtual, Automated, and Continuous Risk Management Robot business takes you88 Gartner 2020 Technology Mega Trends People Centricity Internet of Behaviors Total Experience Strategy Privacy Enhancing Computing Location Independence Distributed Cloud Anywhere Operations Cybersecurity Mesh Resilient Delivery Intelligent Composable Business AI Engineering Hyper Automation2. The Future of business takes youNEW -IIA Three Lines Model (Interactive Governance) business takes youAs ERM Matures It Will Separate From business takes youPolling Question 23.

4 Critical Skills Required in the Next business takes you14142016 2030 Forecasted Change in Hours WorkedSource: business takes you15 Higher Cognitive Skills Vs. Basic Cognitive SkillsSource: business takes you16 Skills NeededToday vs FutureSource: McKinsey4. Next Generation Internal business takes you18 Next Generation Internal business takes youPolling Question 35. Internal Audit Hot Topics business takes you21 Continuous Risk Assessment & Scenario business takes you22 Integrated assurance and AdvisoryManagement AssuranceExternal AssuranceInternal assurance Strategy Operations Quality Management Finance & Treasury Information Technology Development Engineering Commercial Services Supply Chain Others External Audit ISO Sustainability Actuarial Others Risk Management Regulatory Compliance Legal Company Secretary Health and Safety OthersCombined assurance to Board & ExecutivesRisk areas affecting the companyCombined assurance will leverage an existing model -such as the three lines model-to help clarify roles and responsibilities for assurance providersProfiling assurance business takes you23 Risk

5 AnalyticsCritical Risk Analytics CapabilitiesTechnical & AnalyticalTesting & ValidationDefining, developing, and implementing quality assurance practicesSQL QueryingQuerying and manipulating data to facilitate the solving of more complex problemsData ModellingStructuring data to enable the analysis of information, both Internal and external to the businessData AnalyticsValuating data using analytical and logical reasoning for the discovery of insight [ predictive modeling]Reporting SoftwareUnderstanding the underlying theory and application of key reporting softwareBusiness & CommunicationTechnology AlignmentUnderstand how technology can be leveraged to solve business problemsMacro-PerspectiveUnderstanding the company s business strategy, current business issues and priorities, and current industry trendsBusiness KnowledgeUnderstand the business measurement of key performance indicators and business frameworksBusiness CommentaryArticulation of insight to explain current and forecasted trends.

6 Their impact and opportunities for the businessSoft SkillsCommunication and interpersonal skills necessary to articulate insight gained from analysisBusiness AcumenStorytellingTechnical SkillsData business takes youRisk Analytic Projects24 Data Integrity AssuranceClient wants comfort that the data has integrityCompliance to Internal Policy or RegulationIdentify anomalies outside of acceptable rangesVendor BillingDetermine inaccurate billing based on comparison to contract termsFraud DetectionIdentify red flags that may lead to fraudulent activity [ Benford s Law] business takes youRisk Analytic Projects25 Inaccurate AccountingIdentify anomalies that could indicate inaccuraciesDisplay Trends Over TimeUtilize visual analytics to display positive and negative tendsGlobal Mapping of Activity/Assets/Other Overlaying critical data and activities on a geographic mapPredictive and Descriptive CapabilityAdvanced prediction on what happens next and prescribed action business takes you26AI Continuous business takes you27 Agile Internal Audit Perfect communication Rigidly planned activities Comprehensive documentation Established roles Following a preset plan Auditing to IA resources Control of the Audit process Frequent communication Quick, iterative activities Timely.

7 Relevant documentation and reporting Empowered roles and flexible system Responding to emerging needs Transparency in the process Making the Shift to Agile (Small a) business takes you28 Virtual Auditing, Meetings, and business takes you29 Hyper and Continuous business takes you30 Data Governance Monitoring & business takes you31 ESG: Environment, Social, and GovernanceESG, which stands forEnvironmental, Social and Governance, refers to a cluster of non-financial factors about a company that can sometimes prove material for investors and other disclosure topics below can have a material impact on an organization s operating and financial and all are driven by the operating culture of the organization. Energy efficiency Carbon footprint Water usage Waste management Packaging Biodiversity management Employee attraction and retention Diversity and inclusion Pay equity Customer data privacy Social acceptability of projects/business Organizational culture Climate change Cybersecurity Corruption and bribery Responsible taxes Compensation Reliable financial business takes you1 Baseline Assessment2 Stakeholder Identification & Consultation3 ESG Framework4 Impact Assessment5 Data Management Validate mapping of operational footprint, products and services, as well as customers, markets and geographic locations.

8 Completeness and accuracy of evaluation is necessary for ESG adoption. Validate identification of all stakeholders directly influencing and/or being influenced by your organization. Ensure stakeholder consultation is sufficient and remains unbiased. Assess reasonableness and applicability of framework adopted (or to be adopted) for alignment Ensure framework meets industry requirements, regulatory expectations, and comparability with like entities. Where more than one framework is selected ensure appropriate mapping between each. Reassess management s approach to and conclusions regarding both positive and negative ESG impacts resultant from operations and in line with ESG framework requirements. Identify key metrics to be used to measure success in pursuit of sustainability strategies.

9 Evaluate sufficiency of approach to emerging ESG factors and/or risk issues. Identify the data necessary to report on ESG strategy ( , workflow, calculation and storage). Assess the control environment designed to ensure data is complete and accurate for decisions and reporting across the management Considerations of CAE in business takes you6 TargetSetting7 Progress Monitoring8 Policies and Procedures9 Reporting10 Governance Evaluate whether targets have been identified by management, are SMART, and stretch the organization for achieving meaningful change. Assess whether targets are prioritized based on significance from impact assessment. Evaluate linkage of ESG targets to strategic priorities and ensure management is sufficiently monitoring/tracking performance.

10 Identify risk(s) of missing targets and implications to strategy and operations. Assess policies and procedures to ensure expected ESG actions and behaviors are embedded. Review policies and procedures routinely to ensure relevant and timely reflection of changes from Internal and external factors. Evaluate disclosure controls and procedures for integrated reporting, standalone sustainability reporting, or online provision. Assess management s opinion of target(s) achievement. Obtain third-party SME to calculate and validate metrics where appropriate ( ). Evaluate board training/conduct board training on ESG. Evaluate board reporting whether includes necessary information for required board oversight. Provide IA opinion on testing conducted to validate ESG Considerations of CAE in business takes you34 Third Party Risk business takes you35A Degree in Internal business takes youPolling Question 46.