Internal Audit in 2021 and Beyond

1 A Profession in the State of Material ChangeIIA Calgary Virtual MeetingApril 28th,2021 Internal Audit in 2021 and Beyond business takes youRichard Arthurs, FCPA, FCMA, MBA, CFE, CIA, CRMA, QIAL Partner, Enterprise Risk Services National Leader Internal Audit ServicesPast Chair IIA Canada BoardPast Roles:VP Audit , Risk & Compliance Berkshire Hathaway Energy, CanadaGlobal Director of Audit & Risk General Mills | business takes ContinuousRiskAssessmentandScenarioPlann ing IntegratedAssuranceandAdvisory RiskAnalytics AIContinuousMonitoring AgileInternalAudit(ChangeinIACulture)

2 VirtualAuditing,Meetings,andNetworking Hyper&ContinuousLearning DataGovernance,Monitoring&Security Environment,Social,andGovernance ThirdPartyRiskManagement business takes you199020002020 SOX Legislation Started2002 COSO & ERM 2003 onwardsY2K & Dot Com Crash1999 DigitalTechnologyRegulationData AnalyticsThoughtLeadershipEconomic & Political EventsData analytics & Continuous Monitoring2004 onwardsInternet LaunchedLate 1980 siPhone Launched & Cloud Boom2008 Visual analytics , Cloud & IA2010 onwards2010 COVID192020 Dodd Frank Act2010 Financial Crash2008IA Consulting Role1995 onwardsAgile IA2019 onwardsIA Advisory Role2008 onwardsIntegration of AI, ML.

3 RPA & IA2015 onwardsIIA Three Lines of Defence2008-10 onwardsSocial Media Boom2008 OnwardsGDPR & Privacy Policy2018 SEC Increases FCPA Enforcement1995 onwardsApplied data & Robotics2015 onwardsUS Election2016 Internal Audit Report Leading Practices Financial Focused Long and Detailed Reports Minimal Use of Technology 100% Audits Most Auditors are CPA s Compliance Focus Instead of Risk Risk Focused Shorter Issue Focused Reports data analytics Experimentation 70% Audits & 30% Advisory IA Leading SOX Implementations Most Auditors are CPA s Growing Operational Audits Increasing Focus on IT & Cyber Security Risk & Value Focused Shorter & Concise Reports data analytics Expertise 40% Audits & 60% Advisory IA Becoming Trusted Advisor Multi Discipline Audit Teams Growing Technology & data Audits Increasing Focus on Disruption & Impact From Technology Co-Source and Out-Source Models Agile Risk & Value Focus Real Time Continuous Monitoring.

4 UBER Audits & data analytics Dashboard Reporting Virtual Remote Auditing Extensive use of analytics and AI Extreme Change Driving Risk Increasing Focus on Business Models , Sustainability & ESG Co-Source Model Very business takes youPolling Question 11. Risk in business takes youAnticipating Future Risk Maturing Intelligent Digital Technologies OngoingGlobal Pandemic RiskMitigation Self-Disruption is aCompetitiveAdvantage WarforLeadershipSuccession Talent ExtremeGenerationalDifferences in Preferences ConstantIncreaseinESGE xpectations data Insight Competitive Advantage NeverEndingCyberThreatInnovation Virtual, Automated.

5 And Continuous Risk management Robot business takes you88 Gartner 2020 Technology Mega Trends People Centricity Internet of Behaviors Total Experience Strategy Privacy Enhancing Computing Location Independence Distributed Cloud Anywhere Operations Cybersecurity Mesh Resilient Delivery Intelligent Composable Business AI Engineering Hyper Automation2. The Future of business takes youNEW -IIA Three Lines Model (Interactive Governance) business takes youAs ERM Matures It Will Separate From business takes youPolling Question 23.

6 Critical Skills Required in the Next business takes you14142016 2030 Forecasted Change in Hours WorkedSource: business takes you15 Higher Cognitive Skills Vs. Basic Cognitive SkillsSource: business takes you16 Skills NeededToday vs FutureSource: McKinsey4. Next Generation Internal business takes you18 Next Generation Internal business takes youPolling Question 35. Internal Audit Hot Topics business takes you21 Continuous Risk Assessment & Scenario business takes you22 Integrated Assurance and AdvisoryManagement AssuranceExternal AssuranceInternal Assurance Strategy Operations Quality management Finance & Treasury Information Technology Development Engineering Commercial Services Supply Chain Others External Audit ISO Sustainability Actuarial Others Risk management Regulatory Compliance Legal Company Secretary Health and Safety OthersCombined Assurance to Board &

7 ExecutivesRisk areas affecting the companyCombined assurance will leverage an existing model -such as the three lines model-to help clarify roles and responsibilities for assurance providersProfiling assurance business takes you23 Risk AnalyticsCritical Risk analytics CapabilitiesTechnical & AnalyticalTesting & ValidationDefining, developing, and implementing quality assurance practicesSQL QueryingQuerying and manipulating data to facilitate the solving of more complex problemsData ModellingStructuring data to enable the analysis of information, both Internal and external to the businessData AnalyticsValuating data using analytical and logical reasoning for the discovery of insight [ predictive modeling]

8 Reporting SoftwareUnderstanding the underlying theory and application of key reporting softwareBusiness & CommunicationTechnology AlignmentUnderstand how technology can be leveraged to solve business problemsMacro-PerspectiveUnderstanding the company s business strategy, current business issues and priorities, and current industry trendsBusiness KnowledgeUnderstand the business measurement of key performance indicators and business frameworksBusiness CommentaryArticulation of insight to explain current and forecasted trends.

9 Their impact and opportunities for the businessSoft SkillsCommunication and interpersonal skills necessary to articulate insight gained from analysisBusiness AcumenStorytellingTechnical SkillsData business takes youRisk Analytic Projects24 data Integrity AssuranceClient wants comfort that the data has integrityCompliance to Internal Policy or RegulationIdentify anomalies outside of acceptable rangesVendor BillingDetermine inaccurate billing based on comparison to contract termsFraud DetectionIdentify red flags that may lead to fraudulent activity [ Benford s Law]

10 Business takes youRisk Analytic Projects25 Inaccurate AccountingIdentify anomalies that could indicate inaccuraciesDisplay Trends Over TimeUtilize visual analytics to display positive and negative tendsGlobal Mapping of Activity/Assets/Other Overlaying critical data and activities on a geographic mapPredictive and Descriptive CapabilityAdvanced prediction on what happens next and prescribed action business takes you26AI Continuous business takes you27 Agile Internal Audit Perfect communication Rigidly planned activities Comprehensive documentation Established roles Following a preset plan Auditing to IA resources Control of the Audit process Frequent communication Quick, iterative activities Timely, relevant documentation and reporting Empowered roles and flexible system Responding to emerging needs Transparency in the process Making the Shift to Agile (Small a)