Audit Committee Reporting trends and best practices for

Audit Committee Reporting trends and best practices for leading Internal Audit departments Michael Gowell Wolters Kluwer

Michael Gowell SVP & GM Wolters Kluwer § Founder Team. Mate Audit Management System § 30 Years of audit and audit technology experience § 22 Years with Pw. C (CPA), ü Audit Manager ü Director – Pw. C Research and Development Center § Host of the Annual Team. Mate User Forums ü over 1, 000 attendees yearly

Access to Information In 2011 Team. Mate initiated a new global thought leadership program designed to leverage the community of knowledge at its fingertips Team. Mate is well positioned to study best practices have ready access to over 100, 000 auditors have an R&D group that spends over 10, 000 hours a month developing audit technology solutions host annual internal audit conferences that are attended by over 1, 000 auditors yearly have formally surveyed over 12, 000 auditors have conducted deep-dive interviews with over 200 organizations

Agenda – Audit Committee Reporting Key Concepts Audit Committee Reporting Survey Results 10 Opportunities to Enhance Your Audit Committee Materials & Reporting

Audit Committees - the Opportunity “An effective relationship between the audit committee and the (organization’s) internal auditors is fundamental to the success of the internal audit function. ” “Are reports and other communications from internal auditors to the audit committee of an appropriate standard and do they provide value? ” Audit Committee Resource Guide, Deloitte, January 2013

Audit Committees - the Challenge Key Questions to Address: • Can your organization expertly capture, massage, compare, contrast, and display data to turn it into useful intelligence? • Can your organization provide comparative information across locations and functions to highlight leading practices and trends? • Is your organization tracking, reporting, and - when possible - estimating the value of insights delivered by internal audit?

Audit Committees - the Objectives The Objective Gain insights and information to help internal auditors enhance their audit committee relationships, materials and reporting. Explore the formats, content and extent of the current reporting practices with an eye towards surfacing promising ideas for broader consideration.

Audit Committees - the Value Proposition “… to be successful, internal audit is less about presenting audit results and more about engaging executives and board members in thoughtful consideration of current challenges……” “Insight: Delivering Value to Stakeholders” IIA Research Foundation 2011

Strengthen Audit Committee Value Materials Available Survey Results Allows you to benchmark with your peers 10 Opportunities to Enhance Your Audit Committee Materials & Reporting • With examples and case studies

Survey Background More than 300 audit executives surveyed regarding the following areas: Format of audit committee reporting Content provided to the audit committee Extent of current reporting practices Frequency of specific reporting activities

Survey Demographics

Survey Data Augmented with Insights with over half a dozen interviews with IA Leaders including: Dennis Chookaszian, Former Chairman and CEO of CAN Insurance Companies Served on 52 Boards and Committees Currently the audit chair for several public companies Bob Hirth, Sr. Executive with Protiviti Former head of Protiviti IA Consutling Practice Current Chair of COSO David Landsitted, Retired Anderson Partner Former head of COSO Co-authored by Dick Anderson Retired Partner Pw. C, Former Head of IA Consulting Practice IIA Cadmus Award Winner

Polling Devices • Interactive polling with live responses • Your responses are anonymous – only group statistics are captured • Please leave them in the room after the session

POLLING SLIDE On average, how long does it take to prepare, compile and distribute your audit report A. B. C. D. 1 – 4 hours 4 – 8 hours 1 – 4 days More than 3 days

The amount of time we spend in total to compile, prepare and distribute our audit committee package is on average? SURVEY RESULTS

Opportunity #1 1 Ensure your Materials Meet Your Audit Committee Needs

POLLING SLIDE During the last 2 years have you conducted a formal review of the format and/or content of your audit committee materials with the audit committee to identify possible enhancements? A. Yes B. No

During the past 2 years, have you conducted a formal review of the format and/or content of your audit committee materials SURVEY RESULTS 67% Yes 33% No 0% 10% 20% 30% 40% 50% 60% 70% 80%

Conduct a Formal review of your audit committee materials and format BEST PRACTICE Treat as a strategic, relationship-building process Focus broadly on knowledge and information • Determine what current and new information could help the audit committee discharge its responsibilities • Run your list by the audit chair and senior management Demonstrate your expertise by suggesting new ideas that promise either strategic or tactical support • Educational information and knowledge • Formats and other techniques to enhance communications

POLLING SLIDE How satisfied are you with the quality of your audit committee materials? A. I believe we have a leading edge package B. Generally very satisfied C. Somewhat satisfied D. Our format is set and it is adequate E. Not really satisfied

How satisfied are you with the quality of your audit committee materials? SURVEY RESULTS 5% We have a leading-edge package 46% Generally very satisfied Somewhat satisfied 29% Our format is set and it is adequate According to KPMG's 2015 Global Audit Committee Survey, audit committee members are searching for more and better information 12% 8% Not really satisfied 0% 5% 10% 15% 20% 25% 30% 35% 40% 45% 50%

POLLING SLIDE Is your audit committee material reviewed with executive management prior to sending it to the audit committee? A. Yes B. No C. Sometimes

Executive Review of AC Materials SURVEY RESULTS

POLLING SLIDE Is your audit committee material reviewed with your external auditor prior to sending it to the audit committee? A. Yes B. No C. Sometimes

External Audit Review of AC Materials SURVEY RESULTS Why not? Gain advance support on key issues from management and the external auditor Bob Hirth - Protiviti

8 Point Checklist for Enhancing AC Materials BEST PRACTICE 1. Make it look interesting 2. Synthesize the issues – get to the point 3. Make it clear why this is important – explain the relevance, significance or risk 4. Explain what needs to get done 5. Have facts and evidence in your back pocket or at the end of the report 6. Gain advance support on key issues from management and the external auditor 7. Use Appendices to shorten core materials 8. Constantly pursue opportunities to educate

Opportunity #2 Help the audit committee focus and set priorities

Help the audit committee focus and set priorities A basic challenge facing audit committees is the need to sift through volumes of materials to determine what really matters to their work. For internal auditors looking to provide value to their primary stakeholders, this challenge spells opportunity.

Techniques to Help the Audit Committee Set Priorities SURVEY RESULTS

Techniques to Help the Audit Committee Set Priorities SURVEY RESULTS Visual Analytics * Other, including (1) (2) (3) (4) Developing Matrix of Audit Committee Responsibilities, Ranking Audits by Degree of Impact on Organization, Use of Audit Ratings, and Identifying the Severity of Each Audit Finding

POLLING SLIDE Do you provide the audit committee with: (Select your primary option) A. Copies of all audit reports B. Summaries of all audit reports C. Only audit reports with certain ratings or significant findings D. Summaries of audit reports with certain ratings or significant findings

Do you provide the audit committee with: (Check all that apply) SURVEY RESULTS 43% Copies of all audit reports Does this help the AC focus? 49% Summaries of all audit reports Only audit reports with certain ratings or significant findings 12% Summaries of audit reports with certain ratings or significant findings 35% 0% 20% 40% 60%

Discussions with Audit Committee Chair BEST PRACTICE CAEs, in particular, can help facilitate audit committee discussion on key Issues. a pre-meeting call between the CAE and audit committee chair provides the CAE with an opportunity to play the role of advisor and recommend specific areas of focus for the audit committee agenda send out deep-dive background information to their audit committees well before meeting dates

Discussion with AC Chair - Best Practice Every January the Audit Committee Chair for HCA meets with the CAE and other top officers in a full day planning session • Discuss major issues facing the company • Establish priorities for the audit committee and internal audit for the coming year. The CAE and Audit Committee Chair are joined for dinner by the CEO, CFO, Controller, Chief Compliance Office and the lead partner from HCA’s external auditor, Ernst & Young “Our goal is to discuss and establish priorities for the audit committee and internal audit for the year, ” Joe Steakley, Senior Vice President of Internal Audit HCA

Visual Analytics Purpose Tell the story / communicate the message Assist the reader in thinking/reasoning about the topic Enable rapid comprehension / interpretation Support decision making Inform / provide insight

What is the Story or Message?

The Trend Over Time

Multi-Period Slices

Scatterplot / Heat Map

Visual Reporting Examples High Risk Issues by City

POLLING SLIDE Please rate your use of visual reporting in your audit committee reports A. Excellent B. Good C. Could use some improvement D. Could use plenty of improvement

Opportunity #3 Provide more Risk Information to the Audit Committee

Provide more Risk Information to the Audit Committee The need to understand an organization’s risks and risk management practices is a fundamental challenge for audit committees. CAEs have significant opportunities to step up and position themselves as trusted advisors to their audit committees ü Consider how to acquire and share information on emerging risks ü Consider the types of risk reporting only being used by a minority of survey respondents (next slide) Demonstrate the direct linkage between changes to the organization’s risk profile and changes to the audit plan

SURVEY RESULTS Types of Risk Information Provided Look here for value

Provide More Risk Information BEST PRACTICE Ø Link risk information to the organization’s activities and strategies. Ø Tell the audit committee about areas or risks not covered by the internal audit plan and why Ø Demonstrate the direct linkage between changes to the organizations risk profile and changes to the audit plan Ø Set aside time each year to consider the types of “unthinkable” or “unrecognized” risks that could pose a serious risk to the company

Opportunity #4 Provide More Periodic Trending Information

Provide More Periodic Trending Information Audit Committees gain significant value from trending types of information that helps them gain a sound overall assessment of an organization’s systematic and thematic risk and control issues.

POLLING SLIDE Do you provide the audit committee with periodic trending information? A. Yes B. No

Do you provide the audit committee with periodic trending information? SURVEY RESULTS Ye s 62% 38% No 0% 10% 20% 30% 40% 50% 60% 70%

Types of Trending Information Provided SURVEY RESULTS Team. Mate Insight: Our experience indicates that audit committees find trending information extremely valuable in assisting them to see broader thematic and systemic issues.

Provide more periodic trending information BEST PRACTICE Analyze trending information currently being provided to the audit committee, seeking to identify thematic and systemic issues Ask senior management and members the audit committee what types of trending information they would find most valuable Revise internal audit processes to capture trending data as part of your ongoing procedures

Visual Trending Information

“Playable Graphs”

Opportunity #5 Pursue Greater Management follow-up on reporting issues

Pursue Greater Management followup on reporting issues There appears to be ample opportunity for internal audit functions to foster greater involvement from management in the reporting process. Such efforts, while hard to achieve, can significantly enhance the stature and positioning of internal audit.

How do you handle open audit issues, including management responses and follow up? Team. Mate Survey Results Internal audit develops an updated status-report on open audit issues, including management responses and follow-up, and discusses the report with the audit committee 71% Management develops an updated status-report on open audit issues and internal audit briefs the audit committee on report findings 16% Management develops an updated status-report on open audit issues and reviews report with audit committee 4% Other 8%

Increase management’s responsibility for reporting the status of audit issues BEST PRACTICE Since management is responsible for following up on reporting activities, take steps to reinforce that responsibility 1. Find a champion within management to assist with the followup reporting process 2. Reposition internal audit as function providing assurance on actions as opposed to group responsible for the actions 3. Assist management by providing a streamlined technology solution to track and report on corrective actions

Opportunity #6 Utilize more Automated Reporting Tools

POLLING SLIDE How are audit committee materials provided to the members? A. In hard copy only B. Electronically plus hard copy C. Only electronically D. Made available on a website

How are audit committee materials provided to the members? SURVEY RESULTS 15% In hard copy only 38% Electonically plus hard copy 35% Only electronically 12% Made available on a website 0% 5% 10% 15% 20% 25% 30% 35% 40%

Technology Used to Support Deliver Audit Committee Materials or to Increase the Effectiveness of Audit Committee Meetings SURVEY RESULTS

Ways to Enhance Audit Committee Materials: Current Considerations SURVEY RESULTS

Utilize more Automated Reporting Support BEST PRACTICE Explore opportunities to partner with IT and other corporate groups providing support to the board and board committees Leverage technology to enhance information-sharing and expand scope of activities Consider board portals Take your corporate culture into account ü Assess director receptivity to newer technology ü Meet with audit committee to review options

Opportunity #7 Enhance reporting on internal audit quality and performance

Enhance reporting on internal audit quality and performance. Question: Do you provide the audit committee with any type annual overall opinion on IA quality or performance? A. Yes B. No SURVEY RESULTS

Annual Reports on Internal Audit SURVEY RESULTS This is troubling!

Enhance reporting on internal audit quality and performance BEST PRACTICE Ø Perceptions are the proxy for “value” for directors and executives: key factor to keep in mind Ø Reporting needs to measure internal audit performance against stakeholder expectations Only 13% of survey respondents measure this key indicator Consider using a balanced scorecard to ensure that you report on all key aspects of performance as opposed to those dealing solely with internal audit measures

Opportunity #8 Consider providing the audit committee with an annual opinion

POLLING SLIDE Do you provide the audit committee with an annual overall opinion? A. Yes B. No

Do you provide the audit committee with an annual overall opinion? SURVEY RESULTS 40% Yes 60% No 0% 10% 20% 30% 40% 50% 60% 70%

If yes, does your opinion cover: SURVEY RESULTS Adequacy of overall system of controls 90% Adequacy of financial controls 51% Adequacy of risk management 50% Adequacy of governance processes 41% Overall regulatory compliance 30% Compliance with regulatory or legal requirements 30% Other (please specify) 2% 0% 10% 20% 30% 40% 50% 60% 70% 80% 90%100%

Determine what types of internal audit opinions are valued by the audit committee When it comes to providing an annual opinion to the audit committee only 40% of survey respondents do so. The experts interviewed in our process believe there is more value in selective assurance (wherein internal audit provides an opinion on a specific area or process) rather than an overall blanket opinion.

Key Considerations: Providing an annual opinion BEST PRACTICE If currently not providing an opinion, consider whether your audit plan would support issuance of an overall opinion Ask whether management sees value in an opinion If yes, determine what type of opinion Top area of focus for survey respondents providing an opinion: ü Assessing Adequacy/Overall System of Controls Consider areas such as risk management and adequacy of financial controls Discuss opinion value with audit committee chair

Opportunity #9 Explore Combined Reporting Opportunities

Explore Combined Reporting Opportunities Audit committees appreciate and value combined reporting that contributes to consensus-building and the development of sound, enterprise-wide profiles of risks and controls. Yet only 28% of the survey respondents prepare any materials on a combined basis with other risk-and-control functions. That suggests the potential for many internal audit groups to increase stakeholder value by exploring additional opportunities for combined reporting.

Areas Where Internal Audit Prepares Audit Committee Materials on a Combined Basis with other Risk & Control Functions SURVEY RESULTS When it comes to collaborating with other risk-and-control functions on combined audit committee materials, Enterprise Risk Management (ERM) leads the way for those following this practice.

What is the focus of your combined reporting? SURVEY RESULTS

Combined Reporting BEST PRACTICE Play the role of catalyst: Develop a common framework Think about cooperation and working together – not about changes in organizational structure Be aware of potential silo issues View the exploration of combined-reporting activities as an opportunity to increase information and knowledge sharing with other risk and control functions

Opportunity #10 Reassess the type, nature and frequency of communications with the audit committee

POLLING SLIDE How often do you send materials to the audit committee? A. Only prior to each audit committee meeting B. Prior to each audit committee meeting and periodically between meetings C. Audit reports are sent as they are completed D. Materials are shared on an ongoing basis

How often do you send materials to the audit committee? SURVEY RESULTS Only prior to each audit committee 52% Prior to audit committee meetings and periodically inbetween meetings Audit reports are sent as completed 32% According to the Audit Committee experts we interviewed, communications between an internal audit function and the audit committee should be an ongoing continual process. 0% Materials are shared on ongoing basis 16% 0% 20% 40% 60%

Reassess the type, nature and frequency of communications with the audit committee BEST PRACTICES To better inform your audit committee, provide members with periodic information and updates between committee meetings • Good communications is an iterative process focus on: § Valuable information and knowledge … not formats § Building relationships and trust • Think broadly about what kinds of materials and information would be of value to the audit committee: § Audit committee articles and practices § Risk and business-related materials § Look beyond audit results

Reassess the type, nature and frequency of communications with the AC Chair BEST PRACTICE Goal – establish a clear and effective channel between the two parties 60% of respondents indicated they hold discussions with the AC Chair to help the AC set priorities – half of these do this by email From an audit committee perspective, timely candid verbal communications are preferred David Landsittel, Former COSO chair There is much to gain from conducting executive sessions between audit chairs and CAEs. Such meetings provide the opportunity for the type of candid and constructive conversations that build rapport and strengthen the relationship

Enhancing Relationships and Building Confidence BEST PRACTICES Expand the range of internal audit presenters to the audit committee to include direct reports to the CAE and other internal audit staff as appropriate. Set up a series of informal meetings or events involving the audit committee and members of the internal audit staff. Have members of the audit committee conduct a critical review of internal audit's reports. ü Do they provide valuable insight? ü Do they reflect a strong knowledge of the organization and your primary areas of operation?

Resources Available www. teammatesolutions. com mike. gowell@wolterskluwer. com