www pwc com Reaching Greater Heights Are You

www. pwc. com Reaching Greater Heights: Are You Prepared for the Journey? 2013 State of the Internal Audit Profession Study April 18, 2013 © 2013 Pricewaterhouse. Coopers LLP. All rights reserved.

With you today Chris Lydon Internal Audit Director 314 276 2000 christopher. lydon@us. pwc. com Valerie Caporuscio Data Assurance Manager (330) 686 -2698 valerie. j. caporuscio@us. pwc. com Pw. C © 2013 Pricewaterhouse. Coopers LLP. All rights reserved. April 2013 2

Agenda • Introductions • Pw. C’s 2013 State of the Internal Audit Profession study - Heart of the matter - Examining the issues - The opportunity: defining greater heights - The path forward • Data analytics discussion • Questions and answers Pw. C © 2013 Pricewaterhouse. Coopers LLP. All rights reserved. April 2013 3

At a glance • 9 th Annual State of the Internal Audit Profession Study • Second year where we explored the impact of Internal Audit from the lens of a stakeholder • Over 1700 respondents, Audit Committee Chairs, Board, CEOs, and CFOs, participated including 630 executive stakeholders • Over 140 personal executive interviews conducted • Focus areas included - Stakeholder’s expectations of IA - Performance and value of IA’s contribution - IA’s contributions in emerging risk areas - Characteristics of IA functions Pw. C © 2013 Pricewaterhouse. Coopers LLP. All rights reserved. April 2013 4

Heart of the matter Pw. C © 2013 Pricewaterhouse. Coopers LLP. All rights reserved. April 2013 5

Heart of the matter Stakeholders want more and internal audit can deliver Internal audit continues to face challenges • Stakeholders are not aligned in their views on internal audit’s value and performance Key takeaways • Alignment must be achieved amongst stakeholders and CAEs on internal audit’s role in the organization, what internal audit value means and where internal audit should be focused • Internal audit’s capabilities are not keeping up - what was once leading practices are now the new floor • Internal audit must break the cycle of inaction and improve • Internal audit continues to its performance on eight core struggle in maximizing its attributes contribution, especially in less traditional areas Internal audit’s performance is not Our research has revealed internal audit functions performing at keeping up with – what was a high level provide a distinctively different level of service once leading is now the new floor April 2013 Pw. C © 2013 Pricewaterhouse. Coopers LLP. All rights reserved. 6

The new floor Pw. C © 2013 Pricewaterhouse. Coopers LLP. All rights reserved. April 2013 7

Examining the issues Pw. C © 2013 Pricewaterhouse. Coopers LLP. All rights reserved. April 2013 8

Examining the issues Our survey data revealed the circular nature of the internal audit challenges The issues of stakeholder alignment, a challenged capability foundation and suboptimal internal audit contribution are tightly interwoven Internal audit must break the cycle of inaction and increase its capabilities or risk being marginalized in comparison to other risk functions Pw. C © 2013 Pricewaterhouse. Coopers LLP. All rights reserved. April 2013 9

Examining the issues Stakeholders are not aligned in their views on internal audit’s value and performance Value At the most fundamental level, stakeholders have significantly different views of internal audit value 79% of board members see significant value, while only 44% of management do Performance This year’s research confirms that strong performance in the eight core attributes directly correlates to greater value. 56% of the board ranks IA performance as strong, while 37% of management do Critical Risks Stakeholders are not aligned on critical risks facing the organization which creates challenges for internal audit in addressing those critical risks 60% of the board members believe risks are well managed vs. 52% of management Board members’ views on value versus performance do not reconcile – 79% see significant value, yet only 56% view performance as strong – a 23% difference Pw. C © 2013 Pricewaterhouse. Coopers LLP. All rights reserved. April 2013 10

Examining the issues Internal audit capabilities are not keeping up How well is internal audit performing in each of the following areas? Promoting quality improvement and innovation Leveraging technology (such as automation, data and advanced analytics) Delivering cost-effective services Delivering services with a service-oriented team Engaging in and managing a relationship with stakeholders Obtaining, training and/or sourcing the right level of talent for audit needs Aligning scope and audit plan with stakeholder expectations Focusing on critical risks and issues 0% 20% 40% 60% 80% 100% Percent of stakeholders who say internal audit is performing well or very well Our survey revealed promoting quality improvement, leveraging technology and obtaining right talent as three key focus areas Pw. C © 2013 Pricewaterhouse. Coopers LLP. All rights reserved. April 2013 11

Better integration of technology through data analytics Analytics are widely viewed as important 81% Data analytics are important to improving the quantification of issues Yet few have strong programs 31% Data analytics are integrated into the audit process and used regularly Pw. C 85% Data analytics are important to strengthening audit coverage And most intend to, yet lack a well develope d plan © 2013 Pricewaterhouse. Coopers LLP. All rights reserved. 74% Data analytics are important to gaining a better understanding of risks 71% Plan to expand use of data analytics but do not have a well developed plan April 2013 12

Examining the issues Internal audit continues to struggle in maximizing its contribution in areas outside of its traditional focus Increased internal audit focus has not translated into greater stakeholder satisfaction Pw. C © 2013 Pricewaterhouse. Coopers LLP. All rights reserved. April 2013 13

The opportunity Pw. C © 2013 Pricewaterhouse. Coopers LLP. All rights reserved. April 2013 14

The opportunity - defining greater heights Integration with ERM and other risk functions Coverage of emerging risk areas Stronger foundational capabilities Our survey identified a subset of organizations represented by the top 5% of the respondent base as “high performing” Higher level of service The high performing internal audit functions stood out from their peers in their contribution and value to the organization Pw. C © 2013 Pricewaterhouse. Coopers LLP. All rights reserved. April 2013 15

The opportunity – defining greater heights Profile of the top 5% Promoting quality improvement and innovation Top 5% All others 67% 41% Obtaining, training and/or sourcing the right level of talent for audit needs 61% 34% Leveraging technology 54% 23% Focusing on critical risks and issues 91% 57% Engaging in and managing a relationship with stakeholders 82% 51% Delivering services with a service-oriented team 84% 47% Delivering cost-effective services 80% 49% Aligning scope and audit plan with stakeholder expectations 86% 58% Percent of respondents who responded internal audit is performing well The top internal audit functions are demonstrating significantly stronger foundational capabilities Pw. C © 2013 Pricewaterhouse. Coopers LLP. All rights reserved. April 2013 16

The opportunity – defining greater heights Profile of the top 5% The Organization works together across the various functional areas to create an integrated view of risk IA creates an integrated view of risk across the organization IA is well or extremely well coordinated with ERM IA is well or extremely well coordinated with other risk groups IA is involved in emerging risk areas 0% Top 5% Others 20% 40% 60% 80% 100% Percent of respondents who believe internal audit is well aligned with risk The high performing internal audit functions have achieved greater integration with ERM and other risk functions Pw. C © 2013 Pricewaterhouse. Coopers LLP. All rights reserved. April 2013 17

The opportunity – defining greater heights Profile of the top 5% The top 5% internal audit functions are providing better coverage of emerging risk areas and achieving stakeholder satisfaction Top 5% All others Commercial market shifts 92% 55% Government spending and taxation 52% 37% Competition 90% 67% IT security/cyber security 88% 54% Data privacy 94% 56% Large program risk 77% 43% Disruptive technologies 71% 40% Mergers, acquisitions and JVs 74% 47% Economic uncertainty 77% 53% New product introductions 82% 51% Energy and commodity costs/prices 64% 51% Regulations and government policies 89% 55% Financial markets 86% 65% Reputation/brand 92% 66% Fraud and ethics 92% 63% Talent and labour 83% 41% Percent of respondents who responded that each risk area is well managed Pw. C © 2013 Pricewaterhouse. Coopers LLP. All rights reserved. April 2013 18

The Opportunity – defining greater heights Internal audit functions fall across a spectrum of value delivery Pw. C © 2013 Pricewaterhouse. Coopers LLP. All rights reserved. April 2013 19

The path forward Pw. C © 2013 Pricewaterhouse. Coopers LLP. All rights reserved. April 2013 20

The path forward Our survey identified need for urgent action on part of stakeholders and CAEs alike Audit Committee: Ask More Management: Expect More • Ask yourself if your expectations of internal audit are high enough • Ask if critical business risk coverage is aligned with your views on risk • Ask if internal audit has a strategic plan and resources to deliver • Ask if you are enabling internal audit to be what it should be • Expect internal audit to perform at a higher level and bring more value • Expect internal audit to have a stronger enterprise-wide risk assessment process • Expect internal audit to deliver value for the investment but recognize the need to invest • Expect a robust dialogue with internal audit and provide candid feedback Pw. C © 2013 Pricewaterhouse. Coopers LLP. All rights reserved. CAEs: Deliver More • Deliver high quality on foundational areas • Deliver a strategic vision that aligns with stakeholder expectations • Deliver value for investment • Deliver proactively April 2013 21

Recap Our survey data revealed the circular nature of the internal audit challenges The issues of stakeholder alignment, a challenged capability foundation and suboptimal internal audit contribution are tightly interwoven Internal audit must break the cycle of inaction and increase its capabilities or risk being marginalized in comparison to other risk functions Pw. C © 2013 Pricewaterhouse. Coopers LLP. All rights reserved. April 2013 22

Data analytics discussion Pw. C © 2013 Pricewaterhouse. Coopers LLP. All rights reserved. April 2013 23

Better integration of technology through data analytics Analytics are widely viewed as important 81% Data analytics are important to improving the quantification of issues Yet few have strong programs 31% Data analytics are integrated into the audit process and used regularly Pw. C 85% Data analytics are important to strengthening audit coverage And most intend to, yet lack a well develope d plan © 2013 Pricewaterhouse. Coopers LLP. All rights reserved. 74% Data analytics are important to gaining a better understanding of risks 71% Plan to expand use of data analytics but do not have a well developed plan April 2013 24

Drivers and value of analytics within internal audit The risks highlighted as a result of the financial crisis has required organizations to develop a deeper understanding of the businesses they manage. They cannot simply rely on existing control structures. They must evaluate transactional activities for patterns, trends and anomalous behavior. Drivers Value What is creating demand for analytics? Why is it so important for organizations to get it right? • Deeper business understanding & focus on risk • Pressure on audit groups to audit closer to the business and a develop a deeper position on risk and issues. • Lower existing and future costs • Regulatory expectations to monitor business activities are increasing. • End-to-end testing • Data is growing exponentially, and the technologies to analyze the data are maturing rapidly. • Increased population and control coverage • Organizations are being forced to do more with less. • Competitive pressures are forcing organizations to innovate. Pw. C • Real-time evaluation of controls and data integrity - facilitates “what-if” analysis © 2013 Pricewaterhouse. Coopers LLP. All rights reserved. April 2013 25

ng Data Analytics Maturity Model iti d Au d ze mi ti p y O ll Fu There is a broad spectrum of technology use in current data analytics programs Fully Optimized • Technology enables full integration into internal audit workflow • Business focused Routinely Leverage • Core technical competencies resident within the department • Results used for updating risk assessment throughout the audit process s tic ly na A oc -H Ad Ad Hoc Analytics • Occasional, ad-hoc data Initial Stage • Creation of data experts to develop routine data analysis techniques • No process for incorporating into IA methodology • IA focused Enhancing the use of technology can assist with improving the efficiency of the Internal Audit department. analysis on certain audits Pw. C © 2013 Pricewaterhouse. Coopers LLP. All rights reserved. April 2013 26

Building an effective program Business view Analytics increases assurance through improved population coverage and more intelligent, riskbased sample selection. Enterprise view Analytics enables regular, periodic reporting and accelerates on-going risk identification and assessment. 2 3 Audit Plan Analysis of audit plan and coverage against risks and geography’s and issues Audit Planning and Scoping Risk analysis to confirm understanding and identify issues within business operation 1 Risk Assessment Analytics to compare like metrics between audit entities to drive risk identification 4 Auditing Life Cycle Control and Outcomes Testing Analytics to test the operating and evaluate risk outcomes and quantify findings 6 Issues Management & Monitoring Analytics to re-test and monitor identified issues and trends Pw. C Reporting 5 Analytics to present risk insights and articulate audit findings © 2013 Pricewaterhouse. Coopers LLP. All rights reserved. April 2013 27

Implementing a Strategy – Where to Start? • Start small in Year 1, working your way towards a larger data analytics or Continuous Auditing strategy by Year 3 • Along the path, evaluate: - Resources - Tools - Training • Move from manual use of data analytics tools towards automated scripting that can be used across business units and time periods, creating efficiency and repeatability Pw. C © 2013 Pricewaterhouse. Coopers LLP. All rights reserved. April 2013 28

Sample Data Analytics Strategy Year 1 • Select an audit, and execute data analytics on one business process where you will see immediate results, such as the Purchase-to-Pay cycle • Communicate benefits to stakeholders to gain support and momentum Year 2 • Expand data analytic know-how to several other business processes • Use data analytics to perform scoping activities on individual audits • Based on results of data analysis, select high risk areas to focus on during audit • Use data analytics to support findings and quantify issues in the internal audit report Year 3 • Implement the usage of repeatable data analytics across business units and time periods to gain efficiencies • Utilize data analytics in the Risk Assessment process going forward • Develop a Continuous Auditing strategy going forward Pw. C © 2013 Pricewaterhouse. Coopers LLP. All rights reserved. April 2013 29

Internal Audit Process Framework – As Is Process to utilize results for next year’s Risk Assessment Utilize information from previous audits for current audits (ad-hoc data analysis not leveraged project to project). However, informal sharing of information within group. ANNUAL Risk Assessment Pw. C Fieldwork Audit Plan Technology is being applied here (in audit management and data analysis), to speed up audit process… © 2013 Pricewaterhouse. Coopers LLP. All rights reserved. Reporting Wrap-Up April 2013 30

Internal Audit Process Framework – Future A technology enabled approach to the internal audit framework allows for more timely identification of and response to risks. TECHNOLOGY ENABLED APPROACH ONGOING Risk Assessment • Monitor key risks • Changes in KRIs indicating change in risk profile Continuous Audit Program Pw. C Audit Plan • Monitor results to change frequency/ scope of planned audits Execute Automated Script PERIODIC Fieldwork Reporting • Report changes in trends to management Strategic Audit Exception Reporting © 2013 Pricewaterhouse. Coopers LLP. All rights reserved. Review Reports April 2013 31

Thank you for your participation The 2013 State of the Internal Audit Profession Study may be found at: www. pwc. com/us/2013 internalauditstudy E-mail us questions at: 2013 SOPIAStudy@us. pwc. com This document is for general information purposes only and should not be used as a substitute for consultation with professional advisors. © 2013 Pricewaterhouse. Coopers LLP. All rights reserved. Pw. C refers to the United States member firm, and may sometimes refer to the Pw. C network. Each member firm is a separate legal entity. Please see www. pwc. com/structure for further details.