The Institute of Internal Auditors (IIA), Bombay Chapter

Research Partner: VERITA Management Advisors

Measuring the Impact of Internal
Audit in Uncertain Times
November, 2012

The Institute of Internal Auditors (IIA), Bombay Chapter Page 2


Index

1. The Institute of Internal Auditors (IIA) and related initiatives.3

2. Foreword.5

3. Research Background..6

A. Introduction
B. Impact of the Global Financial Crisis
C. About the Research Initiative

4. Research Findings10
A. Adding value to the Audit Committee
B. Nurturing an effective IA function
C. The new business risk normal
D. A good internal auditor is a sum of parts
E. Aiming in the right direction
F. Integrated view at the top is more useful

5. The Lean, Mean and Hungry tribe of Internal Auditors..23

6. Acknowledgement.27











The Institute of Internal Auditors (IIA), Bombay Chapter Page 3


Introduction
1. The Institute of Internal Auditors - India and Bombay
Chapter
The Institute of Internal Auditors-India (IIA-India) is affiliated to its parent body, The Institute of
Internal Auditors, USA (IIA-Inc). IIA-India is a not for profit professional organization dedicated
to the advancement and development of the internal auditing profession in India, in sync with
the highest standards propagated by its parent body. IIA-India was founded about three
decades ago, starting first in Bombay, and soon expanded with the setting up of four additional
chapters-Delhi, Calcutta, Madras and Bangalore. In June 2007, one new Chapter at Hyderabad
has been established. Together, these six Chapters represent IIA-India, which in turn is the
National Affiliate of IIA Inc. Most Chapters have in addition, at least one 'Audit Club' attached to
it (with less than 100 members in each Audit Club), which operate from cities falling within their
respective geographical region. This process facilitates local programs/meetings with minimal
time/cost on the part of the members, given the size and spread of the country. The present
membership strength is more than 5000, which includes members drawn not only from trade,
industry and practice, but also comprises non-accountants, representing multi-disciplinary
professional skills so as to fully meet the diverse business challenges.
IIA Bombay Chapter is taking various initiatives for the continuous evolution and updating the
internal audit profession through various programs like annual conference, Internal Audit
Academy, On-site training, faculty support, etc.
IIA Bombay Chapter has recently launched IIA Bombay Research Foundation with the
objective of initially being the research arm of The IIA Bombay Chapter conducted by thought
leaders in the profession.
The Foundation aims to be a driving force for the continuous evolution of the profession through
conducting surveys, publishing research reports covering the full spectrum of issues facing the
profession and through such other initiatives that explore current issues, emerging trends, and
future needs. This foundation is led by a committe of IIA Bombay Chapter Mr. Naren Aneja,
Mr. Nagesh Pinge, Mr. Anil Bhandari, Mr. Satish Shenoy and Mr. S Bhaskar.
IIA Bombay Chapter has identified Verita Management Advisors as its first research partner
enabling IIA Bombay Chapter to launch this new initiative. Verita Management Advisors along
with IIA Bombay Chapter, has developed this research document titled Measuring the Impact of
Internal Audit in Uncertain Times.



The Institute of Internal Auditors (IIA), Bombay Chapter Page 4




Research Guidance
Mr. S Bhaskar, President of the Institute of Internal Audit, Bombay Chapter an
invitee member of the IIA India Council and also a committee Member of the
ASSOCHAM National Council on Internal Audit & Corporate Fraud.
Mr S.Bhaskar is the Chief Internal Auditor for the Tata Capital Group comprising of
Corporate Finance, Consumer Finance, Housing Finance, Private Equity, Investment Banking,
Broking, Wealth Management, Forex, Travels & International Business. He is a member of the
Ethics Committee , Operations Committee and an invitee member of the Fraud & Operational
Risk Management Committee of Tata Capital Ltd.

Authors
VERITA is a private company registered in India. VERITA is promoted by a young team of
entrepreneurs based at Mumbai. VERITA has a rich talent pool of consultants with diverse
skills and post graduate qualifications. VERITA serves varied businesses in the areas of
business and risk advisory, direct and indirect taxation and process outsourcing.
VERITA operates on a pan-India service execution model with quality business partners. Head
quartered in Mumbai with a network of likeminded business partners across the country under
the VERITA Business Alliance Program (BAP).




Huzeifa Unwala, Board Member
Verita Management Advisors
(M) 98200 51936
(E) huzeifa.unwala@verita.co.in
Amit Shah, Director
Verita Management Advisors
(M) 99202 88031
(E) amit.shah@verita.co.in

The Institute of Internal Auditors (IIA), Bombay Chapter Page 5

2. Foreword
Uncertainty is the new normal. It has been fashionable for business leaders to parrot the
unchanging reality of constant change but that mantra has now been replaced by dread of the
unknown. The response to uncertainty has been two-fold. On the one hand business has
become more complicated in its effort to lay off risks: as was the case with bundles of
mortgages, sold to unwary investors. This response has often aggravated the condition rather
than ameliorating it. On the other hand regulators, law makers and the public have sought to
impose greater controls over business, complicating matters still further. No examples are
required of this. At the intersection of all these complexities sits internal audit.
The internal auditors job appears to have become one of reassuring senior management and
the board of directors that their business is being run in a manner that satisfactorily deals with
the risks it faces. It is not sufficient that those risks are avoided. Managements and boards are
in a highly competitive environment and expect that risks are exploited so as to maximize
shareholder value. Therefore, they expect to have a better ways of fine-tuning their response to
specific risks than do their competitors. Bankers want to fine tune their response to credit risk in
the hope that they can offer loans at lower rates of interest to their borrowers without
compromising on credit risk cost. Other managements want to game regulations or contractual
obligations hoping to steal a march over their competitors. Many companies have developed a
(poor) reputation for changing the terms of competitively won bids after winning them. Or they
sail very close to the legal wind hoping that the regulators gust does not overturn their ship.
Again, the only protection against disaster that managements and boards of companies that
build their business on such practices have is a competent audit. Internal audit is required to
possess ever greater degrees of expertise in the subjects that it is required to deal with. The
days of the general internal auditor are over.
At the same time internal audits responsibilities have never been greater for another reason.
Many managements and boards have become very short term in their outlook as the fog of
uncertainty makes peering into the distance difficult. This tendency is exacerbated by the very
short term behaviour of capital providers. But, businesses that do not give due regard to long
term trends and risks run the fundamental risk of perishing. No greater long term risk now exists
than that of climate change. Few, if any, businesses have developed a real programme to deal
with it; most treat it as an opportunity to make more profit. Responsible internal auditors need to
devote attention to this area and to guide managements and boards into strategizing for it.
Businesses that develop a good response to this virtual certainty (assisted by internal audit), will
be the ones that survive into the second half of this century.
Nawshir Mirza.
Date: 29
th
October, 2012
Mumbai

The Institute of Internal Auditors (IIA), Bombay Chapter Page 6


3. Research Background

A. Introduction
The Research Foundation of The Institute of Internal Auditors (IIA), Bombay Chapter
initiated a research study during the period August to October 2012 on the subject of
Measuring the Impact of Internal Audit in uncertain times understand how the
purpose is to Chief Audit Executives (CAEs)/ Audit Heads (AHs) of large and medium
sized companies overcome the challenges faced by internal audit functions emanating
from the uncertain business environment and the ever expanding stakeholder
expectations.
In uncertain economic times the existence and significance of investments in non-
customer facing business processes such as Internal Audit are easily questioned
whereas the stress on internal auditors is far greater with ever increasing audit
responsibilities, expanding audit committee expectations and limited resources at the
command of the internal audit teams.
The internal audit function whether fully outsourced, in-sourced or co-sourced can play
a crucial role in assisting the Board and especially the CEO in re-shaping organizational
and process design. An audit function which is independent of any business function is
best placed to question the resources being consumed by each business process
thereby creating value for the stakeholders. The CAEs/ AHs are often asked:
Is the internal audit function meeting the expectation of the Board of Directors?

Is the internal audit function capable of focusing attention on monitoring strategy
and action plans?

Is the internal audit function adding value in the uncertain economic times?
This research study highlights quantitative and qualitative analysis that would assist the
CAEs/ AHs in addressing the above questions. This report aims at capturing and
consolidating the emerging point of view of CAEs/ AHs who liaise with the C level
executives and Audit Committees.







The Institute of Internal Auditors (IIA), Bombay Chapter Page 7

This study reveals preferences of CAEs/ AHs on:

Key measures that add value to various stake holders

Key contributors for shaping the effectiveness and performance of modern day
internal audit function especially in the backdrop of uncertain economic times

Top risk factors that need attention of the business and audit teams

The research team interviewed leading CAEs/ AHs to find out the most noteworthy
Internal Audit Practice Framework related code adopted by their IA functions. The
response of CAEs/ AHs was very exciting and the research team could consolidate 15
practice philosophies that encompass auditor independence, audit planning, audit team
knowledge building, audit methodology related and others. This exercise will benefit all
IIA members and assist them in benchmarking specific practices to elevate the standing
of their audit functions.
B. Impact of the Global Financial Crisis
In uncertain economic times business priorities change this creates excessive pressure
resulting in cost cutting and employee layoffs. Global IA surveys indicate that during the
economic crisis and recessionary periods internal audit staff reductions are common
showing a direct impact on the internal audit profession. Further, the surveys indicated
that the internal audit staff reduction was not high amongst the Fortune 500 and large
companies; however, in case of small and medium sized organizations the impact was
significant.
Global IA surveys found that the economic crisis fuelled increased integration between
risk management, compliance and internal audit functions.
To meet the rising cost pressures in uncertain economic times Internal audit functions
adopt special initiatives like trimming the IA budget by reducing travel spends, bringing
in outsourced consultants for routine and specialist audit missions and taking up in-
house IA training initiatives.
Internal audit is vulnerable and at times where the function does not have independent
reporting mechanism it can be the first casualty. Challenging times actually increase the
demands on many internal audit departments as they play special roles in cost
reduction projects.



The Institute of Internal Auditors (IIA), Bombay Chapter Page 8


In our current research study we found that all the CAEs/ AHs were in absolute
agreement on the fact that in stressed times internal controls should be strengthened
and not diluted as employee layoffs in the absence of a control design impact analysis
typically results in control dilutions. This survey initiative received a thumb down on
reduction of IA budgets as a measure of adding value to the Audit Committee in
uncertain times.

C. About the research study
The research team designed a detailed research cum survey questionnaire that was
circulated to 50 CAEs/ AHs of large and medium sized companies. The research team
received replies from 30 participants predominantly from the Mumbai region. The
research team also conducted 5 personal interviews with CAEs/ AHs of leading
corporate houses to obtain detailed replies on the direction of the IA function in
uncertain economic times.
The research team received responses from varied sectors. The names of CAEs/ AHs
and the participating companies have been provided under Acknowledgement section
of this report.
Sector Break up of Respondents


The Institute of Internal Auditors (IIA), Bombay Chapter Page 9

The respondents are categorized into two categories viz., CAEs/ AHs and others. In
certain participating companies the custodian of the IA function was either the Head of
Finance/ Risk/ Compliance.
Respondent Profile



The Institute of Internal Auditors (IIA), Bombay Chapter Page 10


Measuring the Impact of IA in uncertain times
4. Research Findings

A. ADDING VALUE TO THE AUDIT COMMITTEE/ BOARD OF DIRECTORS
Q 1: In uncertain times how does a
modern day IA function add value to the
Audit Committee/ Board of Directors?

Results:

93% of respondents agreed or strongly agreed that
the IA function could add value by
- Greater level of engagement with
stakeholders
- Enhance focus on compliances
- Closer monitoring of critical processes to
isolate outliers
- Adopting a leaner approach to audit by
focusing on high risk areas

Majority of the respondents agreed or strongly
agreed on the following additional measures where
the IA function could add value by:
- Continuous Control Monitoring
- Greater use of subject matter experts
- Benchmarking of processes /indicators with
competition

A large majority of respondents disagreed that the IA
function could add value by:
- Reducing the IA budget - 70%
- Reducing internal talent and placing more
reliance on outsourced service providers -
63%
- Each audit mission to carry a value multiple
target - 58%



The Institute of Internal Auditors (IIA), Bombay Chapter Page 11


Research Viewpoint
ADDING VALUE TO THE AUDIT COMMITTEE/ BOARD OF DIRECTORS
Deployment of internal audit function demands economic resources in people, process,
technology and other several intangibles that are associated with the internal audit
function. The smaller the entity the higher is the resource constraint in terms of the
organizational ability to implement a meaningful internal audit function. In general
business and executive teams hold a view that the output of internal audit missions
should generate a value multiple of x times the investment made. Measuring the internal
audit performance with such a single-minded and narrow viewpoint contradicts the
inherent responsibility cast on the flock of internal auditors of objectively evaluating the
design and operative effectiveness of the internal control components in an
organization.
This research study reveals that several internal audit functions that operate in a
challenging business environment especially in uncertain times have ensured that the
primary objectives of IA function are well communicated and implemented. It is evident
that in uncertain economic times the yardstick for measuring the IA performance shifts
from Value addition to Value preservation as the management attention is on resource
preservation.
It is difficult to quantify the benefits of internal audit rather the organization should focus
on extracting the maximum from the internal audit function. A modern day internal audit
function needs to align with the Business Objectives. It must develop an effective Risk
Based Audit Plan in consultation with the business teams, judiciously use own
judgment and also obtain approval from the Audit Committee. To strike a fine balance
between apparently conflicting responsibilities it is necessary to deploy the right skill
sets. Internal audit teams should certainly concentrate on Value Preservation as its
first line of duty and thereafter think of Value Additions in Internal Audit Reporting.
- Chief Audit Executive, Indias largest automobile company.
Internal Auditors can play an effective role in objectively checking the existence and
functioning of internal control components. The contribution and impact of the internal
audit function which is essentially a monitoring one in an organizations successful
progress becomes more relevant and critical at those stages when the organization is
most vulnerable to economic uncertainty. In times of economic uncertainty
organizations develop lower risk appetites and the cushion to absorb surprises
completely vanishes.


The Institute of Internal Auditors (IIA), Bombay Chapter Page 12


Research Findings
B. NURTURING AN EFFECTIVE IA FUNCTION








Q 2: What are the real differentiators between a performing Internal Audit
function and a non-performing one?

Results:

All the respondents agreed or strongly agreed that following measures are key differentiators
between a performing IA function and a non-performing one:
- Building continuous learning mechanisms
- Implementation of Internal Audit Function Performance score card
- Adopting technology to provide a greater degree of assurance and add to the surveillance
capabilities

The Institute of Internal Auditors (IIA), Bombay Chapter Page 13








Research Viewpoint
NURTURING AN EFFECTIVE IA FUNCTION
Information technology deployment in the audit process has emerged as a key
differentiator as it helps the internal auditor to deal with and analyze huge volumes of
data in a short span of time. It also helps to maintain workflow of audit data and
information in order to keep a track on audit opening, control testing, report delivery,
open audit issues, etc.
Performance measurement of Internal Audit function through performance score card is
another emerging differentiator of an effective Internal Audit function. The performance
scorecard assists the Chief Audit Executive in measuring the value added by IA function
in-terms of cost saving, revenue assurance, compliance, performance efficiency, etc.
Our research team identified several performance oriented key measures that are
currently in vogue and deployed by leading IA functions in the Mumbai region. There
measures are deployed by the Board and Audit Committee members while assessing
the impact and effectiveness of the Internal Audit teams. The key measurements are a
mix of efficiency, effectiveness and management measures such as:
1. Percentage completion of the annual audit calendar.
2. Red flags identified by the internal audit team as Early warning signals on serious
compliance and/ or control violations that would be have dire reputational
consequences to the organization.
3. The trend of non-repeat audit observations made by the internal auditor during the
year. Assessing how many known issues have been implemented by the
management team.
Majority of the respondents agreed or strongly agreed on the following additional differentiators:

- Managing an appropriate balance between audit requirements and staffing levels
- Attract and retain subject matter experts
- On-time report delivery
- Attract and retain quality service partners
- Constant engagement with the chair of audit committee
- Successful completion of annual audit calendar
- Implementation focus
- Automation of audit workflow
- Exceed the expectation set by the audit committee

The Institute of Internal Auditors (IIA), Bombay Chapter Page 14

4. The percentage of audit observations that could be classified as Cost Savings or
Revenue Leakage opportunities. This is an effectiveness measure which indicates
the element of effective value add by the internal audit function.
5. The productivity of the internal audit team in terms of available resources, audit per
resource efficiency, audit cycle time, etc.
6. The percentage of High Risk/ Key audit observations identified by the internal audit
team during the year.
7. The percentage of unimplemented/ uninitiated audit observations during the year.
8. Number and quality of instances highlighted of internal and/ or external
benchmarking for standardization and organizational consistency.
9. Percentage achievement of audit goals, objectives and initiatives during the year.
10. IA acceptability, attention/ perception and satisfaction feedback from the executive
management team.
11. IA budget on training, learning and development

12. IA ability to attract and retain talent especially subject matter experts

13. IAs participation in on-going risk assessment projects

14. IAs participation in on-going change management projects

15. IAs participation in control advocacy and continuous improvement programs


Taking a philosophical view on the ROI of internal audits a Chief Audit Executive of a
large corporate house says we can look at the year-end Balance Sheet position of the
internal audit contributions as:
Assets = Fixed Assets (IA team members and skills enhancement) + Current
Assets (the benefits given by the IA team to the organization) + Miscellaneous
expenditure (the undelivered commitments of the IA team)

Liabilities = Equity (Confidence levels of the Audit Committee and Board enjoyed
by the IA team) + Share Premium (The perception value of the IA team in eyes of
the auditees and the serious attention bestowed to the IA team by the auditees)
The above equation provides a simplistic but effective ROI mechanism for the IA team.

The Institute of Internal Auditors (IIA), Bombay Chapter Page 15


Research Findings
C. THE NEW BUSINESS RISK NORMAL










Q3. What are the new risk factors that you would like to address in an
uncertain business environment?

Order of Significance on a scale of 1 to 5 where 1 is least significant

Results:

28 respondents participated in ranking the new risk normal grid. The Top 5 rankings were given
to the risks:
- Rising cost pressures
- Frauds
- Growing compliance complexities
- Liquidity, Lack of business resilience and inability to meet growing customer needs
- Lack of innovation

The respondents agreed that business and IA teams should focus their attention on Top 5 risk
rankings in uncertain economic times.

The Institute of Internal Auditors (IIA), Bombay Chapter Page 16

Research Viewpoint
THE NEW BUSINESS RISK NORMAL
To obtain a global viewpoint on building a World Class risk based IA function the
research team interviewed Mr. Uday Gulvadi, CPA, CIA, CISA an IA expert with over
two decades of international experience in risk consulting. Mr. Gulvadi has held
leadership positions as Partner and Director within Internal Audit and Risk Management
practice at leading recognized US and international accounting firms. Mr. Gulvadis
views are reproduced in a narrative form as under:

Questions have been raised at the role and effectiveness of the Internal Audit function
(IA) in being able to prevent or protect organizations caught up in the financial crises.
Have organizations learnt their lessons from the crises? And what changes have they
brought in as a result?
One impact of this soul searching has been that leading companies are taking steps to
build a world class IA function. They have realized that for IA to truly add business value
their horizons must be broadened to cover the effectiveness of Enterprise Risk
Management (ERM). Also as the crises showed, there is a high degree of interrelation
between various risks and therefore management and IA should be cognizant of how
each risk element impacts the other and the organization as a whole.
Limiting the ambit of IA to traditional internal controls assessments focused on
compliance, technology and financial controls is no longer sufficient. A key step toward
building a world class internal audit would be to realign the focus of IA to these two key
areas:
Strategic Risk
Execution Risk
For IA leaders to win the proverbial seat at the table with other C Level executives, it is
critical for them to be aware of the strategic landscape within their respective industries
and how their organizations strategy is set and executed within that environment.
Internal Audits role should encompass an assessment of the organization strategy
setting and execution processes. For e.g. how does the organization deal with the risks
of an uncertain business environment? How does the organization identify and prepare
for potential black swan events?
The best strategic plans have to be backed by good execution. How often does an IA
function get involved in assessing the execution risk to the organizations strategy?
Execution is after all is what translates strategy into actual results. IA should assess
practices, processes and controls of the organizations execution capabilities.

The Institute of Internal Auditors (IIA), Bombay Chapter Page 17


Research Findings
D. A GOOD INTERNAL AUDITOR IS A SUM OF PARTS





















Q4. What are the key skills required to add value to the Board of Directors/
Audit Committee?

Results:

Respondents believed that it was difficult to identify a particular skill as the key for adding value to
the Board and Audit Committee; however, the responses can be summarized as:

- Ability to understand the expectation of the Bod/ Audit Committee
- Ability to understand the finer aspects of the business and organization
- Deeper understanding of the risks, processes, company culture and business landscape
- Ability to carry out objective and independent assessment
- Analytical ability to interpret the data and present it in a comprehensive manner
- Ability to understand statutory and legal requirements and assuring the stakeholders about
the compliance level
- Ability to observe and report blind spots and the damages caused or likely to be caused
- Subject matter expertise
- Analytical and problem solving skills or efficient use of technology
- Ability of effective communication with Auditee, BOD and Audit Committee
- Ability to manage project team and relationship

The Institute of Internal Auditors (IIA), Bombay Chapter Page 18

Research Viewpoint
A GOOD INTERNAL AUDITOR IS A SUM OF PARTS
The ability of the internal auditor to stay objective, consistent, engaged and sharply
focused on the IA objectives emerged as the key skill expectation of the Board of
Directors/ Audit Committee. It was noted that behavioral skills and competencies take
precedence over technical skills and competencies as the latter can be acquired
through training and experience, however, the former is difficult to acquire.
In the context of ever expanding stakeholder expectations the research team found it
relevant to obtain views of a senior statutory audit professional. A statutory auditor looks
upon the modern day internal audit function to go beyond the call of statutory
requirements enshrined in the CARO 2003. The key elements that the statutory auditors
look upon from an internal auditor are on-going risk assessments including risk
benchmarking, forward looking control reviews and identity risks to minimize surprises.
A senior audit partner from a global accounting firm states A statutory auditor can
better leverage the benefits of an internal audit if it is proactive, also seeks to identify
risks that could pose problems for the business in future to minimize potential
surprises. There has to be a paradigm shift in the focus of internal audit - moving from
annual risk assessment process to taking a more continuous approach to assessing risk
especially considering todays dynamic business environment.
Risk assessments and audit plans should be updated as often as possible with a
coordinated approach in consultation with the statutory auditors. The process should
also identify emerging risks through effective and regular interaction with executive
management/ key business managers etc. It would also be relevant to watch out for
risks encountered by others in the same industry and benchmark with peers (especially
in the same industry).
Independence of internal auditors/ internal audit system is an essential pre-requisite and
is expected to make it more effective. The function should be allocated higher budgets
and more time should be devoted by those charged with governance to the internal
audit observations. This would add significant value not only to statutory auditors but
also to the stakeholders and those charged with governance.





The Institute of Internal Auditors (IIA), Bombay Chapter Page 19

Research Findings
E. AIMING IN THE RIGHT DIRECTION
























Q5. What is the Value add that the Board of Directors/ Audit Committee are
looking at in an uncertain business environment?

Results:

Respondents provided several interesting propositions, summarized as:

- Guidance and direction to the company to deal with external uncertainties
- Identify bottlenecks/ blockages and give suggestions / recommendation to remove them
- Root cause and risk analysis of the exceptions and recommendation to eliminate /
minimize the risk involved
- Innovate processes /approach which may result into cost savings or process efficiencies
to the business
- Protection from competition to the extent possible
- Assurance on key business processes
- Early warning signal on risk which would impact the business continuity, stake holders
trust, reputation, non-compliances, etc.
- Strategic implementation support system




The Institute of Internal Auditors (IIA), Bombay Chapter Page 20

Research Viewpoint
AIMING IN THE RIGHT DIRECTION
The aim of any business is to create, nurture and preserve reputation and profits. In
order to be a truly world class value added function, IA must provide a mirror to the
organization, enabling management to identify long term indicators of value creation or
erosion and changes in competitive positioning. This will ensure that IA fulfills its key
role in enabling management to be effective stewards of long term value preservation
and growth.
The only things that evolve by themselves in an organisation are disorder, friction, and
malperformance.
- Peter F. Drucker
Internal auditors can play an effective check and balance role in ensuring that the
organisation is protected against disorder, friction and malperformance.
The research team has identified one shining internal audit example that proved to be a
Top Line Contributor in the growth story of a company. This case study is selected
from the Logistics sector where the exemplary work of a CAE of a Courier and
Integrated express package distribution company was recognized by the management
team. It is a case study that demonstrates how the internal audit function not only met
but far exceeded the expectations of all the stakeholders.
The CAE was requested to undertake internal audit of the Claim handling process of the
Courier Company. During audit of the claim handling process, the CAE came across
number of cases having disputes with customers on limited liability terms. Customers
were demanding full value of damaged/lost goods against the argument of Companys
limited liability policy. The Companys contention was that it recommends insurance to
shippers in case of valuable shipment and as such not liable to pay full value. Some of
the customer feedback showed they accepted such claim settlements reluctantly.
The CAE explored possibilities of finding a solution whereby the Company could
enhance customer satisfaction. The CAE approached few insurance companies, but
there was no ready product available which allowed carrier of the shipment to offer
Insurance of shipment and settlement of claim to be done to the shipper. But one
company desired to work on this solution after taking approval from their Head office
and the Regulator.
Accordingly, a new customised policy was designed by the insurance company which
allowed carrier of the shipment to offer insurance arrangement to its customers across
counters under the customised policy with Insurance Company. The feature was named

The Institute of Internal Auditors (IIA), Bombay Chapter Page 21

Freight on Value (FOV). The feature is running very successfully for last four years
which not only enhanced customer satisfaction but also added extra revenue to the top
line of the Company by acquisition of new customers and improved bottom line by way
of service charges for the new offering.
Freight on value (FOV) is product feature primarily designed to remove the hardship
faced by customers in case their valuable shipment gets damaged during transit and
they have to bear the loss as all courier companies operate with limited liability as
defined on the waybill.
Comments from Managing Director of the company:
The Managing Director of the Courier Company added on the service Since the launch
of the FOV service, our sales teams have been able to offer insightful solutions to the
customers; it also enables customers to make a decision based on factors of reliability
and complete peace of mind. I believe that the FOV service has differentiated us and
advantaged against competition when submitting RFPs

The Institute of Internal Auditors (IIA), Bombay Chapter Page 22


Research Findings
F. INTEGRATED VIEW AT THE TOP IS MORE USEFUL










Q6. Is it time that an integrated internal audit is performed to avoid
duplication of efforts and audit fatigue? Integrated audit refers to an audit that
satisfies the needs of internal audit, fraud risk assessment and technology
risks.

Results:

90% of respondent agreed that an integrated and comprehensive internal audit is beneficial to
cover all aspects like financial audit, process audit, fraud audit, technology audit, etc. This also
ensures adequate reporting, avoids duplication of efforts and audit fatigue.

However, we cannot entirely rule out the necessity of standalone special audits or fraud risk
assessments or technology audits as each organisation and business environment is unique.
Further, small organisations generally dont have subject matter experts to perform and achieve
specific objectives of the management in an integrated manner.


The Institute of Internal Auditors (IIA), Bombay Chapter Page 23


5. The Lean, Mean and Hungry tribe of Internal Auditors

During the course of the research study the team interviewed Chief Audit Executives of
leading business houses and observed several notable practices adopted by them.
The depth of the notable practices reveals the high state of maturity of the internal audit
functions and the lean, mean and hungry approach of the Chief Audit Executives.
The research team believes that such notable practices are exemplary in nature and
shall assist the readers of this report in scaling up the maturity of their internal audit
functions to the next level. A compilation of the notable practices is presented in a
summarized manner.

Sr.
No.
AREAS NOTABLE PRACTICE

1.

Appointment of
Chief Audit
Executive
Recruitment directly done by the Chair of the Audit Committee. Since the
reporting relationship of the CAE is with the Chair of the Audit Committee there
was no involvement of the CEO or CFO in the recruitment of the CAE.

2.

Dealing with
Whistle Blower
escalations and
protection of
whistle blowers
The Board and Audit Committee expanded the CAE role and responsibility to
include receipt, investigation and initiation of corrective action on whistle blower
complaints by keeping the incident confidential.

3.

Internal
Benchmarking

The internal audit team studies the good practices implemented by the Auditee
department and shares them with other departments through internal
publications and special sections in the Internal Audit Report. The identified gaps
highlighted in a positive manner serve the organisational goal of standardisation
and efficiency in operations. This ensures recognition of good practices and
motivating business teams to embrace good practices.


The Institute of Internal Auditors (IIA), Bombay Chapter Page 24


4.

Control
Advocacy

The Head of audit has developed a quarterly knowledge sharing forum wherein
all key leaders meet and enhance their knowledge base by inviting external
speakers on emerging topics. The Head of Audit takes this opportunity to discuss
developments in the area of internal controls and advocates/ promotes good
control practices.

The internal audit team publishes a quarterly digest called Beacon. This digest
shares good control practices, audit issues and other relevant topics with auditee
departments.


5.

Thinking Out of
the Box

The CAE analysed the root causes of a particular finding and also envisaged the
needs of the ultimate customer. He recommended an innovative solution of
expanding the current service offering of the company to include an expanded
and bundled insurance cover. This problem solving approach was first rejected
by the Business team; however, on consistent persuasion it was adopted and
has emerged as a BIG VALUE ADD and a top line contributor.


6.

Making the
audit process
Customer
Facing
The organisation coached the CAE under the First Choice program that was
meant for senior business executives to listen to the Voice of their Customers
and align their business processes with customer needs.

7.

Gathering
business
insights

The CAE is invited in all business review meetings by the CEO as a special
observer to obtain key business insights. This practice assists the CAE in
developing sound understanding of business issues and also provides a one to
one forum with the CEO for the purpose of sharing useful insights.


8.

Staying on
course

The CAE conducts monthly team meetings with a simple rolling agenda:

a. Look back at the month gone by to take corrective actions
b. Review the audit plan for the next month to make relevant adjustments, if
any
c. Hold a knowledge sharing session

The Institute of Internal Auditors (IIA), Bombay Chapter Page 25


9.

Packing a
Punch

The CAE personally participates in all audit closure meetings irrespective of time
and distance challenges. This means that the highest level in the Auditee
department also has to participate and commit to the management action plans.
Such a level of personal attention from CAE ensures quality reporting and timely
completion.


10.

On time
reporting

The Head of Audit has started a new practice of encouraging team members to
issue final audit report prior to exiting the audit site. The audit report is issued
within 2 days from the audit closure.


11.

Balancing Audit
Resources with
Organisational
Audit
Requirements

The Chief of Internal Audit has gradually shifted the audit execution from
functional and department audits to Process Audits. The Process Universe of the
company has been classified into Core & Non Core processes. The
contemporary audit planning approach is to bucket the existing processes into
three categories viz., Vital, Essential and Desirable.

The process rating and bucketing is undertaken on the basis of:

Criticality/ Core or Non-Core to business
Risk Profile High, Medium or Low
Materiality Impact on financial statements

The coverage of the processes is determined through a fixed criteria:

Vital - All Vital processes to be reviewed during a financial year
Essential Atleast 50% of Essential processes to be reviewed during a
financial year
Desirable Atleast 33% of Desirable processes to be reviewed during a
financial year

The Institute of Internal Auditors (IIA), Bombay Chapter Page 26



12.

Overcoming the
Audit
Coordination
Monster

The Internal Audit Department (IAD) has established a unique Assurance
Champion initiative at the company. Under this initiative a pool of experienced
line managers are identified from various departments across the organisation
who play the role of Audit Coordinators and act as the bridge between the
auditors and auditees. Each Assurance Champion plays out his assigned
coordination role on the audit mission. Since there is an independent coordinator
the audit project is executed smoothly and in a time bound manner. The
Assurance Champion is rated by the IAD and the Head of Department (HOD)
and suitably recognised and rewarded once a year by the Managing Director.


13.

Setting the
Tone

The Chairman of the Company studies each mail/ request marked to his attention
by the Chief Audit Executive and personally responds to the situation. Where the
mail is an escalation of a control issue the Chairman of the Company calls up the
concerned Auditee department to seek a response thereby demonstrating the
seriousness of the matter.


14.

Audit
Philosophy

The Board Members of the company have set a simple philosophy for the
Internal Audit function to follow that is Be Proactive on Controls and Partner with
the Business to avoid surprises. This is executed through proactive involvement
of the Internal Audit function in all major business projects and change
management initiatives the internal audit team participates by reviewing
controls while the new business initiatives are being implemented.


15.

Process
Alignment

The Internal Audit team has carved out a two member SOP and Authorisation
Design team called the Methods Team. This special team continuously studies
the business process changes and updates the SOP documentation thereby
keeping the documents Live to current business realities. The Internal Audit
team prior to field work commencement undertakes a process walkthrough using
the SOP and process templates designed by the Methods Team. This practice
aligns the Internal Audit efforts to existing business processes making the
outcome more meaningful.


The Institute of Internal Auditors (IIA), Bombay Chapter Page 27

6. ACKNOWLEDGEMENTS

Name of Participating CAEs and Companies

The IIA, Bombay Chapter and the research partner VERITA warmly acknowledges the
contributions made by the following participants in this research effort.

Sr.No. Company Name Participants
1. Aditya Birla Financial Services A. Dhananjaya
2. Cross Tab Prashant Bhatt
3. Aamby Valley Ltd. Rohit Somani
4. A leading Life Insurance Company Head of Audit
5. Cnergyis Infotech India Pvt Ltd Venkat Balan
6. US based firm Harish Iyer
7. Edel Cap Nikhil Johari
8. Enercon India Ltd. V. Jambunathan
9. Leading manufacturer of Oleochemicals EVP Corp Audit & Assurance
10. A leading AMC Head of Audit
11. Leading private sector bank Chief Audit Executive
12. Blue Dart Aneel Gambhir
13. L & T Satish Shenoy
14. Gujarat based firm Parag Adhiya
15. A leading ITES/ BPO Head of Audit
16. Leading Financial Service Company Chief Risk Officer
17. Reliance Life Insurance Company Limited Sunder Krishnan
18. Sahara India Group Sushil Gupta
19. A leading General Insurance Company Head of Audit
20. Tata Capital Ltd S. Bhaskar
21. Tata Motors Limited Nagesh Pinge
22. TATA Power Parshuram Date
23. Telavance Inc Uday Gulvadi
24. Union KBC Asset Management Company
Private Limited
Padmaja Shirke
25. Leading Telecom player in India Smitesh S Bhosale
26. Voltas Ltd Jyotin Mehta
27. Retail Stock Broker /financial service
company
Asst. Vice President
28. A French MNC Head of Finance & Audit
29. Volkswagen Finance Private Limited Gopal Gattani
30. HDFC LIMITED Arjun Gupta

The Institute of Internal Auditors (IIA), Bombay Chapter Page 28


Disclaimer: The material is prepared with due care, however, any reliance should be placed only after
consultation with the publication team. The contents of this material are for information purposes only and
should not be construed as solicitation or advice in any manner whatsoever. No one should act upon the
information provided in this material without appropriate professional advice. While the Institute of Internal
Audit (IIA) and its research partner - Verita Management Advisors Pvt. Ltd. (VERITA) strives to ensure
that the information contained herein is accurate, timely and reliable, we do not make warranties or
representations, express or implied, including the warranty of merchantability and fitness for a particular
purpose, or assumes any liability or responsibility for the accuracy, completeness, reliability, timeliness or
usefulness of the information provided in this material.
This information is not intended to create, and receipt of it does not constitute, an advisor-client relationship.
You acknowledge and agree that all proprietary rights in the material shall remain the property of IIA and
VERITA. The modification, reproduction, redistribution, disclosure, display and transmission of any
information contained herein or deriving commercial use or benefit from the material is strictly prohibited. IIA
and VERITA shall accept no liability for any damages, claims or losses of any nature, arising indirectly or
directly, from the use of the data or material or otherwise howsoever arising.
Research Partner
Contact Us:
IIA Bombay Chapter
209, Sagar Avenue, 2
nd
Floor, Above ICICI bank Limited,
SV Road, Andheri (West), Mumbai 400 058

Verita Management Advisors Pvt. Ltd.
441, Kirankunj Society, Bhadran Nagar, SV Road,
Malad (west), Mumbai 400 064