Creating a World Class Internal Audit Function

18 December 2012 Georgiana Iancu (Timofte), KPMG Romania Claudiu Mateescu, OMV-Petrom

The secret uncovered

To gain a better understanding of what makes leading IA departments world class,

KPMGs global IA partners analyzed the IA functions at leading companies around the world.

The research findings uncovered the importance of maintaining the right balance of:
Positioning How is IA perceived within the organization? People Does IA have a broad mix of skills and experiences in order to fulfill its
mission and charter?

Processes Are there robust and formal processes in place that align IA with
corporate strategy?

2012 KPMG Romania S.R.L., a Romanian limited liability company and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (KPMG International), a Swiss entity. All rights reserved.

Benefits of creating a world class internal audit function

The internal audit (IA) function can help the organization tighten controls, reduce risks, identify potential efficiencies, and realize cost benefits

Achieving a world class level can lead to multiple corporate benefits and competitive advantages

Enhanced riskmanagement processes Strengthened relationships with key stakeholders

Improved control environment

Greater efficiencies across key governance, risk, and compliance (GRC) activities

Identified process improvements, cost reductions, and enhanced profitability

2012 KPMG Romania S.R.L., a Romanian limited liability company and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (KPMG International), a Swiss entity. All rights reserved.

Positioning
Positioning People Processes

Is recognized by business leaders as a function providing quality challenge Has sound understanding of business strategy and the associated risks Has an integral role in the governance structure (as the third line of defense) which is clearly aligned with its stakeholders

Drivers and Mission

Is structured so as to enable both the maintenance of independence and objectivity, as well as proximity to the business so as to establish and maintain relationships with and comprehensive understanding of the business

The perception Many IA functions suffer from a negative perception, due to their focus on compliance issues over operational and strategic business issues.

Organization Structure

Stakeholders and Services

Is characterized by strong relationships at the highest levels Has a regular presence in major governance and controls forums/ committees through the organization
3

2012 KPMG Romania S.R.L., a Romanian limited liability company and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (KPMG International), a Swiss entity. All rights reserved.

People
Positioning People Processes

Competencies

Culture

Contains a diverse and sufficient talent pool with a broad mix of skills and experience gained within internal audit and in business, within and outside the organization Has an effective means of improvising, adapting, and delivering under all circumstances

The talent pool composing the IA function should be diversethere should be a broad mix of skills and experiences from IA activities and from across the spectrum of the business.

Is characterized by a culture of challenge, probing, and continuous improvement

Staffing Strategy

Has a vision for medium- and long-term staffing strategies that stay ahead of growth areas and on top of new and emerging risks Is able to develop its personnel through comprehensive training and development and advanced knowledge management

2012 KPMG Romania S.R.L., a Romanian limited liability company and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (KPMG International), a Swiss entity. All rights reserved.

Processes
Positioning
Has a clearly defined audit
universe with appropriate granularity, which aligns with organizational requirements Is forward-looking in its risk assessment process and has a strategic (2- to 3-year) plan in place Continually monitors its processes and stays abreast through an integrated quality assurance and learning program

People

Processes
Is subject to regular Has defined and maintains
review of its effectiveness

Risk Assessment and Planning

Performance Measurement

a variety of measures of its own performance which are regularly reviewed and acted upon Has mechanisms to obtain independent stakeholder feedback

Execution

It is critical that the IA function be supported and empowered by robust and formal processes enabled by technology and aligned with corporate strategy.

Follow-Up

Conducts audit activities in

order to form an opinion on the state of the existing control environment Harnesses technology throughout its audit and administrative processes Has a strong control and reporting mechanism Maintains strong quality assurance (QA) procedures

Reporting

Has effective
mechanisms in place for action tracking and follow-up

Focuses on trends and emerging issues Produces reports that identify both root
causes and consequences of issues
5

2012 KPMG Romania S.R.L., a Romanian limited liability company and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (KPMG International), a Swiss entity. All rights reserved.

Getting it right

Why be world class? Companies that are able to evolve their IA functions to embody these world class attributes can gain a significant competitive advantage. A self-sustaining cycle Organizations that can get this right will often find that they are able to create a self-sustaining cycle: their world class status attracts more high-quality individuals, greater support from senior management, and wider acceptance, and collaboration within the organization.

The investment For many organizations, initiating this transformation requires hard work, regular investment, and clear insight into the gap between their current state and that of a world class IA organization.

2012 KPMG Romania S.R.L., a Romanian limited liability company and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (KPMG International), a Swiss entity. All rights reserved.

Thank you!
Georgiana Iancu (Timofte) Senior Manager, Internal Audit Services, KPMG Romania atimofte@kpmg.com Tel. 0743 139 405

 2012 KPMG Romania S.R.L., a Romanian limited liability company and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (KPMG International), a Swiss entity. All rights reserved.

The KPMG name, logo and "cutting through complexity" are registered trademarks or trademarks of KPMG International Cooperative ("KPMG International").