Auditing Strategic Risks

Practical Insights from Internal Audit Leaders

A CBOK Stakeholder Report J. Michael Joyce Jr.

CIA, CPA, CRMA

CBOK
The Global Internal Audit
Common Body of Knowledge
 About CBOK
STAKEHOLDER STUDY
FACTS The Global Internal Audit Common Body of Knowledge (CBOK) is the
Survey participants 1,124
world’s largest ongoing study of the internal audit profession. The current
Interview participants 112 CBOK study has two major components: practitioner and stakeholder. The
Countries 23 practitioner study encompasses reports that explore a variety of internal audit
Languages 13 practices. To complement this information, the stakeholder study seeks out
STAKEHOLDER POSITIONS
perspectives from stakeholders about internal audit performance. Surveys,
REPRESENTED interviews, and data analysis for the stakeholder project were conducted by
Board member 34%
Protiviti in partnership with IIA institutes around the world. Stakeholder
Chief executive officer reports focus on identifying leading practices that can improve internal audit
(CEO) 15% effectiveness.
Chief financial officer CBOK reports are available free of charge thanks to generous contributions
(CFO) 18%
Other C-suite 33%
and support from individuals, organizations, IIA chapters, and IIA institutes
worldwide. Practitioner and stakeholder reports are available for download at
the CBOK Resource Exchange (www.theiia.org/goto/CBOK). Stakeholder
reports are also available at the Protiviti website (www.protiviti.com).

CBOK 2015 Stakeholder Study: Participants from 23 Countries

Russia
Netherlands

Canada United
Kingdom Poland
France Germany
Italy
Spain Turkey China Japan
United States

India Taiwan
Mexico United Arab
Emirates Hong
Kong
Malaysia
Singapore

Brazil
South Australia
Africa

Note: Twenty-three countries participated with the Internal Audit Foundation, formerly the IIA Research Foundation (IIARF), and
Protiviti to distribute surveys and interview questionnaires to stakeholders in their region from July 2015 to February 2016. Partially
completed surveys were included in the analysis as long as demographic questions were complete. Questions in CBOK reports are
referenced as Q1, Q2, and so on. The colors on the map show the seven global regions (based on World Bank categories) used for
CBOK studies.

2 ● Auditing Strategic Risks

About the CBOK 2015
Global Stakeholder Study
This report is part of the Internal Audit Foundation’s
2015 Common Body of Knowledge (CBOK) Global
Stakeholder Study. One of the key findings in this study
is that nearly two-thirds (64 percent) of stakeholders –
board members, CEOs, CFOs, CIOs, CROs and more
– want internal audit to be more active in strategic risks.
As a follow-up initiative in this ongoing study, chief audit
executives (CAEs) from across multiple industries were
interviewed to gain insight on how they are more active
in strategic risks focused on three common areas – cyber-
security, IT projects, and capital projects. The insights of
these audit leaders, whom we cite throughout our report
without attribution in exchange for their candid feedback
and views, inform our discussion.

Contents

Introduction: Familiar and Fascinating Insights into Auditing Strategic Risks . . . . . 4

Cybersecurity Does Not Exist in a Vacuum . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

IT Projects: Scrutinizing Data, Development, and Behaviors . . . . . . . . . . . . . . . . . . . . 7

Capital Projects: Process Is Everything . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

Four Enablers Behind Leading Internal Audit Functions. . . . . . . . . . . . . . . . . . . . . . . 10

Final Thoughts: Assurance Before Advisory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

www.theiia.org/CBOK ● 3
Introduction: Familiar and Fascinating risk-based auditing approach, internal audit’s credibility in
Insights into Auditing Strategic Risks the eyes of business partners, and the function’s capacity to
thrive in an advisory manner. These critical building blocks
“We keep an eye on the assumptions – those that have existed within top-performing audit functions for some
initially drove the strategic initiative and those that time.
continue to drive the initiative as it progresses. Do those Two other takeaways emerged from this dialogue,
assumptions remain relevant?” as well, that are more unexpected. First, internal audit
functions are making significant progress in how they
The insights on leading practices shared by CAEs are by audit and address strategic risks by leveraging a broad
turns familiar and fascinating when these leaders open range of approaches (as we review in the cybersecurity, IT
up about how their internal audit functions work with projects, and capital projects sections). Second, leading
management and the board to address three specific areas internal audit functions work diligently, and inventively,
of strategic risk for their organizations: cybersecurity, IT to validate their seat at the decision-making table, their
projects, and capital projects. function’s credibility, and their advisory role through
The familiarity stems from the risk-based approach specific enablers (which are summarized in the final part
of audit leaders for these strategic risk areas, as well as what of this report).
they say about the underlying enablers of effective “strategic The interviews conducted served a dual purpose:
auditing” – an activity that more board members, CEOs, by describing how they address strategic risks, leading
CFOs, and other C-suite executives are encouraging internal audit executives highlighted ways they nurture the
audit to perform. CAEs consistently point to the value of function’s role as a strategic partner to the business,
internal audit’s early involvement in strategic initiatives, its without jeopardizing, first and foremost, their focus
on compliance and assurance responsibilities.

4 ● Auditing Strategic Risks

Cybersecurity Does Not Exist
in a Vacuum Strategic Risk Auditing Best Practices:
CYBERSECURITY

“Cybersecurity has to work like all the systems and parts • Engage with those who set and shape
cybersecurity strategy.
of a human body work together to defend against threats
and to make it work efficiently. It’s not a stand-alone • Clarify and coordinate with others on
cybersecurity risk responsibilities.
process. There is not a single element of our company
that does not affect cybersecurity.” • Conduct a formal risk assessment.

• Advise on cybersecurity frameworks,

One CAE responded immediately when asked how standards, and guidance.
auditing a massive capital project underway in a war-torn • Assess cyber resiliency.
region compared to auditing cybersecurity: “Our capital • Learn continuously.
project is not as complex and not as daunting.”
• Own the cybersecurity skills and expertise
Audit committees are pressing for updates on the challenge.
organization’s ability to address cybersecurity, an over-
whelming strategic risk. CAEs are responding through
multiple avenues such as sharpening their view of ●● Clarify and coordinate with others on cyber-
organizational cybersecurity through formal risk assess- security risk responsibilities: CAEs work closely
ments and first-hand involvement in cybersecurity steering with their partners in the IT, information security
committees and exercises; increasing and expanding and ERM groups to identify the specific cyber-
cybersecurity-related areas in audit plans; and aligning their security activities each group is conducting.
risk management activities with IT, information security, This coordination helps synchronize all efforts
and enterprise risk management (ERM) functions. in an organization regarding cybersecurity, while
Overall, the CAEs interviewed cited the following reinforcing internal audit’s role in providing
activities and best practices most frequently when describing objective, independent assurance on cybersecurity
what drives their effectiveness in auditing cybersecurity: risk. One CAE conducts, with his CIO,
presentations of cybersecurity risks to the
●● Engage with those who set and shape cyber- audit committee to demonstrate that “we’re
security strategy: While emphasizing that their working in a coordinated manner based on a
functions conducted identity management, common risk-evaluation approach.”
patch management, and many other forms of
cybersecurity auditing long before the term ●● Conduct a formal risk assessment: Formal
“cybersecurity” took on its current meaning and risk assessments – whether performed by internal
import, audit leaders report that they have more audit or a third-party expert – are a crucial
recently sought out advisory roles with committees part of a cybersecurity regimen. These evaluations
responsible for setting and strengthening organi- identify gaps, clarify improvement and
zational cybersecurity strategies and capabilities. remediation priorities (e.g., addressing a major
Another option to consider, as one CAE noted: increase in phishing emails), help determine
“Work with the audit committee to create a cybersecurity facets of the audit plan,
dedicated cybersecurity subcommittee, reporting influence cybersecurity advisory work, and
to the audit committee, that consists of outside help the organization align on its cybersecurity
experts who can provide relevant input on risks and improvement objectives.
critical and timely cybersecurity issues.”

www.theiia.org/CBOK ● 5
 ●● Advise on cybersecurity frameworks, researching cybersecurity … [as an example],
standards, and guidance: Every CAE mentioned I want to know exactly how Equifax was
one or more sets of cybersecurity standards that breached.” This same leader also exhorts his
their organization uses – and almost always team to understand the mindset of a wide
customizes – to help structure the overall range of stakeholders who could expose,
cybersecurity program and related assurance knowingly or unwittingly, his company to a
activities. These standards include the NIST cybersecurity threat. “Internal audit needs to
Cybersecurity Framework, ERM, HITRUST, understand a hacker’s thought process and
COBIT, ISO, The IIA’s Global Technology methodology,” he said. “An internal auditor
Audit Guide (GTAG): Assessing Cybersecurity has to be able to think like an accountant, an
Risk: Roles of the Three Lines of Defense, investor, a lawyer, a compliance specialist,
CSC20, FFIEC, and more. One CAE who a salesman, a human resource executive –
applauds the ERM framework for numerous anyone who might create a risk that exposes
benefits – including the consistency, transparency, the company to a cybersecurity lapse.” And part
and board exposure to cybersecurity risk it of the function’s assurance work relates to the
enables – also emphasizes that the framework effectiveness of cybersecurity training and
“may not be sufficient in India, Australia, or awareness conducted throughout the organization.
other geographies, for example … where other
cybersecurity risk management models are ●● Own the cybersecurity skills and expertise
used. We’ve taken what we believe is best from challenge: Most CAEs confirm that hiring
all of the models and applied them to meet and retaining internal auditors with IT and
our global needs.” CAEs’ direct involvement in cybersecurity expertise is a challenge. They
the discussion and evaluations of each of the address this obstacle via talent management
potential frameworks, and their advantages and strategies and tactics, including making
disadvantages, positions internal audit to help investments in training and development, using
their organizations gain the most value from external experts, and working closely with human
the frameworks. resources colleagues to design recruiting,
performance, and retention incentives.
●● Assess cyber resiliency: Accepting the fact that,
in today’s environment, a breach is inevitable,
CAEs should assess the organization’s ability
to respond, communicate, and recover when a
breach does occur. Areas to consider include not
only business continuity procedures, but also
communications and crisis management plans.

●● Learn continuously: Knowledge – of external

threats, emerging standards, new compliance
requirements, and even psychological profiling
– is a crucial driver of cybersecurity auditing
success. “I am a CISSP,” noted one CAE, “and
I spend a large amount of time studying and

6 ● Auditing Strategic Risks

IT Projects: Scrutinizing Data,
Strategic Risk Auditing Best Practices:
Development, and Behaviors
IT PROJECTS

“If people think cybersecurity and IT projects are • Develop a structured, multiphased
separate, they’re misled.” assessment process.

• Remove behavioral barriers.

As more companies go all-in on digital transformation • Create advisory offerings to complement
and as more IT systems and applications migrate to the assurance work.
cloud, a larger collection of IT projects of all sizes and • Recognize the need to address Agile
scope qualify as strategic risks. As a result, a much wider development.
variety of IT projects and application development activities
require auditing scrutiny.
This scrutiny can help the internal audit function, as
second category that focuses more on traditional
well. One CAE recalls a major software implementation
IT project management methodology, governance,
that concerned his IT auditors because the third party
and efficiency.
responsible for testing the system did not provide sufficient
clarity around its test results. “We stepped forward, and ●● Remove behavioral barriers: One CAE
we had the facts to support our assertion that we were not
detailed how a team of IT auditors discovered
comfortable with the testing results and, therefore, that we
numerous instances where IT project teams
were not prepared to provide sign-off,” he explains. His
downplayed, or downright obscured, problems
team’s thorough documentation convinced the company
that arose. The internal audit group subsequently
that additional testing was needed prior to the system
revamped its communications with those
going live. “That helped us, as a function, to establish our
project teams. “Once we saw that they were
presence,” the executive continues. “Since then, the soft-
unwilling to bring forward important issues, we
ware testing lifecycle has continued to improve.”
worked on getting them more comfortable doing
Similar types of detailed scrutiny and fact-based forti-
so,” explained the audit leader. “Regarding the
tude figure prominently in the areas audit leaders identify
red, yellow, green evaluation system, we started
as driving effectiveness in auditing IT projects:
a new mantra: ‘Red is not dead.’” The IT
audit team also made a clear business case for
●● Develop a structured, multiphased assessment
the benefits of surfacing and fixing problems
process: CAEs stress the value of developing
sooner in the project lifecycle rather than later,
and improving the structured evaluations for
when the impacts and costs of small issues can
each phase of an IT project. Given the grow-
be much greater.
ing amount, value, and importance of data
involved in new implementations and system
conversions, security is frequently identified
as a starting point for the project assessment.
One CAE explained how her IT audit teams
now organize IT project engagements into two
groups: one focused on system conversions that
involve financial controls and require input
from both IT and financial auditors; and a

www.theiia.org/CBOK ● 7
 ●● Create advisory offerings to complement ●● Recognize the need to address Agile
assurance work: One IT audit group has development: Many CAEs we talked with
developed an advisory offering consisting of are currently determining how to address
the higher-level criteria IT auditors assess when risks associated with Agile development
conducting a formal audit of an IT project (for methodologies that more IT functions are
example: Do we have an implementation strategy? embracing. Although this highly collaborative,
Who is our sponsor? Is funding approved? iterative, and streamlined software development
What are the known project risks? What approach greatly reduces the time it takes to
contingency planning is needed?). Once the IT create new applications and indirectly improves
auditors and IT project teams work through organizational agility and speed to market, an
the list of questions, the IT auditors provide Agile methodology poses risk-related challenges.
recommendations, as opposed to formal “From an audit perspective, we have to figure
management action plans. “It’s been very well out things like requirements traceability,
accepted,” says the CAE. “Today, they rarely whether development teams are obtaining
need this service from us because they do this the correct approvals on design, and more,”
on their own through the steps we documented says an auditing executive. “It can benefit
and shared.” organizations, but it also poses new risks.”

8 ● Auditing Strategic Risks

Capital Projects: Process Is Everything
Strategic Risk Auditing Best Practices:
“We audit the process, not the person.” CAPITAL PROJECTS

• Get involved early in planning.

CAEs whose functions conduct audits and assessments of
• Focus on the underlying rationale for the
large capital projects tend to emphasize the importance
investment.
of two distinctions. First, they say it is important to
• Deploy specialized expertise.
differentiate monitoring the health and progress of each
capital project, which is management’s responsibility, and • Conduct rigorous, process-focused project
reviews.
the assurance that internal audit delivers. Second, leading
CAEs distinguish between their work on individual capital • Consult on capital project management
improvements.
projects and the need to assess their organization’s overall
capital project management capability. The latter can • Perform postmortem audits and reviews.
greatly help the former.
CAEs cited the following activities and best practices
as particularly helpful in driving the effectiveness of their “We ask, ‘What facts did you rely on? If you
capital project assurance and advisory work: conducted modeling, how do you know the
models are accurate? How do you know the
●● Get involved early in planning: While formulas have integrity? Is projected return on
internal audit’s early involvement in any strategic investment confirmed/validated?’”
initiative is an advantage to the organization,
this is particularly the case with, for example, a
●● Deploy specialized expertise: One CAE
$500 million, multiyear, ground-up construction recently hired an external construction auditor
project on the other side of the world. This to conduct a detailed review of the general
involvement often leads to early-stage risk contractor’s invoices on a type of building that
assessments that focus heavily on project the company had never previously constructed.
governance structures. One such risk assessment, “That investment,” he notes, “enabled us to
a CAE reports, resulted in fundamental changes, ask technical questions that only someone who
including to the role of the engineering group, had experience with that type of construction
procurement group, and construction contractor project would know to ask.” Other leaders
(and who filled it), that altered the trajectory hire and retain internal auditors with extensive
of the work. capital projects and construction experience –
they know what issues to look for and possibly
●● Focus on the underlying rationale for the challenge as they walk job sites, attend project
investment: Many capital projects take years meetings, and verify status reports.
to reach completion and the assumptions
underpinning the decision to make the invest-
●● Conduct rigorous, process-focused
ment can change over time. As part of capital project reviews: In most cases, capital project
project audits, one CAE and his team identify audits are comprehensive and highly manual.
which data sources are being used to validate the Governance assessments determine whether
decision-making assumptions. “We selectively test project steering teams are focusing on relevant
where it makes sense and where it is practical risks and receiving correct, complete, and
for us to test those assumptions,” he continues. timely information. Assessments of completion

www.theiia.org/CBOK ● 9
 progress and budgets require reviews of Four Enablers Behind Leading Internal
massive volumes of information – supporting Audit Functions
documentation accompanying the general
contractor’s application for payment tends to be In addition to the specific items identified above,
particularly thick. While a rigorous approach is comments and insights from CAEs reveal a number of
absolutely necessary, CAEs consistently stress underlying enablers that are pivotal to the success of strategic
the need to make it clear to project managers that auditing activities. These qualities are present in each of
the audit is centered on processes as opposed the audit functions helmed by the CAEs interviewed.
to individuals. Striking this balance requires
auditors to translate risk, internal controls, and
other auditing nomenclature and perspectives Four Key Enablers:
into terms that resonate with time-pressed 1. Ongoing demonstrations of value
project managers. 2. Access

3. Common language
●● Consult on capital project management
4. Participation
improvements: One internal audit function
has developed an advisory offering that capital
project teams can use at the onset of a new
1. Ongoing demonstrations of value: Most CAEs
initiative. The service provides guidance on key
describe an origin story of their internal audit function’s
operational controls, financial controls, and
acceptance as a strategic assurance and advisory partner to
project risks the team should consider, along
the business. Like flashbacks in a movie that uncover how
with fraud-awareness and prevention training
superheroes gained their otherworldly powers, these
related to contractor billing activities. “In this
descriptions pinpoint the circumstances under which
role, our goal is to be a risk adviser and strategic
internal audit’s actions transformed the way that C-level
partner without getting in the way of early
executives, board members, and process owners view
deadlines and a successful implementation,”
their internal audit function. More notably, internal audit
says the CAE. Another internal audit group
leaders stress that their function’s hard-earned reputations
participates in a strategic initiative centered on
must be nurtured and sustained through ongoing
improving the company’s capital project man-
demonstrations of value. New leaders and process owners
agement capability and, specifically, how return
continually join the organization – sooner or later, they
on investment is measured and monitored. In
seek evidence that internal audit’s credibility is warranted.
this organization, the internal audit function’s
role is to ensure that appropriate controls are
2. Access: Demonstrations of the internal audit function’s
built into new processes the team develops.
value along with the CAE’s commitment to ongoing
relationship-building grant these leaders important “hall
●● Perform postmortem audits and reviews:
pass” access to board members, C-level executives, and
The results of these activities can provide
process owners throughout the enterprise. This access
valuable feedback on the validity of original
translates into valuable knowledge of what is happening
assumptions used to justify the capital project
throughout the organization and what strategic shifts and
and enhance approaches for future projects,
initiatives may be on the horizon.
including the possible engagement of internal
audit earlier in the project.

10 ● Auditing Strategic Risks

3. Common language: It is striking how many CAEs Final Thoughts: Assurance
mentioned the importance of translating the term “internal Before Advisory
controls” into terminology that IT functions, the CISO,
the capital project manager, and other process owners can Although CAEs describe an interesting collection of
understand in their context. “We altered the definition of advisory services their functions deliver to help the
internal controls,” said one audit executive, “to mean those organization address strategic risks, they also emphasize –
processes that move whoever you are – a plant, a function, in no uncertain terms – that assurance work always
a location – toward your goals.” CAEs emphasize a need comes first.
to translate all of the function’s work into practical, This anecdote may say it all: After a few weeks on the
well-understood terms that hold meaning for stakeholders job, a newly hired senior auditor asked her CAE why the
in their environments. function did not more actively promote its growing
collection of advisory services. His response clarified
4. Participation: Leading audit functions tend to be the function’s priorities: Rather than lead with advisory
highly active and participatory. They join tabletop incident services, he explained, “I’d rather have the people that
response activities designed to expose cybersecurity lapses. we’ve done business with on the assurance side, who
They spend meaningful time on shop floors and construction understand our value, ask us to do advisory services. I
sites. “We conduct network penetration testing as part of think that’s how you want to bring customers in.”
our audit plan,” said one CAE. “That gives us a better
grasp of vulnerabilities and how management is addressing
them.” That information, which the leader shares with the
board, helps makes her cybersecurity risk updates more
tangible for the audit committee.

www.theiia.org/CBOK ● 11
 About the Author

J. Michael Joyce Jr., CIA, CPA, CRMA, FAHM, is the Vice President, Chief Auditor
& Compliance Officer for the Blue Cross Blue Shield Association (BCBSA), a national
federation of 36 independent, community-based and locally operated Blue Cross and
Blue Shield companies. The Blue System is the nation’s largest health insurer covering
more than 107 million members — one in three of all Americans. Joyce directs the
internal audit, national anti-fraud and compliance staff functions for the association.
He has 35 years of professional experience and has been with BCBSA since June 1999.
He has been an active IIA volunteer since 1989.

About the Internal Audit Foundation

CBOK is administered through the Internal Audit Foundation, which has provided
groundbreaking research for the internal audit profession for the past four decades.
Through initiatives that explore current issues, emerging trends, and future needs, the
Foundation has been a driving force behind the evolution and advancement of the
profession. The Foundation may be contacted at 1035 Greenwood Blvd., Suite 401,
Lake Mary, Florida 32746, USA.

About Protiviti Inc.

Protiviti is a global consulting firm that delivers deep expertise, objective insights, a tailored
approach, and unparalleled collaboration to help leaders confidently face the future.
Protiviti and our independently owned Member Firms provide consulting solutions
in finance, technology, operations, data, analytics, governance, risk, and internal audit
to our clients through our network of more than 70 offices in over 20 countries.
Your We have served more than 60 percent of Fortune 1000® and 35 percent of Fortune
Donation Global 500® companies. We also work with smaller, growing companies, including those
Dollars at looking to go public, as well as with government agencies. Protiviti is a wholly owned
Work subsidiary of Robert Half (NYSE: RHI). Founded in 1948, Robert Half is a member
CBOK reports are
of the S&P 500 index.
available free to Protiviti is not licensed or registered as a public accounting firm and does not issue opinions
the public thanks to
generous contributions
on financial statements or offer attestation services.
from individuals,
organizations, IIA Limit of Liability
chapters, and IIA
institutes around The Internal Audit Foundation publishes this document for information and edu-
the world. cational purposes only. The Internal Audit Foundation does not provide legal or
accounting advice and makes no warranty as to any legal or accounting results through
its publication of this document. When legal or accounting issues arise, professional
Donate to assistance should be sought and retained.
CBOK Copyright © 2018 by the Internal Audit Foundation, formerly The Institute of Internal
www.theiia.org/CBOK Auditors Research Foundation (IIARF). All rights reserved. For permission to reproduce
or quote, contact [email protected]. ID #2018-0722