Transcript Slide 1

www.pwc.com
Moving forward with
combined assurance
IMFO Audit & Risk Indaba
28 October 2011
[email protected]
Discussion topics
1.
The source of the combined assurance concept
2. Objectives and tangible benefits
3. The challenges
4. The models to consider
5. A five step practical approach
6. Where to from here…………..
Combined assurance and corporate governance
PwC
October 2011
2
1. The Source - King III introduces combined
assurance as a recommended governance practice
Combined assurance model
“3.5. The audit committee should
ensure that a combined assurance
model is applied to provide a
coordinated approach to all
assurance activities”
“7.3.1. Internal audit should form an
integral part of the combined
assurance model as internal assurance
provider.”
Combined assurance and corporate governance
PwC
October 2011
3
2. The objectives
1. A combined assurance model aims to optimise the assurance coverage
obtained from management, internal assurance providers and external
assurance providers on the (key) risk areas affecting the company.
2. The combined assurance provided by internal and external assurance
providers and management should be sufficient to satisfy the audit
committee that significant risk areas within the organisation have been
adequately addressed and suitable controls exist to mitigate and
reduce these risks.
What are we often faced with?
•
Risks not being covered/ covered too much
•
Audit fatigue
•
Limited assurance budget (especially for internal audit?)
Combined assurance and corporate governance
PwC
October 2011
4
2. Combined assurance offers tangible benefits
that extent beyond compliance
• Coordinated and relevant assurance efforts focusing on key risks
• Comprehensive and prioritised tracking of remedial actions
• Minimised business/operational disruptions
• Improved reporting to the board and committees, including
reducing the repetition of reports
• Possible reduced assurance costs or expansion in scope
• The use of combined assurance to support the audit committee and
board in making their control assessment statements in the
integrated report (IFC’s and systems of internal control)
Combined assurance and corporate governance
PwC
October 2011
5
3.
1.
The challenges and critical success factors
Executive sponsor
2. Combined Assurance champion – the driver
3. Relevant and accurate risk information – ERM Maturity
4. Agreeing on a framework, methodology, risk language, enabling
technology
5. Evaluating the quality of assurance provided and to whom
6. Deciding on the desired level of assurance from which
assurance provider (link to risk appetite and tolerance)
7.
Communication and training throughout the organisation
8. Clear understanding of the plan, its objectives, processes, and
outputs
Combined assurance and corporate governance
PwC
October 2011
6
3.
The challenges and critical success factors
Combined assurance and corporate governance
PwC
October 2011
7
4.
Market Models – What we see…
 New market challenge
 IFC’s and overall controls
 Who drives the combined assurance initiative
Combined assurance and corporate governance
PwC
October 2011
8
5. Combined assurance is one the biggest
challenges in adopting King III
A practical five-step approach to implementing an effective
combined assurance approach
1.
Establishing the business case
2. Assess the actual assurance provided – Reality check
3. Detailed mapping of risks to assurance providers
4. Design Combined Assurance blueprint
5.
Make Combined Assurance a reality
Combined assurance and corporate governance
PwC
October 2011
9
1. Gain high-level understanding of the current
Assurance Profile
Assurance is provided by 3 Lines of Defence:
• Line#1 - Management oversight e.g. performance measurement, risk
management, control self-assessment.
• Line#2 - Enterprise risk management, legal, compliance, health and
safety, quality assurance.
• Line#3 - Internal audit, external audit and other credible assurance
providers.
Management oversight will be factored into combined assurance where
no second and third lines of defence are considered appropriate in the
combined assurance model
The business case is established through getting an overview status of
the assurance profile
Combined assurance and corporate governance
PwC
October 2011
10
Example Assurance Profile
Three lines of defence assurance providers
Processes
First line of defence Management
Control
self
assess
Mgt review
Special
project
Second line of defence – Risk
and legal based assurance
Third line of defence –
Independent assurance
ERM
External
audit
SOX
Compliance
Internal
audit
Special
project
Strategic
Funding
Sustainability
Growth
Operational
Treasury
Products and
services
Finance
Extensive assurance
Combined assurance and corporate governance
PwC
Moderate assurance
Inadequate assurance
Not applicable
October 2011
11
2. The assurance reality check
Identify the assurance providers
― Internal and external audit
― Human Capital
― Risk Management
― SOX Compliance
― Compliance
― ISO
― Information security
― Insurance
Assessment of the assurance providers
• Skill and experience levels
• Scope and frequency of work will address the risks
• Acceptable approach/methodology
• Conflict of interest
• Quality reviews
Combined assurance and corporate governance
PwC
October 2011
12
2. The assurance reality check
Example of ranking of assurance
Rating
Extensive
Assurance
Moderate
Assurance
Limited
Assurance
Description/Characteristics guidance
Scope of work covers entire process area
Period of the work performed covers more than half the
year
Positive opinion or certification is provided
Accredited assurance provider
Scope of work covers part of the business process
Work performed covers less than 6 months of the
period under review
Limited assurance statement provided
Scope of work covers a very specific part of the
business process
Work performed is for a period less than 3 months or is
at a point in time
No certification or assurance statement provided (e.g.
factual findings with recommendations)
Combined assurance and corporate governance
PwC
October 2011
13
2. The assurance reality check
Assess quality of assurance:
• Interviews with the recipients of the assurance
• Identify the assurance sponsors for forward consultation
Assessment of current state of assurance reporting:
• Assurance may not reach appropriate forum
• Some forums do not receive any assurance
• Certain governance committees are overburdened
• Certain agenda items are debated in multiple forums
INTERNAL AUDIT CAN DO THIS !
Combined assurance and corporate governance
PwC
October 2011
14
Example – Current state of assurance reporting
Combined assurance and corporate governance
PwC
October 2011
15
3. Detailed mapping of risks to assurance
providers
Establish the universe for Combined Assurance:
• A consistent risk assessment approach should exist – ERM
Maturity Profile
• Use strategic and key business unit risk profiles (start top 20
inherent?)
• Map the different lines of defence to the detailed risks and
controls
• Determine the desired level of assurance
• Identify the gaps and the “excess assurance”
• Use risk management software to allow analysis and reporting
INTERNAL AUDIT CAN LEAD THIS PROCESS !!
Combined assurance and corporate governance
PwC
October 2011
16
Example Risk Map
Three lines of defence assurance providers
Example
IT risk
Associated
controls
First line of defence Management
Second line of defence –
Risk and legal based
assurance
Third line of defence –
Independent assurance
Control
self
assess
ERM
External
audit
Mgt
review
Special
project
SOX
Complia
nce
Internal
audit
Special
project
Operational - Network
Network
perimeter
security
breach
Network
downtime
Secure firewall
configuration
P
P
O
Secure remote access
design
Security monitoring service
contracted with supplier
O
P
Service level agreement
with supplier
P
P
Disaster recovery plan
P
P
Currently providing
assurance
Combined assurance and corporate governance
PwC
Should provide
assurance
O
Scope excludes
detailed
configuration
P
O
P
P
P
P
Quality of assurance
acceptable
P
P
O
Quality of assurance
unacceptable
October 2011
17
4. Design Combined Assurance blueprint
Convince all stakeholders of the future approach:
• Agree the common risk universe
• What assurance is to be provided and to whom
• Agree on methodology to assess assurance providers
Combined Assurance blueprint:
• Risk based assurance coverage
• Analysis by assurance provider
• Management / governance committee responsible
• Frequency and extent of assurance required
Combined assurance and corporate governance
PwC
October 2011
18
5. Make Combined Assurance a reality
• Executive sponsor and Audit Committee support
• Combined assurance champion driving day-to-day activities
◦ Needs to be driven actively
◦ Consistent reporting structure and feedback
◦ Regular assessment of quality of delivery
• Combined Assurance Forum
◦ Initial planning
◦ 3 to 6 monthly assessment
Combined assurance and corporate governance
PwC
October 2011
19
6. What do I do when I leave here?
 Find your Executive sponsor
 Assess the level of maturity of your ERM process
 Determine who is best placed to drive this initiative
 Liaison with the AC Chair
 What are their expectations
 Reporting requirements
 GET STARTED !
Combined assurance and corporate governance
PwC
October 2011
20
www.pwc.com/za
That’s the theory –
the rest is up to you!
This publication has been prepared for general guidance on matters of interest only, and does
not constitute professional advice. You should not act upon the information contained in this
publication without obtaining specific professional advice. No representation or warranty
(express or implied) is given as to the accuracy or completeness of the information contained
in this publication, and, to the extent permitted by law, PricewaterhouseCoopers Inc, its
members, employees and agents do not accept or assume any liability, responsibility or duty of
care for any consequences of you or anyone else acting, or refraining to act, in reliance on the
information contained in this publication or for any decision based on it.
© 2011 PricewaterhouseCoopers (“PwC”), a South African firm, PwC is part of the
PricewaterhouseCoopers International Limited (“PwCIL”) network that consists of separate and
independent legal entities that do not act as agents of PwCIL or any other member firm, nor is
PwCIL or the separate firms responsible or liable for the acts or omissions of each other in any
way. No portion of this document may be reproduced by any process without the written
permission of PwC.