Corporate Governance Auditing in the Public Sector

Course Overview

A corporate Governance Audit is a useful approach to ensuring that a corporation has followed all applicable laws and that adequate internal control systems, policies, and procedures are in place to meet the interests of all stakeholders. This audit approach is crucial as the Board and the Audit Committee need comprehensive assurance about this strategic business process.

This course will provide all the tools and techniques essential to audit the complex and wide-ranging field of Corporate Governance. It will help you ensure that you are applying the very best practices and meet all regulatory requirements

Course Objectives:

At the end of this course, the participants will be able to:

Audit the risk management process
Meet stakeholder expectations regarding Corporate Governance (CG)
Evaluate the effectiveness of business continuity planning
Assist the Audit Committee in their Corporate Governance (CG) role
Evaluate sustainability and environmental governance
Audit joint ventures and partnerships

Course Coverage:

Topic 1: The Key Aspects of Corporate Governance:

What is Corporate Governance?
6 Core Principles of Governance
The Governance Warning Signs
New Corporate Governance Insights Paper will be Shared
Auditing Corporate Governance – new guidance
Meeting Stakeholder Requirements
How the organization is managed on behalf of the stakeholders?
The Key Parties within Governance
Audit Committee
The Board
Regulators
Customers
Suppliers
A New Governance and Accountability Tool will be Shared
Developing a Terms of Reference for the Assignment
A New Audit Programme will be Shared
New Guide on IA Standard 2120
Corporate Governance Statements

Topic: Governance Assessment Techniques:

COSO Advisory Paper – improving organizational performance and Governance
Governance and Strategy
Governance Models
Codes of Governance Requirements
Financial Reporting Implications
International vs. National Governance Criteria
The 3 Lines of Defense
Who should cover what?

Topic 3: The Business Environment:

The Standards, Processes, and Structures
The Tone at the Top Regarding the Importance of Internal Control
Expected Standards of Conduct
Management Reinforcement of Expectations across the Organization
The Integrity and Ethical Values of the Organization
The Governance Oversight Responsibilities
The Assignment of Authority and Responsibility
The Process for Attracting, Developing, and Retaining Staff
Establishment of Performance Measures, Incentives, and Rewards

Topic 4: Analyzing and Assessing the Effectiveness of Governance Controls:

Business Process Analysis Techniques
Process Objectives and Risk
The Need to Understand the Business Objectives
Developing a Programme to Reflect these Objectives
Defining and Measuring Strategic Objectives
Determining Process Components
The Link between Objectives and Risk
The Link between Risks and Controls
Process and Business System Controls
The Link between Inputs and Outputs
Trigger Events

Topic 5: Scoping a Governance Audit

Governance Structure
Reporting Lines
Strategy and Risk Appetite
Leadership and Culture
3 Lines of Defence Process
Communication with Regulators
Escalation
Delegated Authorities
Whistleblowing
Accountabilities
Data Integrity
Commitment to Governance
Policies

Topic 6: The Need for Governance Audit of the Board:

The Key Role of the Board in Governance
The Need to Assess the Risks at this Level
Determining the Key Risks and Causes
The Audit Approach in this Sensitive Area
How to gather the evidence?

Topic 7: The 15 Key Governance Board Risks to be Reviewed:

The actions of the Board are taken without due consideration of the impact on the organization and the stakeholders
Independent members of the Board are unable to give a robust challenge to the executive/senior management
The Board does not have sufficient, complete or timely information on which to base its decisions
The Board is not monitoring or taking action on the most significant risks to the organization
Evidence of the decisions made by the Board, including the challenge process, is not transparent
Actions agreed by the Board are not implemented on a timely basis
Committees set up by the Board may not fulfil their obligations or there are too many committees such that the oversight is fragmented
The Board is not effective in covering the risks relating to remote sites or does not have responsibility/oversight for all parts of the organization
Policies, procedures, and projects are not aligned with the organization’s objectives
The culture of the organization is not sufficiently defined or does not support the organization in achieving its objectives
Risks accepted or taken which are outside of the organization’s risk appetite
The organization’s risk appetite may conflict with the objectives and values of the organization
In the event of a significant incident there is an adverse effect on the wider economy or society
The governance requirements of any regulatory or legislative requirements are not met leading to increased regulatory sanction, censure or closure of a business
Communications from the Board are not effective such that parts of the organization may not be operating in line with board expectations and may not support the organization in achieving its objectives

Topic 8: Auditing the Overall Risk Management Process:

Establishing the Position Regarding RM in the Business
Establish Corporate Targets and Monitor Overall Progress
Risk Management using ISO 31000 Paper from IIA
Keeping the Board Apprised of the Most Significant Risks
Assessment of RM Capabilities
Strategic Risk Assessment
Review of Risk Evaluations in each Function
Ensuring Actions to Treat Exposures Implemented
Ensuring All Functions Evaluate their Risks Consistently
Evaluating the Results and Challenging Where Necessary
Identification of Exposures
Reviewing Risk Registers
Imperatives for Change – RBA Planning
Basing Audit Programme on Most Significant Risks
Comparing Perceived vs. Actual Controls
A Risk Management Evaluation Tool will be provided

Topic 9: Evaluating Risk Appetite:

Evaluating the Risk Appetite Statement
Defining Risk Limits
The Risk Profiling
Ensuring the Risk Appetite is defined for each type of risk
Ensuring Target Risk for Each Event

Topic 10: Auditing the Audit Committee Process:

The Audit Committee Role
Structure and Independence
Does the Committee approve (but not direct) the internal audit strategy, plan, and performance?
Does the Committee review summary IA reports and the main issues arising and seek assurance that action has been taken?
How does the Committee consider the reports of external audits and other external agencies?
How is the effectiveness of relationships between IA and EA and other bodies reviewed?
How is the effectiveness of the risk management environment and anti-fraud arrangements assessed?
The Audit Committee / IA Relationship
New Paper on How the Audit Committee Should Assess IA
How does the Committee satisfy itself that assurance statements and the annual statement of accounts properly reflect the risk?
Audit Committee Report Example

Topic 11: Auditing Reputation:

The Rise of Reputation as a Key Risk
The Increasing Importance of a Positive Image – the need to be admired
Where does reputation come from?
How do you measure it?
The Magnifying Effect on Reputation of Business Failures
Global Brands
How to judge reputation?
The Explosion of Regulation and External Assurance
Identifying Reputational Risks

Topic 12: Corporate Social Responsibility:

The Increasing Importance of Corporate Social Responsibility (CSR)
New IIA Standard 2110 Re-auditing of Ethics
What constitutes CSR?
The Wider Aspects of CSR and the Implications for IA
Doing Responsible Things Responsibly
A Paper on Auditing Ethics will be provided
Redefining IA Role with CSR in Mind
An Audit Framework
How to audit CSR? – Key Steps Is communication with main stakeholders taken seriously?
Are the expectations of these stakeholders accurately understood, and what are the risks that these will not be met?
Are opportunities taken to develop the ethical reputation of the business?
How do we ensure that staff have and display the right attitudes?
Has the business assessed its reputation for social responsibility and its impact on our business prosperity?
Is the Board, and in particular the Chief Executive, sensitive and responsive to the concerns of customers?

Topic 13: Sustainability and Environment Audit:

The Need for Environmental Auditing
The Key Requirements for Sustainability of Resources
Why Environmental Audit is valuable even if you do need to comply with ISO 14001
Carrying out an Environmental Site Review
Reviewing the Audit Trails
Meeting Regulatory Requirements
Ensuring Consistency

Topic 14: Auditing IT Governance:

Global Technology Audit Guides (GTAGs)
The Need to Determine the Boundaries
Defining the IT Audit Universe
Focus on High-Risk Areas
Assess IT Vulnerabilities
Target Areas Where You are Focusing on Process rather than Technical Aspects
Use of Audit Frameworks such as CoBIT and ISO 27000
IIA New Standard on IT Governance
Risk-Based Audit of General Controls (GAIT)
IIA Guidance re GAIT

Topic 15: Auditing Joint Ventures and Partnerships:

Ensuring that there is a Risk Strategy for JV
What protocol is in place?
What is the review mechanism?
Is it effective?
What frequency is there for review by management?
What mechanism is there to guide management in attending JV meetings?
Does anyone know the number of JVs and partnerships you are involved in and how much money and other resources are invested in them?
Has each JV been risk reviewed?

Topic 16: Auditing Business Continuity Planning:

The Importance of BCP
The Need to Recognize BCP is not just about IT Recovery
Reviewing the Different Types of Disaster – have all been Considered?
Does the organization’s leadership understand the current business continuity risk level and the potential impacts of likely degrees of loss?
Can the organization prove the business continuity risks are mitigated to an approved acceptable?
Are they tested effectively?
Is the Board well set up to respond swiftly and capably in a crisis?
The Transition from an Emergency to a Disaster and the Questions to Ask at Each Stage
Is there an appropriate contingency plan ready to be used to manage a crisis?
Communication Testing
Alternative Site Testing

Topic 17: Reviewing Key Controls Over Technology:

Risk and Control Matrices to Document Technology Dependencies
Evaluating End-User Computing
Implementing or Monitoring Control Activities when Outsourcing IT Functions
Configuring the IT Infrastructure to Support Restricted Access and Segregation of Duties
Configuring IT to Support the Complete and Accurate Processing of Transactions and Data
Administering Security and Access
Applying a System Development Life Cycle over Packaged Software

Topic 18: Assessing Management Information Governance:

Topic Inventory of Information Requirements
Validating Information from External Sources
Information from Non-Finance Management
Creating and Maintaining Information Repositories
Enhancing Information Quality Though a Data Governance Program
Identifying, Protecting, and Retaining Financial Data and Information
Adoption of ISO 27000

Topic 19: Communication Internally and Externally:

External Financial Reporting Disciplines
Responsibilities and Guidelines for Communication to the Board of Directors
Communicating a Whistle-Blower Program to Company Personnel
Communicating through Alternative Reporting Channels
Establishing Cross-Functional and Multi-directional Internal Control Communication
Surveys for External Parties

Topic 20: Ongoing Evaluations to Ascertain Whether the Components of Internal Control are Present and Functioning:

Develop a Baseline for Effective Internal Control Processes
Have a Mix of Evaluations from Different Sources
Use the Most Knowledgeable Personnel
Adjust Scope and Frequency
Change the Monitoring Processes as the Business Activities and Risk Profile Changes
Develop Metrics
Consider a Continuous Monitoring / Audit Approach

Targeted Competencies:

The Techniques for Assessing Governance Risks
A Proven Method for Analysing Governance Controls
The 15 Key Governance Board Risks being Reviewed
The Ways to Audit IT Governance
The Approach to Review Keys Issues of Corporate Social Responsibility and Reputation Management