Appendix – Illustrative Kano Analysis Regarding Internal Audit

BOARD AND AUDIT COMMITTEE PERSPECTIVES ON VALUE ADD (ILLUSTRATIVE)

Seen to be value adding:

  • Delivering the audit plan within the year;
  • Delivering assurance over key concerns or areas of interest for the board/audit committee;
  • Providing comfort over core control and compliance areas;
  • Providing timely and tailored briefings on the position of the organization in relation to topical issues;
  • Offering insights into emerging risks;
  • Identifying themes and trends in audit findings;
  • Being seen to be influential with senior management.

Seen not to add value:

  • Failing to deliver the audit plan;
  • Having a major issue occur in an area that was recently audited (e.g. “Why didn’t you spot that issue when you audited that area last year?”);
  • Appearing un-influential with senior management (and expecting the board to do the running) or appearing in the pocket of management;
  • Audit receiving negative feedback in a quality review or from a regulator or from the external auditor;
  • Audit “Pushing the nuclear button” on an issue which proves to be relatively minor;
  • Indications that management are not remediating audit recommendations;
  • The CAE being unable to answer an obvious question when the matter is discussed at the board/audit committee.

SENIOR MANAGEMENT PERSPECTIVES ON VALUE ADD (ILLUSTRATIVE)

Seen to be value adding:

  • Audit being on hand to do targeted work for some senior managers;
  • Audit delivering advisory assignments that are seen to support the achievement of priority objectives;
  • Audit producing short, balanced reports on a timely basis;
  • Audit working in a joined up way with other functions, including the external auditor, to manage the burden of assurance activities across the organization;
  • Audit delivering the audit plan to (or under) budget;
  • Audit identifying inefficiencies or cost savings.

Seen not to add value:

  • Audit reports with negative ratings that do not align with senior management’s risk appetite;
  • Audit report wording that is either inflammatory or that might be unhelpful if disclosed to a regulator or in litigation;
  • Anything that comes as a surprise;
  • Anything communicated out of chain;
  • Audit reports that simply repeat known issues in more detail;
  • Audit reports that are issued too late to do anything with.

LINE MANAGEMENT PERSPECTIVES ON VALUE ADD (ILLUSTRATIVE)

Seen to be value adding:

  • Audit showing flexibility concerning the timing of the assignment in relation to other priorities;
  • Offering something in the assignment that would be of value to them;
  • Keeping management fully on board throughout the process;
  • Taking opportunities to suggest that some control activities are wasteful and can be removed to make processes slicker.

Seen not to add value:

  • Auditor coming across as poorly prepared during an assignment;
  • Auditors asking follow on questions, or requesting additional information, after interviews or initial requests for information, that appear to be a “second bite at the cherry”;
  • Anything that suggests audit does not have a firm grip on the key facts;
  • Not communicating proposed findings on a timely basis;
  • Poor audit ratings, or poor wording which can imply management negligence or incompetence;
  • Audit having an emphasis on procedures and paperwork in such a manner that the importance of points made is being lost;
  • Being so prescriptive about remediation actions that management do not feel able to move things forward in a way that suits them or reflects other organizational changes.