Home > Risk > An internal audit conversation between Paul Sobel and Norman Marks

An internal audit conversation between Paul Sobel and Norman Marks

Please join Paul (immediate past chair, IIA Global) and me on August 6th for a free webinar hosted by OCEG. Here is the session description.


Join Norman Marks and Paul Sobel for a conversation about what it takes to have a world-class internal audit function. Paul is the Vice President/Chief Audit Executive of Georgia-Pacific LLC and a former Chairman of The Institute of Internal Auditors. Norman Marks, who is not only an OCEG Fellow but an Honorary Fellow of the Institute of Risk Management, led the internal audit activity at global corporations for about 20 years; he is the author of World-Class Internal Audit: Tales from my Journey and a new book, World Class Risk Management.

Paul and Norman will share their views on topics such as:

  • Our world is constantly changing and change is the order of the day. Has a gap been created between the value executives and boards need and what IA has traditionally delivered? Is it time for transformation?
  • In today’s world of rapidly changing risk profiles, how has risk-based internal auditing changed? Should we now call it enterprise risk-based auditing?
  • Is our primary mission assurance or consulting/advisory?
  • How often should the audit plan be updated?
  • Are audit reports the best way to communicate results?
  • Should the CAE issue a formal report on the adequacy of internal control? What about an opinion on the management of risk?
  • IT-related risks continue to grow; how should a CAE determine how many of his scarce resources should be devoted to technology?
  • Of the new Principles for Effective Internal Auditing, which is your favorite and why?
  • How do you build relationships with executive and operating management?
  • How do you get the best out of an internal audit team?
  • What does a savvy CAE do to win the war for talent?
  • Does IA need to educate the audit committee of IA’s potential so that it demands more?
  • What is world-class internal auditing?

This is a group internet-based event for NASBA authorized continuing education credit. Attendees who are premium individual or enterprise members of OCEG or who have an OCEG All Access Pass will receive a certificate of completion of this webcast indicating 1 hour of CPE.

  1. Kaya Kwinana
    July 30, 2015 at 7:47 AM

    “Is our primary mission assurance or consulting/advisory?”

    Actually, the question should be “Is our primary mandate assurance or consulting/advisory?”

    That should be an interesting question to address head on!

    The added value concept provides an answer for when there is a choice between the two. Whichever one is appropriate for particular circumstances!

    But primary?

    Maybe the answer lies in the fundamental purpose of internal auditing as contained in the definition of internal auditing, “”It helps an organization accomplish its objectives …”

    Now, assurance engagements assess the current status but consulting engagements influence (contribute to the improvement of) future behaviour, which behavior should include reliable periodic self-assessments.

    So, “Is our primary mandate assurance or consulting/advisory?”

    Which one would one go with if the only choice was one OR the other?

  2. August 6, 2015 at 2:02 PM

    Great webinar today Norman – such a pity you ran short of time and weren’t able to cover all the topics or answer any questions from the audience.

    I have two questions arising from the discussion.

    The first was prompted by Paul Sobel’s useful analogy involving boulders, rocks and pebbles. Where is the location for the great photo on the front cover of your book, which I bought a week ago and am thoroughly enjoying dipping into?

    The second question has intrigued me for a while. As a Brit, you will have seen Audit Committees operating on both sides of the pond. While carrying out an EQA for the CIIA recently, I had to review the Terms of Reference for 2 Audit Committees; one in the UK and one in the US. The ToR for the US committee only seemed to have about 15% of its focus (and time on the agenda) for internal audit, with finance and external audit dominating all meetings. In the UK ToR, it was more like 40-50% for IA, particularly for the meetings which didn’t have full or half year numbers to consider.

    I looked at other US ToRs and they seemed consistent. Does this mean IA doesn’t get enough of a voice these days at Audit Committees – or is that just a quirk of the US and it’s apparent financial blinkers (or is it dominated by quarterly reporting). Does IA get more of a voice at Risk Committees these days?

    This may partly support why it seems more progress has been made in the UK and Europe in bringing internal audit into the spotlight, particularly in Financial Services, which has been my terrain for almost 30 years. Like you, I have now entered the world of “semi-retirement”, focusing my time on training, consulting and mentoring. Maybe I have a book inside me – they do say everyone does.

    Keep up the brilliant observations on all aspects of GRC and particularly internal auditing. Our thoroughly enjoyable internal audit world wouldn’t be the same place without it.

    • Norman Marks
      August 6, 2015 at 2:51 PM

      David, thank you so much for the kind words.

      I have only worked with audit committees in the US, but they are responsible for financial reporting and the management of financial risks. I can’t say why they would not be in the UK, but if IA is doing its job well, it shouldn’t need to consume a great deal of the AC’s time.

      Just my opinion. I tried to keep my reports to the AC very short and let them know just what they need to know, including that we are working effectively with the management team.

  1. No trackbacks yet.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.

%d bloggers like this: