Archive for the ‘Risk’ Category

Risk management and thinking

May 20, 2017 6 comments

Last week, I was privileged to present what was billed as a “3 hour master class” on World-Class Risk Management to about 200 risk and internal audit leaders in Moscow.

Organized by Alex Sidorenko and the Risk Academy (check out their excellent web page, which includes blogs and a free book on effective risk management), I spoke about a couple of themes from my World-Class Risk Management book:

  • Effective risk management is about far more than a periodic review of a list of risks. It’s about taking the right level of the right risks, especially as we make decisions running the business.
  • The journey to world-class risk management involves understanding and addressing the risks to the quality of the risk information relied upon by decision-makers, executives, and the board.

The Risk Academy web site includes a link where you can see the entire presentation.

Alex treated me to a tour of the city, which I thoroughly enjoyed – especially the opportunity to chat and share ideas about the management of risk.

During our conversation, I realized something.

What do people say when you do something they think is wrong?

“What were you thinking?”

After you struggle to reply, they continue with:

“You weren’t thinking, were you?”


What do they mean? They mean that you weren’t thinking about the consequences of your actions, what might happen, and the other choices you could have made.

Isn’t that risk management?

  • Identifying what might happen
  • Assessing and evaluating the effects of what might happen
  • Determining whether that is desirable or acceptable
  • Taking action as appropriate, including making a different decision if necessary
  • Checking afterwards that what happened met your expectations and acting as necessary, going back to the top of this list (remember how ISO 31000:2009 says that risk management is dynamic, iterative, and responsive to change)

How can we help decision-makers think about what might happen?

Isn’t that the role of the world-class risk practitioner?

I welcome your thoughts.

Deloitte on internal audit and the path forward

May 12, 2017 35 comments

In a new paper, Deloitte takes the results of its latest survey of chief audit executives (CAEs) and makes recommendations for action.

The survey, which has been widely reported, indicated that in the opinion of the responding CAEs only 28% of them “believe their functions have strong impact and influence in their organizations, while 16 percent felt that Internal Audit has little to no impact and influence”.

I think the path to fixing the problem starts with acknowledging it, which Richard Chamber has done in a number of his IIA posts (which you can find here).

Deloitte has suggested 9 areas of focus.

I disagree with them.

Here are my suggestions for CAEs, audit committee members, and executives who want to help improve the quality and value of internal audit services.

  1. Audit what matters. Audit how risks to the achievement of enterprise objectives, what might cause them to fail and what is necessary to succeed, are managed. Richard Chamber and I have both written a book with advice on the path forward. Neither of us do it for the money; it’s our shared desire to see the profession advance. My latest book addresses this topic and more, Auditing that matters.
  2. Focus on helping your stakeholders succeed, rather than on performing audits and writing audit reports. Read Richard’s latest, Trusted advisors: key attributes of outstanding internal auditors. Ask what information your stakeholders need from you which could make them welcome you to their table.
  3. Communicate what matters, when it matters, in a way that is actionable and readily consumed. The advice on this topic from Deloitte is off the mark. I cover the point in far more detail in my book, including pointing out that IIA Standards do not require an audit report; that the best communication is face-to-face where questions can be asked and answered; and that we need to deliver our assurance, recommendations, and insights at speed. The business is being run faster and faster, yet our reporting process remains slow and old-fashioned.
  4. Understand why the CAE is not getting the respect he or she should. Is it a failure of the CAE to explain effectively or of the audit committee and management to understand the potential for internal audit to help them succeed? Is it because the CAE is complacent, delivering what he is told he should and being satisfied with good performance reviews and bonuses instead of pushing the envelope to deliver the services and value he or she could and should?
  5. Deliver. Last but hardly least, the CAE must deliver assurance and insights that the executive team and the audit committee truly value. Again, this is what my book is all about, but if the executives and audit committee see our end product as ‘ho-hum’ and not something that might affect their decisions or strategies, then is it worth the money being spent on internal audit? Why should they give respect and, more importantly, their time to an activity that is peripheral at best to running the business?
  6. Be willing to change. Some CAEs, such as Chris Keller at Apple, have thrown out the traditional internal audit model because they can see a better way to add value to the organization, providing assurance that the right risks are being taken. We don’t accept people in the business doing things the same way for years because that’s the way it is always done, so why should we do that ourselves?


I welcome your comments and perspectives.

How do we make decisions? Where does ERM fit?

May 8, 2017 4 comments

How do you make decisions in your personal life?

How do you decide where to live, which car to buy, and where to go for lunch?

For many of us, the last is the most difficult decision to make in a day!

So let’s think about it.


It’s lunch time. Even if your watch didn’t tell you, your stomach is loud.

The first decision is whether you are going to eat at all.

Can you afford the time? Can you afford not to eat, given what lies ahead in your day?

What can you get done if you skip lunch? What will suffer if you don’t?

Did you bring your lunch to work? That would provide a compromise solution: eat while you work. Do you really want to do that and risk getting stains on your papers? Is it accepted behavior or will you be forced to leave your workspace for a lunch room or similar – in which case, time might be saved but the idea of eating and working may not be achieved.

If you have to get some lunch, where do you go?

Do you go where you love the food, or where you can get a quick bite of so-so flavor and be back at work promptly, or do you go somewhere where the food is just OK but at least is relatively quick?

Or, do you gather up some colleagues and have a lunch together? This may help with team spirit and other objectives but would take longer. Maybe your colleagues ‘expect’ you to go with them and failing to do so will affect your relationship with them.

Can you afford the time, given how much work you have and the deadlines given you by your boss?


There’s more to the lunch issue (such as how will you get to the restaurant and when you should leave), but let’s leave it there.


What we did was consider our current situation and determine whether it was acceptable or not. We decided that it was not, because we needed (and wanted) to eat. The value of eating outweighed the loss of time (sorry, boss).

We then considered all the options, the benefits and downsides of each.

We made a decision.


Where was the risk manager with his list of potential harms?

Did we have a separate analysis of the risks from any analysis of the benefits (getting more work done, satisfying the boss, enjoying our food, and being ready for the rest of the day)?

What would you say if one of your colleagues responded to every suggestion about a restaurant by pointing out what could go wrong (bad food, food poisoning, delays getting back, unpleasant service, and so on)?

Would you say he or she was doing their job well and look for a separate colleague to identify and assess all the good things that might happen by going to this or that restaurant?


Can risk practitioners continue to be the voice of gloom and expect to be asked to join the CEO for lunch at his or her club?


I welcome your thoughts.

Risk appetite in practice

April 29, 2017 32 comments

From time to time, I am asked about the best risk management activity I have seen. Perhaps the best overall ERM was at SAP. I wouldn’t say it was perfect but it did include not only periodic reviews but the careful consideration of risk in every revenue transaction (including contracting) and development activity.

The best risk management activity was when I was with Maxtor, a $4b hard drive manufacturing company. It was based in the US but had major operations in Singapore, which is where I saw this.

The head of procurement for the region, a vice president, and his director were evaluating bids to supply the two Singapore plants with critical materials.

Margins in that business were not high, so the effective management of cost was very important indeed.

[David Griffiths has pointed out that my post, as originally written, did not specify the objectives to which we have risks. I am adding them here:

  • Procure critical materials at the lowest possible cost to optimize margins
  • Ensure timely delivery of critical materials to support manufacturing and timely delivery of finished products to customers with a positive effect on customer satisfaction
  • Minimize supply chain disruption risk
  • Ensure quality materials so that scrap and rework are minimized, manufacturing is not delayed, costs are contained, and customers are satisfied]

But, there were additional issues or ‘risks’ to consider:

  • The choice of a single vendor would increase the likelihood and extent of supply chain disruption if that vendor was hit by floods or other situations that could disrupt its ability to manufacture and deliver.
  • If we were dependent on a single vendor, that vendor could demand price increases.
  • If we were dependent on a single vendor, we could not switch with agility to another should the single vendor have quality manufacturing problems.
  • If the decision was made to select two vendors, the total cost would be likely to increase.
  • If two vendors were selected and the supply split between them, there would be less desire for them to make us a priority customer.
  • If only two vendors were selected, there would still be significant supply-chain disruption risk.
  • If more than two vendors were selected, additional agility would be obtained, but at a cost.
  • If more than two vendors were selected, they might be less reliable because they would be less dependent on us as a major customer.

Cost was not the only consideration. Quality, timely delivery, and our agility to respond to any form of disruption were also very important.

The procurement VP gathered together all the potentially affected parties to participate in the decision, including the vice presidents for finance, sales, manufacturing, and quality.

They considered all the options, the consequences of each decision (both positive and negative), and decided to select three vendors and split the allocation between them. They also decided to negotiate backup supply contracts with a couple of other companies.

The decision involved taking a higher level of some risks and lower levels of others.

Basing the decision on whether one risk was too high would not have led to the optimal overall result.

Now, how would a risk appetite statement have helped the VP of procurement?

I believe the answer is “not at all”.

What do you think?

I welcome your comments.

Risk management in review

April 21, 2017 5 comments

PwC’s latest Risk In Review study makes some very interesting points. It carries the title of “Managing risk from the front line” and I recommend downloading and reading it.

I like how it begins (with emphasis added):

Today a collaborative approach to risk management with risk accountability sitting squarely in the first line of defence can be the key to greater organisational resiliency and growth. That means an engaged first line that makes risk decisions in alignment with strategy. It means a proactive second line that influences decision making through effective challenge and timely consultation and collaboration. And it means a diligent, independent third line focused on its core missions of protecting the organisation and delivering value.

This recognizes that risk is being taken every hour of every day by decision-makers across the extended organization.

This is emphasized in a quote:

Melissa Lea, SAP AG chief global compliance officer, says that at her organisation, that direct connection is paramount. “We’re very first-line heavy. The more we can get risk responsibility out into the field—first into management’s hands and then to employees to make sure they’re armed with the right expectations to make the right decisions—the more successful we’ll be. We try to get people—either on the ground, in-country, or with the best lines of sight into how a particular risk might materialise—to really own that mitigation approach.”

Is the report perfect? No. For example, they still seem to believe that a risk appetite statement can drive the business decisions that take risk at all levels of the organization. I don’t.

They also don’t emphasize reporting to top management and the board the likelihood of achieving each and all enterprise objectives (i.e., the aggregate effect of risk, positive and negative in terms of the likelihood of success).

But let’s give them some credit for the pieces they got right and hope the emphasis on decision-making extends to the update of the COSO ERM Framework.

I welcome your thoughts.

Are your internal auditors present?

April 15, 2017 3 comments

If you want the internal audit team to address the risks that matter to the success of the organization, they have to know what they are.

I addressed this in detail in Auditing that matters.

In the section on Being Present, I said:

Some internal audit departments live in an ivory tower, part of a corporate organization that is at the center of the enterprise. While there are advantages in being at the center, with information flowing in and with access to corporate officers and executives, the disadvantage is that you may not know what is really happening in the business – where the front lines extend across the globe and the men and women in the trenches feel disconnected with the corporate bureaucracy.

I like to have my office in the headquarters area, but I put my staff where the action is. When business units are headquartered in other areas of the country or the globe, those are where I position my direct reports.

For example, at Tosco we had multiple refineries. Each was a major operation in itself, so I had staff located there. But, my director for the Tosco Refining Company was based at that division’s headquarters in New Jersey and the director for the Marketing Company was at their HQ in Tempe, Arizona. At Business Objects, we had a regional structure; I was at the California office, co-located with the CEO and CFO. But I also had staff in the Vancouver, Paris and Singapore offices, co-located with the Americas, Europe, and Asia/Pacific executives.

I require my direct reports to build a strong relationship with the management of the areas they are responsible for. They attend those executives’ staff meetings and have periodic one-on-one meetings with them. They are part of the local management team in some ways, dedicated to helping that part of the business succeed, although they retain their organizational independence and objectivity.

When they are present, when they are seen, they are able to listen.

My experience is that people will think of coming to you, whether to provide information or to seek advice, if they see you. If they don’t see you, the likelihood they will call on you is significantly diminished.

At Solectron, my team was scattered across the organization – again, to remain in touch with the pulse of the organization.

One of my team, Jeff Mullis, was based in Charlotte, North Carolina. On one of my visits to Charlotte, I arrived outside Jeff’s office a few minutes early for a scheduled meeting with him. As I neared his office, I heard voices inside. I waited outside while he finished the meeting he was having with two members of local management; it was clear that they had come to him for advice on an operational issue (he had been in local operating management prior to joining the audit team).

When they left and I entered his office, Jeff apologized for keeping me waiting. He asked if I had a problem that he spent time talking to local management like this rather than spending all his time on assigned audit engagements. My reply was to congratulate him!

I was very pleased that he had retained his connections with operating management and made himself available when they needed his advice and insight (that ‘magic’ word, again). He knew what was going on in the business, had his finger on the pulse, and as a result could not only be a more effective auditor but help the entire internal audit team understand the risks and opportunities across the organization.

If you want to address the risks that matter to the success of the organization, you have to do more than listen to the members of the board and executive management team.

You have to, using the words of Tom Peters, “talk to the janitor”.

The members of the audit team have to be where the action is, where the risks are being taken, and where the front lines are in manufacturing, sales, procurement, and so on.

How can we expect an occasional visit to help us understand what is really happening? Is it sufficient for the CAE or an audit manager to fly in once a quarter to talk to local management?

Let’s face it: most internal audit “findings” are where they find that what is happening in real life is different from what those in the ivory tower believe is happening.

I do not believe it is advisable to base the audit plan on input and advice from the top and then go audit to find out the risks are different, or at least managed differently.

The audit plan should reflect reality, not ivory tower beliefs.

How confident are you that your audit plan addresses the risks as they appear in the front lines?

Is that acceptable? If not, what are you doing about it?

I welcome your comments.


The state of the internal audit profession

April 6, 2017 18 comments

My friend Richard Chambers has written a couple of posts that merit our careful attention.

Frankly, all of his posts merit our attention, but these are important.

I ask that you review:

I have not spoken to Richard about either of his posts nor about his motivation for writing them. (See Note at conclusion.)

However, I suspect that they were sparked by articles such as this, Internal Audit Losing Prestige, Survey Finds. To quote that piece:

In the eyes of CFOs and many other senior executives and board members, the internal audit function is fast losing prestige, a new study suggests.

The reason? Most internal auditors are slow to help their employers prepare for and respond to major corporate “disruptions” like big regulatory changes and cyber attacks, according to PwC’s 2017 State of the Internal Audit Profession Study.

The portion of “stakeholders” — internal auditors, senior executives, and board members — reporting that “internal audit adds significant value” plummeted from 54% in 2016 to 44% in 2017, reaching the study’s lowest level in the five years PwC has been tracking the metric.

Tim Leech of Risk Oversight was more gloomy about the current state of internal audit when he wrote a piece with the highly provocative title of Is Internal Audit the next Blackberry.

Full disclosure requires that I tell you that I have known both Richard and Tim for a very long time.

  • Richard and I come from different backgrounds but tend to see things in similar ways (while he served as CAE in the US public sector, I served as CAE for global public companies; he worked with PwC in the consulting and audit services area before becoming CEO and President of the IIA, while I started my career with PwC in public accounting). His position requires him to be diplomatic while I tend to be more provocative. I served many years on IIA committees and task forces and Richard and I have collaborated on a number of AuditChannel broadcasts.
  • Tim and I also have different backgrounds. While he also started with PwC (in Canada) before moving into internal audit, he has been a consultant for the last 30 years. Tim and I often disagree but have a mutual respect. Recently he has shared drafts of his work with me for comment before they are published.

Richard is far more provocative than usual in his March 27 post when he says:

It is a truism that negative news tends to generate more attention, and of late there has been too much of it directed at internal audit. I wouldn’t go so far as to characterize it all as “fake news,” but much of it is “hyped news” at best. Whether it’s a media headline trumpeting a purported decline in stakeholder confidence in internal audit or pundits characterizing the profession in such stark terms as the next Blackberry, a few sensational “sound bites” can easily become fodder for those who are quick to relegate the profession to irrelevancy.

Naturally, Tim sees this as labeling his writing as “fake news”.

Richard is 100% correct when he states:

No one has been more open and transparent about challenges and opportunities facing our profession than I have been. Along with other leaders of The IIA, we have continuously challenged internal auditors to acknowledge and address any shortcomings that surface. Internal audit should never shy away from fair critique of its work. However, superficial interpretation of data about the profession can quickly morph from valid encouragement for continuous improvement to destructive criticism.

Equating survey results indicating that less than half the respondents believe “internal audit adds significant value” with a loss of prestige is fallacious. The fact that internal audit functions are able to add staff may indicate that they are being given more resources so they can do more and add greater value.

I don’t believe internal audit is “losing prestige”. My belief is that internal audit can and should do more to deliver the value that our stakeholders need.

Unfortunately, internal audit at many if not most organizations does not have a lot of prestige and the argument should be about increasing rather than losing it.

Let’s look at some more information.

My friend Joe McCafferty of MISTI recently wrote about comments by a panel that included other friends, Larry Harrington and Angela Wizany, along with Brian Christensen of Protiviti. Joe’s piece is titled Stakeholders are sending a clear message to internal audit to step up its game.

I strongly recommend reading the piece and noting the eight action items.

One quote by Brian caught my eye:

Stakeholders are challenging us to get out of our swim lanes. We as auditors are so accustomed to doing our behaviors. We have our audit plans, we have our pencils. But [stakeholders] talked to us about the fact that things change. Be adaptable, be flexible, and be receptive to embracing new challenges and taking them on.

I have worked with IIA Malaysia in the past, including talking on their behalf to the Malaysia Securities Commission and presenting to board members. The profession appears to be strong there, but a recent survey indicates that more is needed.

An article in the local business newspaper reported that:

Public listed companies (PLCs) in the country still have much room to strengthen their internal audit functions, according to a year-long survey commissioned by the Institute of Internal Audit Malaysia (IIAM).

In a statement, IIAM said 54% of the PLCs on the Main Market preferred to outsource their internal audit function and almost all (90%) of these PLCs that outsourced paid RM100,000 or less in a year.

“The amounts incurred indicate that very junior staff or very few staff were in the audit team and a limited scope was covered. The low amounts are also a sign that the staff are not professional staff and may not have the experience and skillset to effectively carry out the work, thus less is spent,” the institute said.

“PLCs should consider the professional qualifications, certification and experience of their OSPs (outsourced service providers) in relation to the scope of the work required to ensure adequate coverage of risk areas and reliable reports are issued.”

Tim has every right to challenge the current state of internal auditing and I know Richard respects that.

I don’t agree with Tim’s reference to a “direct report internal audit paradigm”. While he has explained what he means to me in private conversation, I strongly doubt that many know what he is referring to. However, I do agree that internal audit should provide assurance on the effectiveness of risk management and its ability to help the organization make intelligent decisions and achieve objectives.

There is some merit to Tim’s thinking, but I always struggle with the way he says it. (Sorry, Tim).

Nevertheless, we need people like Tim to challenge us.

Now is the time to step back and think about why the surveys are saying what they are saying, and then talk about what needs to be done about it.

Richard and I have both shared our views with new books.

I would like to think that between us we have charted a way forward.

Internal auditors need to be “proactive” and “forward-looking” according to our Principles for Effective Internal Auditing.

Let’s adopt that mindset for our own practices and profession.

Forward ho! The future is bright. Internal auditing in 2020 and beyond may well be quite different than it has been in the past.

I welcome your comments.



NOTE: I shared a draft of this post with both Richard and Tim. Neither has a concern, although Tim and I remain at odds over his terminology and perhaps more.