GAIN 2009 Kick-off Meeting Toelichting Questionnaire 7, 8 of 9 April 2009

Transcriptie

1 GAIN 2009 Kick-off Meeting Toelichting Questionnaire 7, 8 of 9 April 2009 Dia nummer 1

2 Agenda Organisatie voor GAIN 2009; Deelnemers GAIN 2008 kennismakingsrondje; Invulinstructie questionnaire; Hoe submitten? Kosten deelname GAIN; Tijdpad GAIN 2009; Beantwoorden van vragen; Borrel (ca uur). Dia nummer 2

3 Organisatie GAIN 2009 Doelstellingen IIA GAIN Nederland in 2009: Opnieuw vergroting aantal deelnemers Dutch Trade, Industry & Services Dutch Financials (inclusief Insurance) Dutch Government Ook véél aandacht voor Networking (Round Tables) Per groep minimaal deelnemers. Professionelere communicatie via IIA Website en Audit Magazine Coördinatie uniform submitten van Questionnaire en tijdig ontvangen/beoordelen rapportage Dia nummer 3

4 Leden werkgroep GAIN 2009 Hans van Hoogenhuijze (IIA GAIN, voorzitter) Arie Beunis (DELA, algemeen secretaris) Louis de Bruijn (KLM, voorzitter Trade, Industry & Services) Jantien Heimel (NUON, vice-voorzitter Trade, Industry & Services) Thomas van Tiel (Min. van Financiën, voorzitter Government) Scott Cheung (Credit Europe, voorzitter Dutch Financials) Korstiaan Kegel (Allianz, vice-voorzitter Dutch Financials) Dia nummer 4

5 Deelnemers 2008 Dutch Financials Friesland Bank De Lage Landen Rabobank Nederland De Nederlandsche Bank Equens SNS Reaal Delta Lloyd Groep Triodos Bank Robeco Groep ING Group DELA PGGM Credit Europe Bank Nederlandse Waterschapsbank Allianz Nederland UWV Agis Zorgverzekeringen BinckBank UVIT Bank Nederlandse Gemeenten Achmea Staalbankiers Ordina BPO Demir Halk Bank Nederland Bank Insinger de Beaufort DAS Holding Dia nummer 5

6 Deelnemers 2008 Dutch Trade&Industry OPG Groep TNT NS Akzo Nobel KLM Heineken Ahold NUON KPN TomTom Vopak DSM Dia nummer 6

7 Deelnemers 2008 Dutch Government IB-Groep Audit Services Rotterdam Sociale Verzekeringsbank Dia nummer 7

8 1. Eerst Profiel aanmaken Invulinstructie questionnaire Bedrijfsinormatie ingeven Ga naar: Industriegroep en Subindustriegroep (meer dan 100) L1. First specialty group = Netherlands L2. Second specialty group = Dutch Financials Dutch Trade, Industry and Services Dutch Government L3. Third specialty group = Dutch Small Financials Print General instructions for the use of the GAIN Annual Benchmarking System 3. Print Preparation Guide for the GAIN Annual Benchmarking Questionnaire Dia nummer 8

9 Algemeen: Nederlandse gegevens Invulinstructie questionnaire In US $; koers 31/12/08 1 USD = EUR Geen duizendtekens! Geen spaties, geen komma s! Geen percentages, geen valutatekens! 1 EUR = USD Overal antwoord geven! Systeem checkt en geeft aan wat je gemist hebt. Sluit pas af na complete input. ALLE NULLEN vermelden! Dia nummer 9

10 Secties Questionnaire Sectieindeling 2009 A. Organization Information B. Internal Audit Resources C. Internal Audit Oversight D. Risk Assessment and Audit Planning E. Audit Implementation / Life Cycles / Reporting F. Information Technology (IT) auditing G. Performance Management H. Professional Development I. Emerging Trends and Leading Practices Dia nummer 10

11 A.Organization Information A1. Annual Revenues: Totale opbrengstengegevens die tot het audit domein behoren: bruto premie-inkomsten, bruto rente- en beleggingsopbrengsten. A2. Total Assets: Balanstotaal assets die tot het audit domein behoren (dus inclusief Assets under Management). A3. Annual Expenses: Totale kostengegevens die tot het audit domein behoren, inclusief rente- en schadelasten en (eventueel) resultaat op herverzekeringen. Dia nummer 11

12 A.Organization Information A4. Total employees in organization (full-time equivalents): FTE s gerelateerd aan bij A1 en A2 vermelde revenues & costs. A6. Is your organization: Public / Private / Government or Non-Profit Vul Public in als je eigen organisatie of je moedermaatschappij beursgenoteerd is. A7. Is your organization subject to the US SOx 2002? Yes / No Je bent ook subject to als je organisatie vrijwillig aan SOx voldoet, maar dan wel echt. Dia nummer 12

13 A.Organization Information A8. If your organization is subject to SOX, what is the level of responsibility handled by the internal audit activity? full responsibility over all aspects of SOX (e.g., process documentation and testing) The internal audit activity is responsible for the testing of controls only The internal audit activity acts in a consultative manner assisting organization management to ensure all components of SOX are completed The internal audit activity remains independent regarding SOX and audits the process in place that is owned outside of the internal audit activity Dia nummer 13

14 A.Organization Information A9. Organizational Reach: Keuze uit: Regional, National, International A10. Organizational Structure: Keuze uit: Centralized of Decentralized

15 B. Internal Audit Resources Internal Audit Costs B1. Please allocate the total cost of your internal audit activity: Salary (gross pay and bonuses) Geen Sociale Lasten + Pensioenen Employee benefits (if not tracked separately, averages 30% of salaries) Hier Sociale lasten en pensioen Travel Echte reiskosten + lease-auto s -/- reisk opleiding Training Kosten opleiding en permanente educatie + reiskosten opleiding Costs of purchased services (consultants, co-source providers, outsource providers, etc.) Non salary earners die hebben meegewerkt aan je audit plan Other Overige DIRECTE KOSTEN, dus geen doorberekeningen voor overhead als huisvesting, pc s e.a. Total internal audit costs: Automatic sum Dia nummer 15

16 B. Internal Audit Resources Staffing B2. Please enter the following FTE staff information. (Sourced staff must be entered/calculated as a full-time equivalent staff); Vul in gemiddelde FTE over periode! Chief Audit Executive Directors / Managers Seniors / Supervisors Staff In-House Staff Sourced Staff Total Audit Positions Automatic Calculation Automatic Calculation Total Professional Audit Positions Automatic Calculation (in-house + sourced) Secretarial / Clerical Total Positions Automatic Calculation Automatic Calculation Total Staff Automatic Calculation (in-house + sourced) B3. Including sourced staff, by what percent did your staff size increase or decrease over the last year (please insert 0 for no change and a negative number for a decrease)? Dia nummer 16

17 Staffing B2. B. Internal Audit Resources Chief Audit Executive Directors & Managers Seniors / supervisors Staff Secretarial/Clerical = Directeur Interne Accountantsdienst = Audit Managers, tweede echelon bij grotere IAD = Leidinggevenden / teamleiders / senior medewerkers, met 5 jr ervaring en/of titel = Medewerkers (de handjes ) = Ondersteuning/Secretariaat/Administratie Staffunctionarissen: vaktechniek onder Seniors, Control/HR onder Secr B2 en B3: Sourced staff alleen INDIEN EN VOORZOVER meegewerkt aan het uitvoeren van het internal audit plan! B3. Met gezond verstand afronden, 1 feb of 1 mrt mag 1 jaar zijn (en omgekeerd) r 17

18 B. Internal Audit Resources B8. Please identify the following staff information by level (FTE in-house staff only): Level of education sought for position Average years in internal audit profession Average years of industry experience (primary industry of organization) Number of staff with one or more professional certification designation(s) Zie B2 Alleen in house! Chief Audit Executive KIES EEN CERTIFICATE UIT DE LIJST VAN B6 + TOELICHTING ALLEEN INTERNAL AUDIT- ERVARING!! BINNEN DE BETREFFENDE SPECIALTY GROUP, BIJV. FINANCIALS, OOK IN ANDERE FUNCTIES!! AANTAL PERSONEN, DUS: Mr XXX RA CIA = 1 Directors / Managers Seniors / Supervisors Staff Dia nummer 18

19 B. Internal Audit Resources B9. Please provide the total number of audit staff with the following audit-related professional certifications (FTE in-house professional audit staff only): CIA / MIIA / PIIA CISA / QiCA CIPFA / CGAP / CGFM CCSA CA / CPA / ACCA / ACA CMA / CIMA / CGA CAT / AAT CFE CFSA / CIDA / CBA FCA / FCCA / FCMA) CFA QAR Other NEDERLANDSE EQUIVALENTEN RO RE MGA RA/ CAA Alleen in-house Welke titels komen hoe vaak voor, dus Mr X RA CIA = 2 Dia nummer 19

20 B. Internal Audit Resources B13. What was your internal audit staff turnover for the year (numerically by FTE)? Placed inside organization (andere functie binnen organisatie of groep) Voluntarily left organization (andere functie buiten organisatie) Retirements (pensioen) Other (bijvoorbeeld ontslag of overlijden) Total Beperk het gebruik van other!!! Dia nummer 20

21 Sourcing B. Internal Audit Resources B14. What percentage of your audit engagements are (must add to 100%): Staffed internally: eigen internal auditors Co-sourced: joint audits met combinatie eigen/externe auditor(s) Outsourced: audits volledig uitgevoerd door externe auditor(s) B15. What areas do you source (choose all that apply)? General internal auditing m.n. operational / financial auditing Information Technology (IT) auditing Subject matter expertise Fraud auditing Other None Dia nummer 21

22 B. Internal Audit Resources Sourcing B16. What percentage of the following general areas are sourced? General internal auditing: % Information Technology (IT) auditing: % Subject matter expertise: % Fraud auditing: % % van totale urenbesteding in die categorie door Internal Audit! B17. In the last fiscal year, how many total hours did you receive in sourced internal audit services? Totaal co-sourced + outsourced (alleen externe uren/kosten) Dia nummer 22

23 B. Internal Audit Resources Relationship with External Auditors For the following questions, do not include any statutory audits. B19. What were the total internal audit hours worked on the most recently completed external audit: Bijv. SAS 70, Sox testing, subsidieverklaring B20. How many of the total internal audit hours worked were related to the testing of controls over financial reporting: = Alleen Sox testing B21. Estimate the total external audit hours (both internal audit and external audit combined) worked on the most recently completed external audit: B22. What were the total external audit fees associated with the most recently completed external audit: De laatste, dus alleen als voorbeeld? Vragen zijn niet duidelijk, maar probeer de relatie tussen uren en kosten reëel te houden. Dia nummer 23

24 C. Internal Audit Oversight Chief Audit Executive = Directeur IAD of vergelijkbare functie (hoogste functie binnen IAD nemen) C2. The CAE reports administratively to: Administratively = Puur hiërarchisch, voor de declaraties en de potloden C3. The CAE reports functionally to: Functionally = Functioneel, inhoudelijk, CAE beoordelaar, beloning bepalend Audit Committee, or equivalent AC sec of voorzitter AC General / Legal Counsel Hoofd Juridische Zaken (?) Chief Executive Officer (CEO) Voorzitter Raad van Bestuur President or Government Agency Head Chief Financial Officer(CFO) op hoogste niveau in organisatie Chief Operating Officer (COO) op hoogste niveau in organisatie Chief Risk Officer (CRO) op hoogste niveau in organisatie Controller groepscontroller Other Dia nummer 24

25 C. Internal Audit Oversight Audit Committee C6. Do you have an audit committee, or its equivalent? Yes / No Voor concerns is de NL-situatie relevant voor een positief antwoord. Indien er alleen een concern-ac bestaat dat nadrukkelijk ook de NL auditactiviteiten meeneemt in haar toezicht, is het antwoord toch Ja. Indien in NL een platform/commissie bestaat dat in de geest acteert als een echt AC, dan kan vraag C6 met Ja beantwoord worden. De overige vragen onder C dienen analoog hieraan te worden beantwoord. Dia nummer 25

26 C. Internal Audit Oversight Audit Committee C7. How many people sit on your audit committee, or equivalent? Alleen RvC-leden (= non executives van Board of Directors), dus geen gasten als de RvB-leden, interne accountant en/of externe accountant. C8. Who chairs your audit committee, or equivalent? Chairman of the Board of Directors (or equivalent) Vz RvC Other independent Board of Directors member Ander RvC-lid Chief Executive Officer (CEO) or Government Agency Head Vz RvB Other individual outside of the organization Chief Financial Officer (CFO) Chief Audit Executive (CAE) Other Not applicable Nederland: Angelsaksische landen: Raad van Bestuur / Raad van Commissarissen Board of Director met Executive en Non Executive members Dia nummer 26

27 D. Risk Assessment and Audit Planning D1. Do you have a defined audit universe? (yes/no) Ja, indien het audit universum (in algemene termen) is gedefinieerd D3. How many audits did you plan in the last fiscal year? D4. How many audits did you actually perform in the last fiscal year (exclude management requests not in original audit plan)? Schatting of, indien mogelijk, een berekening maken van de dekkingsgraad Dia nummer 27

28 D. Risk Assessment and Audit Planning D5. How many unplanned audits did you perform in the last fiscal year? (nieuw in 2009) D7. What percentage of total hours built into your audit plan is categorized as unallocated time for future, unplanned, or ad-hoc audit requests? (nieuw in 2009) Dia nummer 28

29 D. Risk Assessment and Audit Planning D6. What percentage of your audit plan is the following (must sum to 100%): Assurance engagements Financial en operational audits Consulting engagements Specifieke opdrachten voor beoordeling van design van processen & procedures, risk management; meedraaien in stuur- en werkgroepen Management requests Fraud investigations Follow-up audits TOTAL Verzoeken van het management die aan het op risico-analyse gebaseerde audit plan worden toegevoegd Specifiek gericht op implementatie van verbeteracties n.a.v. een eerdere audit Automatic calculation Dia nummer 29

30 D. Risk Assessment and Audit Planning Organization / Internal audit activity Risk Assessment D15. Internal audit activities can utilize risk categories in their risk assessment process and may also use these categories to communicate the results of the risk assessment to management and the audit committee. Do you utilize risk categories in your risk assessment? YES/NO Voorbeelden: financial risk, operational risk, legal risk, reputation risk, compliance/integrity risk, strategic risk. D16. How many risk categories do you use? D17. What percentage of your risk categories are covered by your audit plan? Onduidelijk hoe die beantwoord moet worden. Schatting van welke Altijd --- Nooit. Dia nummer 30

31 D. Risk Assessment and Audit Planning Audit Engagement Risk Assessments D18. Does your audit activity complete engagement-level risk assessments? Always / Sometimes / Never Hier gaat het om een risico-analyse per onderzoek. D19. How do you gather information for the engagement-level risk assessments (choose all that apply)? Questionnaires / Interviews / Process documents and flowcharts / Other / Not applicable Dia nummer 31

32 E. Audit Implementation/Life cycles/reporting INVULLEN OP BASIS VAN URENREGISTRATIE, ANDERS ZO GOED MOGELIJK SCHATTEN E1. What percentage of your audit staff time (including sourced staff) was devoted to (should add to 100%): Assurance engagements ZIE EERDER VOOR ONDERSCHEID Consulting engagements Fraud investigations Management requests Follow-up audits External audit assistance Non-chargeable time training Non-chargeable time other Absences TOTAL (automatic sum) E2. What was the distribution of total time (as a percentage) on typical audits (should add to 100%)? Planning = VOORBEREIDING TOT AAN BEGINGESPREK Fieldwork = VELDWERK TOT EN MET SLOTGESPREK EN AFSTEMMING BEVINDINGEN/CONCLUSIES Reporting = RAPPORTAGEFASE INCLUSIEF AFSTEMMING RAPPORTAGE TOTAL (automatic sum) Dia nummer 32

33 E. Audit Implementation/Life cycles/reporting E3. On average, how many calendar days does it take to complete the following tasks (should be measured in working/business days): Planning ZIE EERDER Fieldwork Reporting Follow-up ALLEEN ALS DAT KORT NA AUDIT PLAATSVINDT, GEEN KWARTAAL- TOTAL (automatic sum) GEWIJZE FOLLOW-UP MONITORING E4. On average, how many calendar days lapse between the end of fieldwork and the issuance of (should be measured in working/business days): Draft Reports: Final Reports: Dia nummer 33

34 E. Audit Implementation/Life cycles/reporting E9. Did you identify any audit recommendations in the last fiscal year? Yes/No Zal normaliter JA zijn E10. How many audit recommendations were identified in the last fiscal year? Aantal aanbevelingen/verbeteracties in totaal E11. How many major audit findings were identified in the last fiscal year? Conclusies met hoge significantie (prioriteit) E12. How many repeat findings did you identify in the last fiscal year? Gelijke aanbevelingen/verbeteracties in meerdere audits/rapporten Dia nummer 34

35 E. Audit Implementation/Life cycles/reporting Continuous Auditing E15. Does your organization currently perform continuous auditing? Yes / No, but we plan to start this year / No E16. Who is responsible for continuous auditing in your organization? Internal audit / Management / Both internal audit and management / Other / Not applicable Continuous auditing is a new and evolving methodology used to automatically perform control and risk assessments on a more frequent basis. Continuous auditing changes the audit paradigm from periodic reviews of a sample of transactions to ongoing audit testing of 100 percent of transactions. It becomes an integral part of modern auditing at many levels. Technology is the key to enabling such an approach; new data warehousing and data mining techniques to receive, process and report large sums of data on a continuing basis, thus fueling the need for continuous monitoring and auditing. Bron: IIA Inc Dia nummer 35

36 G. Performance management Zie ook de IIA professional practices standards Standard 1300 Quality Assurance and Improvement Programs G1. Do you have a formal quality assurance and improvement program? Yes / No Hier wordt gedoeld op een QA en improvement program voor de Internal Audit-functie Standard 1311 Internal Assessments G2. What is your internal audit activity s status with regard to internal assessments (choose all that apply): Our internal audit activity performs ongoing reviews of the performance of the internal audit activity Our internal audit activity performs periodic reviews performed through self-assessment or by other persons within the organization, with knowledge of internal audit practices and The IIA s Standards Our internal audit activity does not have a formal internal assessment process Dia nummer 36

37 G. Performance management Standard 1312 External Assessments G6. Has your organization had an external quality assessment in the last 5 years? Yes / No External Quality Assessment Review (QAR) in last three years: Deze vraag heeft te maken met een externe quality assurance review van de Internal Audit-functie zelf. Bedoeld wordt een separate quality review door een externe partij, anders dan de gebruikelijke review van een individueel dossier door de controlerende externe accountant in het kader van diens jaarrekeningcontrole (dus ook een review door een separate group audit) Het toezicht door AFM / DNB / PVK telt als zodanig niet mee. G8 en G10 t/m G14 alleen invullen als er een externe QAR heeft plaatsgevonden Dia nummer 37

38 G. Performance management Standard 1311 Internal Assessments G15. Do you use the phrase: Conducted in accordance with the Standards in your audit reports and communications? Yes / No / Not applicable Deze zinssnede mag alleen worden gebruikt wanneer een QAR heeft plaatsgevonden met positief resultaat. Dia nummer 38

39 H. Professional development Information Technology H9. Generally speaking, which of the following basic IT knowledge categories do your internal auditors possess (choose all that apply)? Software used in applications Operating system software Network software Perimeter defenses Intrusion detection Authentication controls Application controls Understanding IT risks Audit software tools Microsoft Office Suite None of the above Het gaat hier om alle internal auditors, dus niet specifiek om de IT auditors Dia nummer 39

40 I. Emerging Trends and Leading Practices Risk Identification: I 1. From your perspective, what are the key risks facing your organization today? I 2 From your perspective, what are the key risks your organization will face in the next three years? I 3. Has management shared with you any key risks or issues facing the organization that you have not already indicated above? et cetera Leading Practices: I 9. Please identify any areas within your internal audit activity where you believe you have implemented leading practices or innovative processes: I 10. May we contact you to obtain additional information and insight regarding the practices you have implemented? (yes/no) Open vragen, weinig guidance mogelijk. Dia nummer 40

41 Kosten deelname GAIN Geen: alleen data verstrekken GAIN report $ 225 Extra Specialty Group $ 125 Totaal $ 350 Extra of anders: GAIN CD Report $ 255* Additional copy CD report $ 30 GAIN Paper Report $ 200* *including shipping charges Dia nummer 41

42 Opslaan Sla de questionnaire steeds op na een onderdeel Na een periode van inactiviteit gooit het systeem je eruit, dus ook tussendoor opslaan! Altijd wijzigingen afzonderlijk opslaan Met save & continue wordt het scherm opgeslagenen ga je naar een volgend scherm Summary screen geeft true and false statements Per scherm Mark as completed kan pas nadat gesaved is Als alles is marked completed, kun je pas submitten Zie verder General instructions

43 Tijdpad GAIN april 2009: 20 mei 2009: Deadline submitten ingevulde questionnaires Ontvangst rapportages en (zelf)analyse 9, 10, 11 juni 2009: Evaluatie bijeenkomsten Uitwisseling ervaringen, onderling bespreking resultaten, noodzakelijke correcties opsporen (afspreken GAIN Round table-onderwerpen) 22, 23, 24 september 2009: Round Tables 5 november 2009: GAIN-middag Presentatie van de uitkomsten van de verschillende groepen Dia nummer 43

44 Deadline Submissions DEADLINE SUBMISSIONS 28, 29 april 2009 Ontvangst rapportages Week 21 (18, 19 of 20 juni 2009) Dia nummer 44