内部审计增值课件三.pptx

InternalAudit AddingValueMay31 June3 2011Lesson3 UrtonAnderson CIA CCSA CGAP CFSA PhDClarkW ThompsonJr ProfessorinAccountingEducationTheUniversityofTexasatAustin Lesson3 NanjingAuditUniversity 1 Agenda Lesson1IntroductionTheinternalauditvaluepropositionRiskassessmentandriskmanagementRiskandauditresourceallocationLesson2InternalcontrolMonitoringAuditplanningcaseTheIPPFLesson3CapabilitymaturitymodelsEffectiveComplianceSystemsAssessingthecomplianceandethicsprogramCompliance ethicscaseLesson4Consultingservices blendedconsultingengagementsBlendedconsultingcaseCombinedAssurance AssuranceMapping Lesson3 2 NanjingAuditUniversity CapabilityMaturityModels WhatisaCapabilityMaturityModel OriginsoftheCMMmodelCMMasanaudittoolCMMappliedtoInternalAudit Lesson3 3 NanjingAuditUniversity WhatisaCapabilityMaturityModel Amodelthatdescribesanevolutionarypathofincreasinglyorganizedandsystematicallymorematureprocesses TypicallyfivelevelsareusedInitial adhoc RepeatableDefinedMatureOptimized Lesson3 4 NanjingAuditUniversity CapabilityModelLevels IAexample Lesson3 5 NanjingAuditUniversity StructureoftheCCM Purpose CapabilityLevel Activities Outputs Outcomes Mastery KeyProcessArea KeyProcessArea KeyProcessArea Lesson3 6 NanjingAuditUniversity Elementsofthematuritymodel LevelscomposedofKeyProcesses KPAs aclusterofrelatedactivitiesthat whenperformedcollectively achieveasetofgoalsconsideredimportant Goal Purposeofakeyprocessareasummarizethestatesthatmustexistforthatkeyprocessareatohavebeenimplementedinaneffectiveandlastingway Theextenttowhichthegoalshavebeenaccomplishedisanindicatorofhowmuchcapabilitytheorganizationhasestablishedatthatmaturitylevel CommonFeaturesofaKPA Therearefivetypesofcommonfeatures CommitmenttoPerformAbilitytoPerform ActivitiesPerformed MeasurementandAnalysisVerification InstitutionalizingPractices ThekeypracticesdescribetheelementsofinfrastructureandpracticethatcontributemosteffectivelytotheimplementationandinstitutionalizationoftheKPAs Lesson3 7 NanjingAuditUniversity OriginsoftheCMMmodel DevelopedbyCarnegieMellonUniversityin1980sAssesstheabilityofdefensecontractorstodevelopsoftwareModelbeenextendedtolookatotherprocess Lesson3 8 NanjingAuditUniversity Lesson3 9 NanjingAuditUniversity Lesson3 10 NanjingAuditUniversity IAModel InternalAuditCapabilityModel IA CM forthePublicSector IIAResearchFoundation2009 Lesson3 11 NanjingAuditUniversity UnderlyingPrinciples IAResponsibilityBeanintegralcomponentofeffectivegovernanceinthepublicsector Helporganizationsachievetheirobjectivesandaccountfortheirresults Organization sResponsibilityDetermineoptimumlevelofIAcapabilitytosupportrequiredgovernancestructures Achieveandmaintainthedesiredcapability Lesson3 12 NanjingAuditUniversity SelectingOptimumCapability Threevariables Environment Organization IAactivity Differentcapabilityrequired Auditingmustbecost effective No onesizefitsall Lesson3 13 NanjingAuditUniversity WhatareIA sKPA Purpose CapabilityLevel Activities Outputs Outcomes Mastery KeyProcessArea KeyProcessArea KeyProcessArea Lesson3 14 NanjingAuditUniversity IAActivityElements TheIAactivityconsistsofthefollowingsixelements ServicesandroleofIA Peoplemanagement Professionalpractices Performancemanagementandaccountability Organizationalrelationshipsandculture Governancestructures Lesson3 15 NanjingAuditUniversity InternalAudit CapabilityModelMatrix Lesson3 NanjingAuditUniversity 16 Lesson3 17 NanjingAuditUniversity Lesson3 18 NanjingAuditUniversity EffectiveComplianceandAssessingtheComplianceandEthicsProgram Lesson3 19 NanjingAuditUniversity WhyspendtimeoncomplianceElementsofaneffectivecompliancesystemAssessingtheeffectivenessofthethecomplianceandethicsprogram IncreasedImportanceofCompliance Significantconsequencesofthemanyrecentfailuresoforganizationstoabidebylawsandregulationsandtoexhibitethicalbehaviorhaveraisedsocietalawarenessofthecostoforganizationalcorruptionandincreaseddemandthatorganizationsbeheldaccountable Lesson3 20 NanjingAuditUniversity ComplianceRequirements Lesson3 21 NanjingAuditUniversity Lesson3 22 NanjingAuditUniversity FactorsIncreasingComplexityoftheLegalandRegulatoryEnvironment TechnologicalAdvancementsGlobalizationIncreasedInterdependencyofOrganizationsDemandforAccountability Lesson3 23 NanjingAuditUniversity WhataretheCosts 2007 SchnitzerSteelIndustriesInc sSubsidiaryPleadsGuiltytoForeignBribes Agreesto 7 7MillionCriminalFine subSSIKoreawouldpaya 7 5millioncriminalfine2007 BakerHughesagreedtopaythelargestFCPApenaltyinhistory todate 44million includedacriminalfineof 11millionandacivilpenaltyanddisgorgementofapproximately 33million2008 SiemensAG s 1 6BillionPenaltyforBribingForeignOfficials 800milliontoUSresttoGermanauthorities doesnotincludethe 1 2Billionpaidtoattorneysandaccountantsfordefense Lesson3 24 NanjingAuditUniversity WhataretheDirectCosts 2001 TAPPharmaceuticalProducts TakedaChemicalandAbbott 875milliontosettlecivilandcriminalchargesofillegallymarketingandmanipulatingthecostsofLupron aprostatecancerdrug undertheMedicareandMedicaidprograms2000 HCAsubsidiariespledguiltytosubstantialcriminalconductandpaidmorethan 840millionincriminalfines civilrestitutionandpenalties2003 HCAagreedtopaytheUnitedStates 631millionincivilpenaltiesanddamagesarisingfromfalseclaimsthegovernmentallegeditsubmittedtoMedicareandotherfederalhealthprograms2008 TenentHealthcare 900million Lesson3 25 NanjingAuditUniversity WhataretheCosts 2008UnitedHealthsettlesbackdatingsuitsfor 912M2009 Pfizer PleadsguiltytofederalcriminalchargesofillegallymarketingpainkillerBextra 2 3billion includes 1 3billionincriminalpenalty3rdCorporateintegrityAgreement 2002 Lipitor 2004 Neurontin Lesson3 26 NanjingAuditUniversity WhataretheCosts March2010BAEpleadsguiltyandagreesto 400millionforFCPAviolationsand 30milliontoUKOctober2010GlaxoSmithKlinedistributedadulterateddrugs 750criminalfineandforfeituretotaling 150millionandacivilsettlementundertheFalseClaimsActandrelatedstateclaimsfor 600million NanjingAuditUniversity Lesson3 27 NotJustUSIssue TheOrganizationforEconomicCo OperationandDevelopment OECD GoodPracticeGuidanceonInternalControls EthicsandCompliance March2010AnnexIIof RecommendationoftheCouncilforFurtherCombatingBriberyofForeignPublicOfficialsinInternationalBusinessTransactions December2009 Agreementof38countries SupportsFCPAIncludes ComplianceElementsofFedSentencingGuidelines UK Lesson3 28 NanjingAuditUniversity FederalSentencingGuidelinesforOrganizations WentintoeffectinNovember1991Notjustcorporationssignificantlyincreasedexposureoforganizationstolossesbecauseofcriminalactsofemployeespriorto1991rarelyharsh fineslessthan 150 000andmostunder 10 000andlimitedrestitution 20 ofcasesandusuallylessthan 50 000 Lesson3 29 NanjingAuditUniversity FederalSentencingGuidelinesforOrganizations Fourmethodsofpunishment1 restitution2 fines3 probation4 specialassessment forfeitureandcosts Lesson3 30 NanjingAuditUniversity FederalSentencingGuidelinesforOrganizations Impact muchhigherfines threatofprobation restitutioncostprobablynotchangesincealreadydonethroughcivillaw finesincreasedsignificantlyupto 100sofmillions probation uptofiveyears notificationofemployeesandshareholders periodicallyreportingtocourt unannouncedauditsbyprobationofficerorcourtappointedexpert insomecasecourtmayappointtrustee Lesson3 31 NanjingAuditUniversity FederalSentencingGuidelinesforOrganizations Effectivecomplianceprogramisamajorconsiderationindeterminingpunishment canreducefinesfrom30 to91 probationrequiredifattimeofsentencingnotevidenceofeffectivecomplianceprogram Lesson3 32 NanjingAuditUniversity FederalSentencingGuidelinesforOrganizations Effectivecomplianceprogramisamajorconsiderationindeterminingpunishment canreducefinesfrom30 to91 probationrequiredifattimeofsentencingnotevidenceofeffectivecomplianceprogram Lesson3 33 NanjingAuditUniversity Whatisintentbehindguidelines sanctionsimposeduponorganizationsandtheiragents takentogetherwillprovide incentivesfororganizationstomaintaininternalmechanismsofpreventing detecting andreportingcriminalconduct Lesson3 34 NanjingAuditUniversity EffectiveCompliance Lesson3 35 NanjingAuditUniversity WhatisCompliance Itisasystemofindividuals processes andpoliciesandproceduresdevelopedtoensurecompliancewithallapplicablefederalandstatelaws industryregulations andprivatecontractsgoverningtheactionsoftheorganization Acomplianceprogramisnotmerelyapieceofpaperorbinderonashelf itisnotaquickfixtothelatesthotproblem itisnotacollectionofhollowwords Acomplianceprogram aneffectivecomplianceprogram mustbealiving ongoingprocessthatispartofthefabricoftheorganization Acomplianceprogrammustbeacommitmenttoanethicalwayofconductingbusinessandasystemforhelpingindividualstodotherightthing Lesson3 36 NanjingAuditUniversity FederalSentencingGuidelinesforOrganizations Effectivecomplianceprogramisamajorconsiderationindeterminingpunishment canreducefinesfrom30 to91 probationrequiredifattimeofsentencingnotevidenceofeffectivecomplianceprogram Lesson3 37 NanjingAuditUniversity Criteriaforeffectivecomplianceprogram 7minimalrequirements 1 establishstandardsandprocedurestobefollowedbyemployeesthatarereasonabletoreducethechanceofcriminalconduct e g codeofethics 2 specificindividualwithinuppermanagementorboardassignedoverallresponsibilitytooverseecomplianceprogram ChiefCompliance EthicsOfficer Lesson3 38 NanjingAuditUniversity Criteriaforeffectivecomplianceprogram 7minimalrequirements 3 organizationmustuseduecarenottodelegatesubstantialdiscretionaryauthoritytoanindividualwhomtheorganizationknows orshouldknow tohavepropensitytoengageinillegalactivities Backgroundchecks 4 effectivelycommunicatetheprogram sstandardsandprocedurestoallemployees trainingandtranslation 5 takereasonablestepstoachievecompliance monitoringandaudit Lesson3 39 NanjingAuditUniversity Criteriaforeffectivecomplianceprogram 7minimalrequirements 6 standardsconsistentlyenforcedthroughappropriatediscipline includingdisciplineofindividualsresponsibleforfailuretodetectoffense recordsandpolicies 7 afteroffensedetected takeallreasonablestepstorespondappropriatelytotheoffenseandtopreventsimilaroffenses investigationandreview Lesson3 40 NanjingAuditUniversity AdditionalGuidelinesforEffectiveComplianceandEthicsPrograms 2004FederalSentencingCommissionamendmentscompliancesystemtobeeffectiveorganizationsarenowrequiredto conductongoingriskassessmentandtakeappropriatestepstodesign implement ormodifyeachstepsetforthinsubsection b i e thesevenminimalelementsofaneffectivecomplianceprogram toreducetheriskofviolationsoflawidentifiedbytheriskassessment Lesson3 41 NanjingAuditUniversity AdditionalGuidelinesforEffectiveComplianceandEthicsPrograms assessperiodicallytheriskthatviolationsoflawwilloccur i Thenatureandseriousnessofsuchviolationsoflaw ii Thelikelihoodthatcertainviolationsoflawmayoccurbecauseofthenatureoftheorganization sbusiness iii Thepriorhistoryoftheorganization Thepriorhistoryofanorganizationmayindicatetypesofviolationsoflawthatitshalltakeactionstopreventanddetect Lesson3 42 NanjingAuditUniversity ElementsofanEffectiveComplianceandEthicsProgram Inaddition organization wideperiodicriskassessmentandmanagementprocessdesignedtoreducetheriskofoccurrenceofcriminalconducttoanacceptablelevelComplianceProgramsaredesignedtoestablishaculturewithinaorganizationthatpromotesprevention detectionandresolutionofinstancesofconductthatdonotconformtofederalandstatelaw aswellastheorganization sethicalandoperationspolicies Lesson3 43 NanjingAuditUniversity AnEthicalBusinessCulture a Tohaveaneffectivecomplianceandethicsprogram forpurposesofsubsection f of 8C2 5 CulpabilityScore andsubsection c 1 of 8D1 4 RecommendedConditionsofProbation Organizations anorganizationshall 1 exerciseduediligencetopreventanddetectcriminalconduct and 2 otherwisepromoteanorganizationalculturethatencouragesethicalconductandacommitmenttocompliancewiththelaw Fed Sent GuidelinesChapter8 Lesson3 44 NanjingAuditUniversity Lesson3 NanjingAuditUniversity 45 EthicalCulture 2010 OrganizationalCulture Whatdowemeanbyanorganization s culture Canyougiveanexampleofanorganization s culture Lesson3 46 NanjingAuditUniversity OrganizationalCulture FormalversusInformalAlignmentofformalandinformal Lesson3 47 NanjingAuditUniversity IssueofAlignment DidEnronhavealignment Lesson3 48 NanjingAuditUniversity CodeofEthics Page57 Lesson3 49 NanjingAuditUniversity CultureMatters 24 observedmisconductinstrongvs 98 inweak Lesson3 50 NanjingAuditUniversity AssessingtheEffectivenessoftheComplianceandEthicsProgram Lesson3 51 NanjingAuditUniversity Assessment ProvideAssurance BoardManagement Lesson3 52 NanjingAuditUniversity IIAStandards 2110 A1 Theinternalauditactivitymustevaluatethedesign implementation andeffectivenessoftheorganization sethics relatedobjectives programs andactivities Lesson3 53 NanjingAuditUniversity Board sRole 2 A Theorganization sgoverningauthorityshallbeknowledgeableaboutthecontentandoperationofthecomplianceandethicsprogramandshallexercisereasonableoversightwithrespecttotheimplementationandeffectivenessofthecomplianceandethicsprogram Fed Sent GuidelinesChapter8 Lesson3 54 NanjingAuditUniversity ReasonableOversight Adirectorhasadutytoattemptingoodfaithtoassurethat 1 acorporateinformationandreportingsystemexists and 2 thisreportingsystemisadequatetoassuretheboardthatappropriateinformationastocompliancewithapplicablelawswillcometoitsattentioninatimelymannerasamatterofordinaryoperations InreCaremarkInternationalInc DerivativeLitigation 698A 2d959 Del Ch 1996 Lesson3 55 NanjingAuditUniversity Management sResponsibility Toensurethatalloperationsareconductedinaccordancewithapplicablelaw regulationsandpolicies includinginternalpolicies ComplianceProgramsaredesignedtoestablishaculturewithinaorganizationthatpromotesprevention detectionandresolutionofinstancesofconductthatdonotconformtofederalandstatelaw aswellastheorganization sethicalandoperationspolicies Lesson3 56 NanjingAuditUniversity AuditingComplianceSystemEffectiveness Part1 Theassessmentoftheentitylevelcontrolsoverthecomplianceprogramwhichataminimumwouldincludeevaluatingtheorganization sprocessforassessingriskofnoncomplianceandethicalmisconductandthedesignandimplementationofsevenelementsoftheGuidelines Lesson3 57 NanjingAuditUniversity AuditingComplianceSystemEffectiveness Part2 Evaluatingtheeffectivenessofcontrolsspecificallydesignedtoreducetheriskofnoncomplianceinthehighriskareasidentifiedbytheorganization sriskassessmentprocess Lesson3 58 NanjingAuditUniversity Lesson3 59 NanjingAuditUniversity AssessingtheComplianceandEthicsProgram Case Lesson3 60 NanjingAuditUniversity SHRCorporation PublicCompanyEuronext AmsterdamNYSERetail highqualitysportinggoodsHowisthecompanydoing Lesson3 61 NanjingAuditUniversity SHRCorporation Whatarethecriticalriskitfaces Lesson3 62 NanjingAuditUniversity Ethics BusinessObjective Todemonstratesoundethicalconductineverythingwedo BusinessRisk Disregardforsoundethicalprinciples eitherintentionalorunintentional maycausemanagersandemployeestocutcorners embellishperformanceresults misusecompanyresources orotherwiseactinamannerthatharmsthecompanyanditsstakeholders Soundethicalconductisakeycomponentofhowwedobusinessandcontinuestocontributesignificantlytothecompany ssuccess Lesson3 63 NanjingAuditUniversity Part1 1 WhatmonitoringprocesseshasSHRimplementedtoaddresstheabo