IIA Magazine Aug 2017 issue

The Technology Issue

 A technology revolution. Tech is moving at a fast pace and some businesses may not be able to reap the benefits. IA needs to understand the evolving risk landscape related to the business. Tech will continue to disrupt the landscape and IA needs to reassess what data means to them going forward. Auditors help organizations avoid getting into trouble by identifying issues early and avoid them being surfaced by regulators or the media.

The Cyber Readiness Gap. Organizations may not be prepared for the attacks they are expecting. Ransomware is a big issue and thinks will get worse. Only half the organizations surveyed have a plan to address ransomware attacks. IA can help to scrutinize cybersecurity practices and plans. IT security governance needs to include the human factor in corporate risk analysis and assessment. IA can move from a supportive to front-seat role when building crisis-resilient culture.

More than Compliance with ‘A’. Transforming a compliance program into a value-adding activity starts with IA. Compliance with AML regulations are important. However, many managers do not see value in compliance work. IA needs to ensure compliance can provide real assurance. It is important to do the right thing and do things correctly. Ask yourself why there is a compliance requirement in the first place. IA needs to work with the first and second line of defence to ensure all risks are being addressed. IA should also question the need for, existence of, and adequacy of compliance with A. Sometimes, the original risks may not be present and hence the compliance requirement should not be relevant. One needs to examine the adequacy and effectiveness of the mitigating control. The audit needs to maximize the use of resources and analytics. One can use trend analysis to understand whether risk is increasing or decreasing. Effectiveness of controls can be tested with analytics.

‘But it should not be compliance simply for compliance sake. Internal audit should consider the overarching business objective and the controls that help mitigate risk to the achievement of the objective – even when examining compliance-related controls.’

Stop Clicking, Start Coding. SQL queries can enable internal auditors to uncover greater insights from organizational data. Data needs to be analysed etc. Some auditors are required to learn SQL. It is a language for managing data held in databases. To be good, logical thinking and reasoning are important and necessary for coding. SQL can be tailored for auditing needs and for ad-hoc queries. SQL and other audit software can form a powerful set of analytical tools.

Internal Audit needs risk management too. Managing its own risks can improve the audit function’s performance and demonstrate that it practices what it preaches. One key risk of IA is whether the department is strategically positioned within the organization its objectives. Other risks are whether the department has enough staff, on assurance etc. Reputation risks are important too, and so is compliance risks. Operational risks are like the resourcing problems, annual audit plan etc. If audits are behind schedule by about a month, it needs to be highlighted as a red flag. IA can also do a risk control self-assessment to evaluate internal controls in place.

The Cashier Cash Thief. Mounting family pressures and opportunity cause a trusted warranty clerk to pocket payments from customers. IA must emphasize the importance of SOD and monitor any exceptions. Trend analysis would allow organization to detect fraud more timely. Routine audits are vital for all cash processes. Mandatory vacations and rotation of duties should have prevented fraud from happening.

In Safe Hands. Organizations must grapple with a host of issues when determining how to best protect their data and manage the way it’s used. In Europe, there is a General Data Protection Regulation that goes into effect in spring 2018. It is a stricter regulation than ever before. Firms need to obtain consent for data collected from individuals. IA needs to go back to the drawing board to strike a balance. Respecting someone’s privacy rights is actually a soft skill and needs a soft approach. Privacy controls need to be engineered into business processes. Businesses must be clear about what they need the data for. Many companies do not know where their data comes from and how it is used. IA can be a role model in innovation etc.

Great tech expectations. As technology becomes more integrated with business processes, auditors must raise their IT skills. New auditors usually have better skills than older ones. People with expertise in IT will be in demand. Those with experience in DA will have an advantage over those who don’t. Experience with audit-specific software is also a plus. Auditors need to have an understanding of the infrastructure and applications being used. New authors are not usually well versed in soft skills. IA needs to have a good understanding of flow, controls and governance. Determine the specialty skills needed. Maintaining the right mix of generalists and specialists is a key IT challenge. IA needs to have a training plan for the IT risk and controls. Training hours need to be tracked and there needs to be information sharing at every meeting.

Building a data analytics program. Six strategies can facilitate progress when starting or furthering an analytics program. Many functions suffer from pitfalls/ setbacks. The six strategies are (1) create awareness rather than a silo; (2) understand the data before investing in a tool; (3) plan sufficiently; (4) think big picture; (5) Partner with IT; (6) Take advantage of visualization tools for inspired reporting.

#PurposeServiceImpact. The IIA’s 2017-2018 Global Chairman of the Board J Michael Peppers encourages IA to unify around the three concepts in his powerful hashtag. Purpose, Service and Impact are important words for our profession. It is about the why we do things. We should help enhance shareholder value through our work. Service is basically walking the talk. It is important to establish credibility with clients. We are both change agents and educators and need to do the right thing. Volunteering is important and internal auditors should strive to give back to the society. Always try to make a positive difference. We need to understand the purpose of the organization.

‘The best and most successful internal auditors I know understand that internal auditing is more than just a job: it is a sincere effort to improve the lot of others, whether organizations or individuals.’

The Root of the Matter. Performing root-cause analysis requires that auditors recognize common myths associated with the process. Addressing root cause will prevent the issue from recurring. Complex problems may be due a variety of factors. There may not be a single root cause at times. Use the 5 Why techniques. Sometimes, two root causes can lead to one problem. Some brainstorming is required to address all the root causes. One can use the fishbone diagram and identify problems in different categories like: Man, Machine, Measurements, Method, Materials, and Mother Nature. One can also use scatter diagrams to pair cause and effect and look for relationships. Good recommendations in the audit report should address the root causes of a problem. However, IA should understand that RCA requires time and resources and the organization must weigh the pros and cons of doing it.

Seven Steps to Transformation. IA can assist management throughout the many stages of business change. The first is pre-implementation review. It helps management to identify problems at the planning stage. Ask yourself what is the best ERP project model for ERP packages? The other steps are process/controls analysis, In-flight reviews, IT and User Acceptance Testing and Output/Results testing. The last 2 steps are post-implementation reviews and comparison to project management reviews.

It’s only one word. Excessive audit report wordsmithing is often a disservice to the client – and the audit function. Let those who did the work have a say in the changes. Never make a change unless you can explain why that change is necessary. Otherwise, you are just changing for personal preference. Always explain the reasons for any change to the person who wrote the original drafts. Do not be too anal about phrasing as this will result in rewriting and delays and frustrations.

‘Far too often, the lead, manager, chief audit executive doesn’t like what is written and starts editing the audit report. The process often results in a report the auditor no longer recognizes and, in the worst situations, it says something the auditor never intended it to say.’

The Data Analytics Strategy. Adding analytics to the audit methodology requires careful change management. Funding and resources needs to be provided. Integrate data analytics requirements into the audit methodology. Look for quick wins if possible. Use a champion to lead the strategy. CAE must emphasize that analytics is good as it improves audit efficiency. Analytics can add value not just to fieldwork, but also risk assessment and planning. Data is also evidence and that’s what sells well.

From ratings to Recommendations. Behavioural psychology suggests internal auditors’ approach could benefit from more carrot and less stick. Audit gradings are hated by auditees as it sends a signal that they did something wrong and that things are really bad. The SDT (self-determination theory) shows that human motivation is optimized when the following 3 are present: developing one’s skills (competency); exercising free will (autonomy); feeling connected with others (relatedness). Give your auditee the chance by sharing about common goals and building good relationships with them.



The Art of the Good Life: 52 Surprising Shortcuts to Happiness, Wealth and Success by Rolf Dobelli (Part 4)

Managing Expectations (The Less You Expect, the Happier You’ll Be). Our brains are an expectation machine. Expectations are built without us knowing as well, on a subconscious level. Do not have excessively high expectations of certain events. If your expectations regarding income rise faster than your income, you will be disappointed. Besides feeding yourself, you don’t have to do anything else. There are very few true necessities in life. Learn to erase supposed ‘necessities’ from your life. It is good to have desires, but do not be shackled by them. Not all your desires will be fulfilled. Your preferences are sometimes out of your control. Try not to have expectations of others, as they are beyond your control. To live a good life, draw distinctions between necessities, desires and expectations. You need to keep them separate. Managing your expectations is part of a good life.

Research confirms that expectations have a profound impact on happiness, and that unrealistic expectations are among the most effective killjoys. – Rolf Dobelli

Sturgeon’s Law (How to Tune your bullshit detector). Sturgeon’s Law states that 90% of everything is crap, regardless of what field you are in. To re-phrase, 90% of intellectual things are bullshit. Knowing this is good, as you can filter what you see, hear or read without feeling guilty. Concentrate on being selective in your absorption of content. In life, you will come across a lot of trash, but you need to be able to tune those out. It is easier said than done. Recognize the difference between ideas and good ideas. If you’re not sure whether something is bullshit, it’s bullshit.

In Praise of Modesty (The Less Self-Important You Are, the Better Your Life will be). Even great people will be forgotten in 4 generations or so. The problem with humans are that we are too attached to a sense of self-esteem. Our ego is too big. To live a good life, avoid being too full of yourself. Avoid standing upon your ego too much. Focus on your work and do not brag. The self-serving bias afflicts those who have a big ego in life. They may also over-estimate their abilities in life.

In a hundred or two hundred years at the most, hardly anybody will know who Bill Gates, Donald Trump or Angela Merkel were. And as for the two of us – you, dear reader, and me – a few decades after we’re gone nobody will spare us a second thought. – Rolf Dobelli

Inner Success (Why Your Input is more important than your output). Magazines sometimes produce a list of the most successful and powerful people in the world. Modern societies highlight material success a lot. Why are there no lists for people who are the most satisfied? Definitions of success depends on the product of their time. Don’t follow others blindly. Material success is 100% a matter of chance. True success is inner success. Once you have achieved tranquillity of the soul, you will be able to put up with slings and arrows. You can control your input, but not your output. Inner success is more stable than external success. Take stock of your accomplishments at the end of each day. People desire external gain as it gives them internal gain.

Success is a peace of mind, which is a direct result of self-satisfaction in knowing you made the effort to do your best to become the best that you are capable of becoming. – John Wooden

Afterword. The good life is no easy task. Instead of relying on intuition, one should be aware of the biases/heuristics that the mind is susceptible to. Intellectual tools are more important than money. If your friend is not leading a good life, you will know it instantly. This book has provided insights on Stoicism. Throughout this book, I have quoted Charlie Munger and Warren Buffett. This book combines the principles of modern psychology, Stoicism and the philosophy of value investing.




The Art of the Good Life: 52 Surprising Shortcuts to Happiness, Wealth and Success by Rolf Dobelli (Part 3)

The Book of Worries (How to Switch off the Loudspeaker in Your Head). Everyone has to have the right setting on anxiety. That’s the way humans were wired, to be slightly anxious and wary of our surroundings. In the past, anxiety was useful as it ensured the survival of humans. But in modern day, such anxiety is unproductive. Anxiety will simply affect your sleep quality. Excessive anxiety will lead to stress. Fear is enough. There isn’t a switch to turn off the loudspeaker in your head. One trick is to write down your anxieties in a book at a fixed time everyday. Think about the worst possible consequences. Take out insurance. Focused work can definitely help against brooding as it very fulfilling in nature.

Determine what you can influence and what you can’t. Address the former. Don’t let the latter prey on your mind. – Rolf Dobelli

The Opinion Volcano (Why you’re Better Off Without Opinions). Difficult questions require thought and not simply muttering an opinion. The human brain is a volcano of opinions. We express opinions on topics which do not interest us. It would be better for you to shut up. We think we know answers on unanswerable questions. We give over-hasty answers to complex questions. The trick is to not keep on feeling that you need to give an opinion. Select the topics of your interest carefully. Writing is the ideal way to organize your thoughts. Question your own opinion to see if it can stand up to scrutiny.

Your Mental Fortress (The Wheel of Fortune). One needs to accept the existence of fate. Everything can be turned on their head all of a sudden. Everything you own, value and love is ephemeral. These things are fleeting and temporary. Thirdly, understand that the positive outweighed the negative in your life and that all sweet things are tinged with bitterness. However, no one can take your thoughts and your mental tools. These are the principles of stoicism. Happiness can only found in your mental strength and resolve, not in a Porsche collection.

Envy (Mirror, Mirror, on the Wall). Envy is one of the most toxic emotions. It has many destructive powers. Envy is one of the most important sources of unhappiness. Envy is an animal instinct. The trick is to stay clear of comparisons in order to enjoy a good life. Social media also contains information about others. Do not be envious of the neighbour’s car as car is unlikely to be able to bring someone happiness.

This is the interesting thing about envy: the more we compare ourselves with others, the greater the danger of jealousy. – Rolf Dobelli

The images uploaded have nothing to do with your friends’ normal lives. They’ve been meticulously curated, giving the fake impression that others in your social circle are doing better than they really are. – Rolf Dobelli

Prevention (Avoid Problems Before You Have to Solve Them). What is wisdom? It is a practical ability which we need to navigate life. Avoidance isn’t sexy. Successes achieved through prevention are invisible to others. The financial press loves a good turnaround manager. Hence, we underemphasize the role of some people in society. It is better to steer clear of danger because of your wisdom of foresight.

Mental Relief Work (Why You’re Not Responsible for the State of the World). Sometimes, we hear about the injustices in the world. However, there is nothing we can do about them personally. Most catastrophes are more complex than they seem to be. Don’t overestimate your ability. If you want to help reduce suffering on the planet, donate money. Voluntary work using your time is largely unproductive and you would be better off investing in your circle of competence. It would be smarter to pay and let the professionals do the work. Drastically restrict your news consumption – especially when it comes to catastrophes. Evil is all around us, and some things are hard to prevent. You’re not responsible for the state for the world.

The Focus Trap (How to Manage Your Most Important Resource). Focus is important, but you need to know where to direct it. The problem is that in modern society we are distracted by many notifications etc. Focus is an important resource. Don’t confuse what is new with what’s relevant. Avoid content or technology that’s free. Avoid absorbing information from multimedia as books are less distracting. Act from a position of strength. Focus can affect your happiness directly too.

If you deliberately focus your attention, you’ll get more out of life. Be critical, strict and careful when it comes to your intake of information – no less critical, strict and careful than you are with your food or medication. – Rolf Dobelli

Read Less, but Twice – On Principle (We’re Reading Wrong). Get through life via 50 books that you have read. I can faintly recall the content of books I have read. Little of the books you have read, you can remember. What’s the point of reading a book if you can’t remember the content? Why do humans retain so little of what we read? The problem is that we are not selective or thorough enough. Now, I am more selective with my reading and sometimes even read the same book twice. When young, read widely and do not restrict yourself. This is the stage where you are improving your powers of judgment. After you are 30, be very selective about what you read.

The effect of reading twice isn’t twice the effect of reading once. It’s much greater – judging by my own experience, I’d put it at a factor of ten. – Rolf Dobelli

The Dogma Trap (Why Ideologues Oversimplify Things). Humans think we know things very well until we are forced to explain them. This is the knowledge illusion. Special issues require a lot of thought. We need to account for the effects of the effects of doing something. Ideologies are very dangerous. Notice when you are falling for an ideology. An ideology is one which can seemingly explain everything. Remember to give dogmas a wide berth.

Mental Subtraction (How to Realize that You’re Happy). How generally happy are you with your life? Gratitude is an important feeling which you need to be appreciative of. Gratitude might not work because of habituation and we get used to things. Instead of focusing on the positives, mental subtraction works too. It can help to boost happiness. Think about how much you’d miss the things you do have if you didn’t have them any longer.

Our happiness is sometimes not very salient. We need to do what we can to make it more so. Imagine playing a piano and not being able to hear what it sounds like. Many activities in life are like playing a piano that you do not hear. – Rolf Dobelli

The Point of Maximum Deliberation (Thinking Is to Acting Like a Torch is to a Floodlight). The best ideas come to you while you write them down. Action speaks louder than words. Doing beats talking anytime. The world is opaque to us. To go beyond what we know, we have to forge ahead and act. This is the point of maximum deliberation. This is when all the facts are laid on the table and you have digested them. Meditation won’t help you anymore, if there are no more new acts. Stranded on an island, who would you rather be by your side? Your partner? A Consultant? A boatbuilder? You won’t achieve the good life simply by thinking about things you ought to do. Self-inquiry will get you bogged down in moodiness, vague thoughts etc.

An entrepreneur won’t know whether a product will be successful until she produces it and launches it onto the market – no matter how much consumer research she’s done. – Rolf Dobelli

If you’re simply thinking something over, you’ll never bump up against reality, which means you can never fail. Act, however, and suddenly failure is back on the cards – but you’ll gain new experiences. – Rolf Dobelli

Other People’s Shoes (Role Reversal). Sometimes, it helps to take the place of someone else. The issue might be resolved more quickly. You got to see things from someone’s else perspective. Role reversal is a quick way to build mutual understanding. Reading novels can help you to build empathy fast.

Being immersed in a good novel, accompanying the protagonist throughout both highs and lows, is an efficient workaround that sits somewhere between thinking and doing. – Rolf Dobelli

The Illusion of Changing the World (Part 1 – Don’t Fall for the “Great Men” Theory). Can you really change the world? Modern society are very optimistic for the individual. We see ourselves as engineers of the world. However, the idea that any individual can change the world is a grand illusion. The first problem is the focusing illusion. We over-estimate the importance of our projects. The next bias is the intentional stance such as ‘without Einstein, there would be no relativity theory’. However, without such great people, things would have happened, just with someone else at the helm. Individual humans do not shape history, but there are a myriad of factors driving it. Do not cling on to the illusion, that you can be a great man yourself.

The Illusion of Changing the World (part 2 – Why you shouldn’t put anyone on a pedestal – least of all yourself). Other inventors, if Edison wasn’t around, would have invented the light bulb. Hence, the light bulb would still have been invented. Technology will find its inventors, not vice versa. Even without Steve Jobs or Bill Gates, things would not have changed much. Even outstanding CEOs can’t control market forces. A lot of them are forgotten people already. Hence, we need to be modest about our own achievements.

No matter how extraordinary your accomplishments might be, the truth is that they would have happened you. Your personal impact on the world is minute. It doesn’t matter how brilliant you are. – Rolf Dobelli

The only place where you can really make a difference is in your own life. Focus on your own surroundings. You’ll soon see that getting to grips with that is ambitious enough. Why take it upon yourself to change the world? Spare yourself the disappointment. – Rolf Dobelli

The ‘Just World’ Fallacy (Why Our Lives Aren’t Like Classic Crime). We believe in justice and equality and cannot bear injustice. We believe good deeds will be rewarded and bad deeds will be punished. We need to accept the unfairness of the world. In life, we have to put up with a bit of unfairness. Humans like to think everything will turn out fine. The world is fundamentally amoral. Part of the good life is to accept that not everything is fine.

The things that happen to you across the course of your life, especially the more serious blows of fate, have little to do with whether you’re a good or a bad person. So accept unhappiness and misfortune with stoicism and calm. – Rolf Dobelli

Cargo Cults (Don’t Build Planes out of Straw). Many people try to emulate their idol’s behavior or mannerisms, but they can’t achieve the same success. Auditors like to tick boxes, but are so good at identifying risks. Avoid companies that reward ceremony over achievement. Learn to understand what truly made people successful first.

Star far away from any type of cargo cult. And be on your guard: the substanceless imitation of form is more common than we think. – Rolf Dobelli

If You Run Your Own Race, You Can’t Lose (Why General Knowledge is Only Useful as a Hobby). You can recite facts about your own area of expertise. However, what do you know outside your expertise? The more you fill your brain with specialized knowledge, the less you will have for general knowledge. We see ourselves as versatile specialists. Our general knowledge gets affected by this. Our ancestors were better at more things, because they didn’t specialize. Now, society only rewards the specialists. If you are not the best in your field, you will have to specialize further. It is okay to have some general knowledge, but you won’t make a career out of it and do not spend excessive amount of time on it.

The Arms Race (Why You Should Avoid the Field of Battle). Students are trapped in a paper race, because others have degrees too. However, taking into account the education cost, they are barely better off than those without degrees. If you are in an arms race, get out if you can. Find a niche where there is no competition. Find a niche where you can operate smoothly and confidently. Humans are pressured to do many things in modern society. If you want a career as a musician, avoid the piano and the violin as there is too much competition in the area. Steer clear of arms race.

Making Friends with Weirdos (Get to know Outsiders but Don’t be one Yourself). People who do not belong in groups can be very successful too, like Einstein. Many of these people can be termed as outsiders. They enjoy an advantage as they don’t have protocols to slow them down. They also look more deeply and learn to question the status quo more. There is an appeal to being one. However, do not be one. Only the brightest outsiders can succeed. Your best chance is not to leave the establishment. Make friends with outsiders and be interested in their work. Practice reciprocity and tolerance. Surround yourself with smart people and outsiders as they might give you a fresh perspective on things and life.

The Secretary Problem (Why Our Sample Sizes are too Small). If you have 100 people to interview for the secretary position, how would you go about it? Take the first good candidate? Or interview many and then assess the feel of the quality of the pool? Statistically, one should interview the first 37 candidates and reject them all; however, you should monitor their quality. Then you should continue interviewing until you find someone better than the previous 37 and then hire her. Although it may not be directly applicable to real life, it can give you guidelines about how long we should be spending time testing things before making a final decision. Try out different options in life first. Understand what are the different options out there. We tend to make decisions too soon and too hasty. Sometimes, our sample size are too small. The trick is to take as many samples as you while you are still young. Be receptive and learn.

Read widely, because novels and short stories are excellent simulations of life. Only as you age should you adapt your modus operandi and become highly selective. By then you’ll know what you like and what you don’t. – Rolf Dobelli