Internal Audit -

Audit Committee Report

 Key Factors in Determining Content

Understanding Board Expectations

Understanding Board Expectations:
• The audit committee charter
• The internal audit department charter • Understanding board expectations
• Committee members and their backgrounds is critical when determining
focusing on any changes since last meeting content.
• Prior audit committee reports and minutes
• Any arrangements that have been documented • By reviewing key documents such
concerning report content expectations as the audit committee charter,
internal audit can gain an
• Board communication style
understanding of the committee’s
risks and needs .

Frequency of Meetings • It is recommended to meet

separately with the audit committee
(and senior management if deemed
appropriate) to determine reporting
framework and expectations
Allotted Agenda Time upfront.

2
 Typical Audit Committee Agenda

• Call to order
• Review and approval of minutes from prior meeting
• Audit committee report by internal auditors
• Audit committee report by external auditors
• Other matters (legal, hot line, compliance, etc.)
• Committee meeting in executive session
• Formal presentation of quarterly or annual reports to shareholders by CEO and CFO and approval
thereof
• Date and time of next meeting
• Adjournment

• Report by Internal Auditors:

Internal audit will typically report first prior to external audit and other members of senior management (allotted time
may vary during the year).
• Executive Session:
Internal audit should also be prepared to attend the executive session, where outside board members can question
internal and external audit without the presence of senior management.

3
 Typical Contents of an AC Report – Quarterly

• Dashboard report on current activities

Quarterly Audit Committee
• Changes to annual plan Reports:

• Status of the annual audit plan • How reports are summarized

should follow agreed-upon
• Critical findings or emerging trends reporting arrangements.
• The committee may not want to
• Internal audit staffing, impact of resource limitations, and review all reports, although they
costs vs. budget year to date have access to all prepared
material.
• Results of special investigations • The goal is to summarize for the
committee what they need to know
• Department performance metrics / scorecard about routine findings in a logical
summary format, and report
separately on more important
matters such as:
Typical audit committee reports will include a summary of: – Matters that might affect the
fairness of financial reporting.
• Reports issued during the quarter showing most
– Breaches of the company’s ethics
important findings and aggregating others. policies.
• Monitoring and follow-up activities. – Details of any frauds discovered.
• Financial values of any frauds that may have occurred. – Significant delays in management
responding to or acting on findings
and recommendations.

4
 Typical Contents of an AC Report – Annual

• Report on the year in review to include themes or trends

identified Annual Audit Committee
Reports:
• Update of the risk assessment and audit plan
• Report on the results of the internal quality assurance and With the exception of any additional
items, the annual report is typically a
improvement program
summary of the four quarterly
• Discuss the results of the external quality assurance reports.
review, timing / frequency of the external assessment and
reviewer’s background Additional items to cover may
include:
• Review and approve updates to the internal audit
department charter • Statement that all work continues
to be performed in accordance
• Confirmation of the independence of the internal audit with IIA Standards.
activity
• Details of changes in personnel in
• Reporting of any impairments of independence or the internal audit department.
objectivity
• The professional development
• Disclosure of nonconformance with The IIA Standards courses that were given or
attended during the year.

• When the next quality assurance

review of internal audit is
scheduled for.

5
 Sample Calendar

The audit committee agenda will typically include discussion around:

• Internal Audit • Legal, Compliance and Regulatory
• External Audit • Financial Reporting Oversight
• Risk Management • Committee Structure and Function

The table below depicts those areas specific to the internal audit update.
Q1 Q2 Q3 Q4 As Needed

1. Evaluate the Internal and Independent Audit Processes

A. Internal Audit

Charter, mission and objectives P

Appointment and compensation of chief audit executive P
Budget, staffing and resources including resource constraints if any P
Scope, procedures and timing of audits (i.e., audit plan) P
Review of audit results and reports P P P P
Review internal and external quality assurance procedures P
Confirm internal audit independence P

6
Dashboards / Issues Summary
 Dashboard Sample 1

Engagements - Completed Since Last Meeting ERM Assessment and Other Dept. Activities for Q1

1 Low, 5 High • Finalize documentation of audit operating methodologies

• Accounts Payable – Brazil 2
• Analyze money, quality and time costs in current accounts
• Procurement Review – Brazil 2 payable process
• Sales and Distribution – Russia 2 • Reduce the volume of accounts payable transactions
• Disbursements – Nigeria 3 • Implement rigorous, pervasive policies to protect against
disbursement fraud and overpayments
• Europe Regulatory Readiness – Europe 2

• Channel Stocking – China 2

• Retail Channel – Brazil

China 3 Brazil 2

Business Unit Audit RemediationStatus Engagements / Audit Plan Activity for Q1

Business Unit Delinquency Status • Vendor Selection – China

BU1 On Track • Accounts Payable – Russia

BU2 On Track • Employee Disbursements – Mexico / Brazil

BU3 On Track • Supplier Controls Review – Latin America

BU4 On Track • Revenue Recognition – EMEA

BU5 On Track • Accounts Payable - China

BU6 On Track • US Govt. Lobbyist Compliance

8
 Dashboard Sample 2

Reports Issued Q1 Scheduled Events

• Accounts Payable - Brazil TBD – Internal Audit Department Training, location TBD
• Procurement Review - Brazil Campus Recruiting
• Sales and Distribution - Russia
• Disbursements - Nigeria
• Europe Regulatory Readiness - Europe
• Retail Channel - Brazil

Issues Status Summary

Issues Issues Observed in Accounts Payable Audit/Area Issue Status
Reported 50
47 120 109

45
37 100
40

FY10 35
80
30 High
25 Medium High
60
20 15 Medium
15 10
40
10 6 24
3 3 2 3 2 15
5
20 5
0 1 3
Business Corp IT Fraud Operations
Units
0
Revised/Past Due Not Due Closed

Review In Charge Stage DSF March 2011 April 2011

AP - UK Smith Fieldwork N/A
SAP SOD Jones Reporting 14 • China • Privacy – EU
Close the Books Farley Fieldwork N/A • Global Procurement • Acquisition Due
TBD TBD Fieldwork N/A • P-card Diligence
TBD TBD Fieldwork N/A • PCE Compliance
TBD TBD Planning N/A
TBD TBD Reporting 28
TBD TBD Reporting 14
TBD TBD Fieldwork N/A
TBD TBD Fieldwork N/A
TBD TBD Fieldwork N/A
TBD TBD Reporting N/A
TBD TBD Fieldwork N/A

9
 Dashboard Sample 3

Key Message Points

• Cash account reconciliations have improved, however remediation efforts related to system design deficiencies are still ongoing.
• There is no formal communication between AP and the merchandising (buyer) department to develop uniform, beneficial practices for
supplier management, and communication with suppliers should be managed to establish mutually agreeable practices.

Summary of Completed Activities (2nd Quarter) Summary of Completed Activities (3rd Quarter)

• Completed Activities • Audits schedules for Q3

– Payroll – Retail Stores and Back Office
– Accounts Receivable and Vendor Management – Accounts Payable
– Continuation of Premium Accounts Reconciliation Special – Vendor Master File Maintenance
Project

Audit Finding Remediation Status

Risk Rating Beginning Balance Currently Open Past Past Due Findings
New Closed
Category (as of insert date) Open Due 5
5
High 2 1 0 3 0 4.5
4
Medium 10 5 2 13 5 3
3.5
Low 17 0 2 15 3 3
2.5
Total Findings 29 6 4 31 8 2
1.5
1
0.5 0
0
High Medium Low

10
 Dashboard Sample 4

Planned Quarterly Accounts Payable Review

In Process 3%
7% Expense payable, stock and Review vendor master file creation
relay for expense payables
2 1
Review for completeness, Review integrity of interface from
accuracy and timeliness of A/P sub ledger to G/L
input and payment processing
(EDI and Manual)
Issue Status

Review of access to systems Review monthly reconciliation of

9 and check stock / signature A/P sub ledger to G/L
plates
Review PO and invoice Review daily balancing performed
27 matching process (pre and by A/P
post paid)
Review disbursement approval Review vendor maintenance within
process A/P vendor master file (stock and
relay) along with access controls
Completed Review controls over stop
90% payments and reissues

Rating Legend
In Process Reviews
- Unsatisfactory - Needs Improvement
• Review of Vendor master files created by merchandising
- Satisfactory - Not Applicable • MSA on-line (rebates, deductions)
Planned Reviews
• Wire transfers

11
 Dashboard Sample 5
We assessed the existence and effectiveness of controls in relation to the business objectives of the accounts payable process. Possible control
improvements (rated as ‘Moderate’ or ‘Limited Controls’) are referenced to the detailed issues and action plans section for further details.

Detailed Issues and Action Plans

Completeness and Accuracy – Authority / Limit Rating
Reference
Suppliers are properly authorized prior to procuring goods / services. Detailed Issue and Action Plan #5

Accounts Payable disbursements are properly authorized. Detailed Issue and Action Plan #1, #2, #5, #7

Access to applicable AP systems is properly segregated. Detailed Issue and Action Plan #2, #9, #12

Detailed Issues and Action Plans

Timeliness – Effectiveness / Efficiency Rating
Reference

Disbursements are made to maximize cash flow. Detailed Issue and Action Plan #1, #2

Costs are reduced as much as possible. Detailed Issue and Action Plan #2, #7, #8, #10

Processing time is minimized. Detailed Issue and Action Plan #2, #3, #4, #5, #6

Performance measures used to control the process are reliable. N/A

Strong Controls Moderate Controls Limited Controls

12
 Key Issues Summary 1

Issues Business Impact Responsible Due Date

Person

Merchandise Payables – Invoices are paid prior to the Negative impact on cash flow due to
xxx 8/31/YY
verification of the receipt of goods. inaccurate payments to vendors.

Expense Payables – There are no approval and

Vendor will not be the best cost, quality
authorization procedures for supplier selection prior to the xxx 7/31/YY
and time supplier for xxx.
purchase of goods.

Expense Payables – A purchase order system or other Unauthorized disbursements and possible
upfront approval process is not used for recurring financial loss. xxx 12/31/YY
expense or non-merchandise related purchases.

Expense Payables – Proof of receipt is not required to be Inaccurate payments to vendors and
xxx 7/31/YY
submitted with approved invoices prior to payment. possible financial loss.

Multiple versions of the vendor master file are utilized and Inaccurate payments to vendors and
xxx 7/31/YY
maintained. possible additional costs incurred.

Access to the various systems utilized during the AP Loss of data integrity and inappropriate 8/31/YY
xxx
process is not adequately secured or monitored. use of the systems.

13
 Key Issues Summary 2

The following chart summarizes the significant (defined as red and yellow) issues identified between February and April.
Issues are grouped by status (Revised, Not Due or Closed) and by report within the above categories.

Issue Date Report Name Report Rating Coverage Area # of Issues # of Red Issues Status
Date 1 Report 1 COSO Level 4 Geographic 8 8N

Date 2 Report 2 COSO Level 2 Corp Function 0

Date 3 Report 3 COSO Level 1 Geographic 0

Date 4 Report 4 COSO Level 2 Revenue 0

Date 5 Report 5 COSO Level 1 Revenue 0

Date 6 Report 6 COSO Level 1 Corp Function 0

Date 7 Report 7 COSO Level 2 Geographic 0

Date 8 Report 8 COSO Level 3 Geographic 2 2N

Date 9 Report 9 COSO Level 2 IT 0

Date 10 Report 10 COSO Level 2 Revenue 0

Date 11 Report 11 COSO Level 3 Geographic 2 1R, 1N

Date 12 Report 12 COSO Level 2 Geographic 0

Date 13 Report 13 COSO Level 1 Corp Function 0

Date 14 Report 14 COSO Level 2 Geographic 0

Date 15 Report 15 COSO Level 3 Process 1 1C

*Key
The 15 above listed reports include 29 Yellow rated issues. Red issues averaged 7% during the last 12
N Not Due
months. Types of issues continue to include reconciliations and clearing of aged items, fixed assets, time
R Revised and expense approval, and system access.
C Closed

14
 Key Issues Summary 3

Significant Issues

Board 1. Review 1
• Issue 1
2. Review 2
>5% Disclosure
Committee • Issue 1
• Issue 2
Executive Management 3. Review 3
• Issue 1
4 3
>1% • Issue 2
4. Review 4
• Issue 1
2 1
Local Management • Issue 2
• Issue 3

* Calculated as a percentage of pre-tax net income and defined as more

The control weaknesses noted above were not material to XXXX, but
than a remote chance. items 2 and 4 were significant to balance sheets of the countries.

Significance Control Criteria

Tier 1 (Board) Tier 2 (Executive Mgmt) Tier 3 (Local Mgmt)
Pervasiveness Impact to the Corporate Entity Impact to the Segment, Region or Business Unit Impact Isolated to the function or location
Relation to Financial Reporting Direct Marginal Relationship Indirect
Fraud Potential High Medium Low
Reputation Impact High Medium Low
Potential Impact to Business Objectives High Medium Low

15
 Key Issues Summary 4

Rating IA
Internal Controls Report
At Follow- Process Owner Progress
Information Issued Current
Issuance up
Internal Audit Summary
• Significant tax issue has been resolved.
Audit 1 1/1/20xx High Medium In-process • Cash reconciliation enhancements are in process.
• Controller reassigned in August.
• VP risk management is spearheading efforts to address
short-term recommendations.
Audit 2 1/1/20xx No Rating In-process
• Efforts will focus on enhancing capabilities at corporate
and service centers.
Audit 3 1/1/20xx Medium Medium In-process Efforts are underway to address identified issues.
Audit 4 1/1/20xx Medium Medium In-process Efforts are underway to address identified issues.
Minor improvement opportunities are being addressed by
Audit 5 1/1/20xx Low Low In-process
local control owners.
Minor improvement opportunities are being addressed by
Audit 6 1/1/20xx Low Low In-process
local control owners.

16
 Sample Audit Scope

Vendor File
A/P Accounting
Maintenance

• Understand Process • Understand Process • Understand Process

• Assess Control Design • Assess Control Design • Assess Control Design
• Assess Control Gaps • Assess Control Gaps • Assess Control Gaps
• Test • Test • Test

In Scope (pre and post paid) • Review Vendor master file creation for
• Expense payables, stock and relay • Review disbursement approval process Expense Payables
• Review for completeness, accuracy and • Review controls over stop payments and • Review integrity of interface from A/P sub
timeliness of input and payment processing reissues ledger to G/L
(EDI and Manual) • Review daily balancing performed by A/P • Review monthly reconciliation of A/P sub
• Review of access to systems and check • Review Vendor maintenance within A/P ledger to G/L
stock / signature plates vendor master file (Stock and Relay) along
• Review PO and invoice matching process with access controls

Out of Scope • Review of vendor master files created by

• Petty cash at RDCs Merchandising
• Direct Ship
• Wire transfers
• TandE from xxx
• MSA on-line (rebates, deductions)

17
Internal Audit Calendar and
Plan
 Audit Calendar 1

• Geography • IT Project • India Assets Management

• Accounts Payable • Technical Support • Gift and Hospitality
Asia - Pacific • Accounts Receivable • TandE • FCPA
• Service Center • Recruitment • Outsourcing

• Business Unit Revenue • QA Performance

• Accounts Payable • IT Projects Review
Europe • Accounts Receivable • Service Center
• Compliance

• Accounts Payable • Treasury • Strategy implementation

• Business Unit 1 • Regulatory
North-America • Business Unit 2 • Accounts Receivable
• Pharmaceuticals • Regional
• Compliance Export • Market Pricing

• Fixed Assets • OTC – Americas • IT Projects Review

• Transfer Pricing • Quarterly Company-wide JE Review
Latin-America • FCPA (Q1-Q4)
• Royalty Audits • HR Payroll and Accounting
• Quarterly SOX Testing (Q1-3)

19
 Audit Calendar 2

20XX
20XX IT Audit Plan - Company X Audit
Q1 Q2 Q3 Q4
Plan and Activities
Jan - March April - June July - Sept Oct - Dec

Accounts Payable Review

Accounts Receivable Review

ITIL - Change Management and Service Desk

PIMS – Interface Engine

Audit Committee Reporting

Quarterly Follow-Up (Performed by Internal Audit)

IT Risk Assessment (Initial)

Update IT Risk Assessment

Coordinate with External Auditor

Color Legend
Complete In Process Not Started

20
 Audit Calendar 3

Jan – Mar Apr - Jun Jul – Sept Oct - Dec

Accounts Payable Review P

Accounts Receivable
Review P Review 4 

Internal Anti-Money Laundering
Audit Review P Review 5

Review 3 Risk Assessment 

Validate Self-
Draft 20XX 404 Scope
P Finalize 20XX 404 Scope
P Execute Testing
P Assessments P
Update Self-Assessment Validate Self- Monitor Deficiency
Program P Schedule Audits
P Assessments P Remediation P
Roll-out Self-Assessment Monitor Deficiency
Program P Remediation P
SOX 404
Update Control Complete Self- Complete Self-
Documentation P Assessment P Assessments P
Evaluate Tested Evaluate Tested
Complete Self-Assessments
P Controls P Controls P
Remediate
Remediate Deficiencies P Remediate Deficiencies P Deficiencies P

Deferred  Not Started Scoped In Progress

Fieldwork
Complete
Report
Drafted
Complete P

21
 Audit Calendar 4

Q1 Q2
Security Management / Governance Business Continuity / Disaster Recovery
Co-branded Credit Cards Treasury
Joint Ventures Joint Ventures
Site Audits Site Audits
Corporate Governance Construction
Service Center PCI Fixed Assets
Sarbanes-Oxley, PCI, Data Privacy, Partial Scope Site Audits
Receivables
Development
Core (Site, SOX, PCI) Headline / Management Request Back to Basics and Other Audit Activities
High-level Audit Scope Summaries
• Security Management / Governance: Assess completeness and sufficiency of security policies and evaluate enterprise-wide compliance.
• Co-branded Credit Card: Evaluate critical contractual requirements and related milestones associated with year one activities.
• Joint Ventures: Review site operations and assess financial information flow from site through partner to Company books.
• Site Audits: Assess financial statement, operational, financial and IT controls (some efforts directly support external auditor).
• Corporate Governance: Assess compliance with new Corporate Governance policies (e.g., disclosure controls, Reg FD, whistleblower
incidents, Insider Trading Policy). Evaluate employee stock trading activities to confirm compliance with stated policies. Review enterprise-wide
email distribution lists for completeness and accuracy. Propose enhancements, as necessary.
• Service Center PCI: Evaluate security configuration controls at the Service Center to confirm compliance with PCI requirements.
• Business Continuity / Disaster Recovery: Follow-up on 20XX Internal Audit results (Operations, Service Centers, Corporate), and evaluate
processes related to recent service incidents / outages.
• Construction: Evaluate the project specific close-out process.
• Fixed Assets: Integrate SOX financial review with a detailed operational focus on fixed assets processes for accounting and reporting (N.A. and
Int’l).
• Development: Supplement SOX testing with a deep-dive assessment of up to four deals.
• Receivables: Supplement SOX testing with a deep-dive assessment of key receivables processes.
• Treasury: Integrate SOX financial review with a detailed operational focus on capital management, liquidity and investment policies, and related
metrics.

22
 Audit Calendar 5

Audit Hot Spot Description and Internal Audit Coverage

Effectiveness of training and policy compliance (Insider Trading, Integrity, Corporate
Governance)
• Substantive testing of stock trades for policy compliance
1 Corporate Governance • Integrate into site visits
• SOX process and IT testing (including Entity Level Controls), Data Privacy and PCI
compliance
• Evaluate communication protocols (e.g., email distribution lists)
Policy compliance for cash usage including marketable securities and significant
deployment
Cash Investment and • Integrated SOX and risk-based audit – Treasury
2
Deployment • Integrated SOX Development audit with deep-dive review of up to four significant
deals
• Assess Delegation of Authority compliance
Proper accounting for construction funding considering change in Corporate
3 Construction oversight
• Select relevant construction projects
Completion of Corporate and Site conversion
Financial Shared Service
4 • Integrated risk-based, IT and SOX review (North America and India)
Center
• Evaluation of cost structure, cost savings and performance metrics
Ability to recover and sustain business operations after a service interruption
Business Continuity /
5 • Evaluate processes related to recent service incidents / outages
Disaster Recovery
• Follow-up on 2009 review and remediation

23
 Audit Calendar 6

March April May

China R Brazil R Argentina/Venezuela

Hungary Follow-Up P Canada : Ireland

Slovak Republic
P Greece : Thailand

Switzerland
P Luxembourg :
Finance Solutions
Cost Structure
P Quarterly Testing :
Business Continuity Planning
P
Service Center Time and Expense
P
Identity Mgmt P :
Active Directory and Exchange (Technical) Payroll Systems Approach

Int. Planning and Operations Svc. / Problem Mgmt. (Technical)

Qtly JE R Workstation Security

Benefits
P Asia Pacific : Government Atlantic and Europe

Pensions PAC : Qtly JE

Management and Communication

Revenue Corporate Functions Information Technology SOA

Geographic Affiliates/BPOs Process / Compliance Management and Communication

R Report Issued P Fieldwork Complete : In process reviews

24
 Audit Calendar 7
Processes

Third Party Outsourcing

HR and Payroll / TandE

Inventory Management

Legal and Regulatory

Financial Reporting
Note: Timing to be confirmed with Business Unit owners.

Mfg Operations

Disbursements

Treasury / Tax
Order to Cash

Fixed Assets
Procurement

Warranty

Logistics
Location Audit Scope Risk Coverage

Financial Reporting
Cross Location Process Review - Sales Order
Enterprise Wide Efficiency P P P
Processing and Revenue Recognition
Compliance

Precision Antennas (Stratford-Upon-Avon, Financial Reporting

Major Process Areas (initial audit) P P P P P P P P P P P P
England)
Compliance

Supply Chain (Sourcing)

Fraud

Shenzhen, China Follow Up Major Process Areas Organizational Culture P P P P P P P P P P P P P

Compliance

Communication

Financial Reporting
EMS Georgia and Brazil - new acquisition Post Acquisition - Integration Status Review P P P P P P P P P P P
Compliance

Business Interruption
(AOP Move) Fixed Assets and Physical Inventory
AOP (Joilet) P P P
Observation and Reconciliation
Product / Service Failure

Business Process Review - Treasury Cash

AHQ Financial Reporting P P
Pooling

Compliance
Lochgelly, Scotland and Czech Republic European Freight Payments Outsourcing Review P P P
Supply Chain (Sourcing)

Compliance
AOP Ongoing Senior Management TandE Review P
Ethical Behavior

Special Project / Prior Year Follow Up /

Global Compliance
Whistleblower Investigations

25
Findings Summary (detailed)
 Audit Report Summary 1

We assessed the existence and effectiveness of controls in relation to the business objectives of the accounts payable
process. Possible control improvements (rated as ‘Moderate’ or ‘Limited Controls’) are referenced to the detailed issues and
action plans section for further details.

Detailed Issues and Action Plans

Completeness and Accuracy – Authority/ Limit Rating
Reference

Suppliers are properly authorized prior to procuring goods / services. Detailed Issue and Action Plan #5

Accounts Payable disbursements are properly authorized. Detailed Issue and Action Plan #1, #2, #5, #7

Access to applicable AP systems is properly segregated. Detailed Issue and Action Plan #2, #9, #12

Detailed Issues and Action Plans

Timeliness – Effectiveness / Efficiency Rating
Reference

Disbursements are made to maximize cash flow. Detailed Issue and Action Plan #1, #2

Costs are reduced as much as possible. Detailed Issue and Action Plan #2, #7, #8, #10

Processing time is minimized. Detailed Issue and Action Plan #2, #3, #4, #5, #6

Performance measures used to control the process are reliable. NA

Strong Controls Moderate Controls Limited Controls

27
 Audit Report Summary 2

Objectives and Scope Timing (week of)

Background Scheduled: Actual:
To complete the audit, the PROJECT NAME renovation was Planning Jan 1 – Jan 5 TBD
selected, which was deemed representative of the population
Fieldwork Jan 8 – Jan 19 TBD
of renovations since the Corporate Office Construction /
Project Management Department coordinates the processing Pre-Close Meeting Jan 25 TBD
of all renovations for the North American locations.
Closing Meeting Week of Feb 4 TBD
Report Distribution Week of Feb 11 TBD
Scope
Internal audit tested to determine if the Company is accruing Issue Follow Up TBD TBD
and paying the appropriate tax from a sales and use tax Total Weeks 6 TBD
perspective.
Total Hours 296 TBD

Significant Issues:
• TBD
• TBD
• TBD
• TBD

Internal Audit Team: Management Contacts:

• TBD • TBD
• TBD • TBD
• TBD • TBD
• TBD

28
 Audit Report Summary 3

Background:
The Company engaged a third-party, Protiviti, to perform a network security assessment of the organization’s external, internal and
wireless technology infrastructure (scope included several computing platforms, ranging from desktop computers to servers and
databases that support critical applications and store business-critical information).

Summary Results
In general, the Company’s technology environment appears to be configured and managed in a manner that is consistent with
several generally accepted industry standards and practices. The organization has a well-architected network security infrastructure
and effective operational IT processes. Although many strong controls and processes were observed, testing identified two specific
issues during the internal network vulnerability assessment that allowed internal audit to gain access to all of the servers,
workstations and information across the Company’s technology environment.
• Easily Guessable Administrative Database Passwords – Two database servers used for the capital expenditure system have
easily guessed administrative account passwords. Internal audit used this compromised account to identify technical system
information and other network account information stored on the database server that was leveraged to take complete control of
the Company network. With complete control of the environment, internal audit was able to access various file storage servers
and workstations containing sensitive business and employee information, including: mergers and acquisitions documents,
financial information, employee and executive compensation, employee performance reviews, and legal documents.
• Re-Use of Administrative Credentials – The default administrative accounts stored locally on the majority of Windows devices
are configured with the same password (i.e., this password is reused throughout the Company’s environment). Leveraging
credentials obtained through the issue noted above, this password was obtained and used to access various servers,
workstations and applications throughout the Company’s environment. Individually, this issue did not provide a point of access
during the assessment. However, when combined with the issue above, it resulted in a significant amount of access. This type of
issue underscores the importance of security controls in layers.

IT management has already taken steps to remediate the specific issues identified during this audit. IT management is also
implementing several long-term process improvements (including regular security audits) to address root cause issues.

29
 Audit Report Summary 4

Report Name: Information Security Audit --- issued 1/1/20xx

Overall Rating: High

Background and Scope:

Many companies store and process a large volume of personal and sensitive information on behalf of employees and customers.
Recent company-specific assessment activities (e.g., SOX, PCI, data privacy audits) have identified a trend in security-related issues
which has led to an increased focus on information security within corporate IT, legal and operations. Effective information security
relies on the combination of robust technical configurations, automated and / or manual process and human behavior to ensure the
confidentiality, integrity, and availability of corporate systems and data. The scope included:
• Network Security: Conducted a vulnerability assessment to determine if processes, procedures and configurations are
adequately designed and implemented to provide reasonable protection against internal, external and wireless -based
attacks.
• User Level Security Practices: Evaluated several business-critical security processes and technologies that support end user
information security activities.
• Governance: Reviewed the roles, responsibilities, and supporting policies and procedures related to directing, managing and
enforcing the information security program throughout the organization.

Summary Findings: The scorecard below summarizes ratings and findings by scope area.
Scope Area Rating Issues Summary
Multiple network security controls are not operating effectively in company data centers and corporate
Network Security
High locations. In some cases, systems and databases have weak passwords, and unauthorized users on
[internal]
the network may be able to access sensitive employee, customer and company information.
Network Security Employees provided valid email user names and passwords during electronic and telephonic social
Medium
[external] engineering exercises.
Management Response (at report issuance): Management agrees with the items outlined in the report and will take corrective action to
address identified issues.

30
Budgeting
 FYXX Budget Status Update

Actuals / Forecast Q1 Actual Q2 Actual Q3 Forecast Q4 Forecast Total

Direct Payroll X X X X X
Direct Non-Payroll Co-Source X X X X X
Training X X X X X
Travel X X X X X
Employment Costs X X X X X
Other X X X X X
Total X X X X X
YTD Cost X X X X

The approved budget is $XM. Internal audit is actively managing all costs and expecting to finish the year within budget.

In comparison to FYXX:
• The number of reports issued increased from X to X.
• An additional X unplanned projects were completed as of April.

32
 Internal Audit Budget

Effective May 1, YY the Company restructured its corporate compliance functions under internal audit. As part of this
restructuring, the following groups transitioned to internal audit:

• IT Compliance (SOX and PCI)

• SOX Compliance
• Compliance Audit (including site-specific audit teams)

The internal audit team successfully executed the complete FYXX Plan under budget, thereby realizing cost savings of
$500K.

The table at right outlines the 20YY budget, 20YY actuals and Spend FTEs
20YY budget.
20YY Budget X X
Note: the 20YY budgeted spend includes adequate contingency to 20YY Actual X X
cover variable costs (e.g., SOX rework).
20YY Budget X X

33
 Benchmarking Analysis

Internal audit provided the audit committee with several departmental benchmarking statistics in December. The graphs
below provide updated information about our internal audit headcount and spend (at an annualized run rate) compared with
three of our Site company competitors.

Internal Audit FTE 7

Comparison * 14 Average IA FTEs: 26 37

10 20 30 40
* IA FTEs do not include the 3 site Compliance auditors

Internal Audit
$2M
Spend $3.9M Average IA Spend: $4.9M $6.1M
Comparison **

$1M $2M $3M $4M $5M $6M $7M

** IA spend includes payroll, travel, co-sourcing, training, recruitment, technology and other approved costs

IA Budget (AC approved 12/20XX) IA Budget (updated 9/20XX)

As a percentage of company revenue, the average internal audit spend for our Company and three other competitors
0.11%. The chart below outlines the percentage for each Site:
Competitor 1 .16% Competitor 3 .07%

Competitor 2 .12% Company .10%

34
Audit Organization and
Qualifications
 Internal Audit Staffing Summary

Leveraging a combination of industry and public accounting experience, our talented team is capable of successfully
executing the audit plan. We will continue to leverage resources from a co-sourced provider as needed for efficient audit
coverage both geographically and in areas requiring specialized skills.

Vice President
Certifications: CPA
Experience: X years
IA Leadership

Director – Sites and Service Centers Director – SOX, IT, Fraud

Certifications: CPA, CIA, MBA Candidate Certifications: CIA, MBA
Experience: X years Experience: X years
Manager / Sr.
Manager

Experience: X years Certifications: CIA, Certifications: CPA

CISA, MBA Candidate Experience: X years
Experience: X years
OPEN
Audit Team

6 Senior and Staff 3 Compliance

Auditors Auditors

36
 IA Personnel Profiles

Part of the measure of an internal audit department is the qualifications of the personnel. There are currently X full-time
employees within the department.

66% of the personnel (X of X) hold a relevant certification, 51% of the personnel (X of X) are fluent in a second
including 100% of the management group. language.

Certified Public Accountant

Chartered Certified Accountant

Chartered Accountant

Certified Internal Auditor

Certified Fraud Examiner

0 2 4 6 8 10 12 14 Polish Italian French Spanish German

Greek Hindi Japanese Mandarin Cantonese

Note: some individuals hold more than one certification. Note: some individuals speak more than one foreign language.

37
 Department Status

The chart below depicts the six core infrastructure components of an internal audit department, and below each lists the
attributes that define a mature function which links closely to the requirements of the QA review. The scale on the left is
used to evaluate the current process maturity of each component along with the desired goal state.

Maturity Strategies and Organization and Management Distinguishing

Methodology Technology Knowledge
Level Policies People Reporting Factors
Written and approved Development of IA Audit reports Risk assessment and Technology Tools: Access to process best practice
Increased IA Mission and Charter resource budget Executive management planning Risk Assessment knowledge
Quality Specific, communicated Recruiting process reporting and Periodic risk assessment Planning and Scheduling Access to risk/process expertise
strategy Traditional - accounting communication performed Work Flow Knowledge sharing process
Compliance with the IIA Non-traditional - Audit committee reporting Common control/ risk Self-Assessment Professional organization
Optimizing Standards operational and communication language Data Analysis affiliations Continuously
Alignment of IA within Utilization of other Defined audit universe Continuous Monitoring Benchmarking
the organization professionals Control models Follow-up Improving
Independent and Process experts Annual audit plan Customer Satisfaction
objective IA function Outside service providers scheduling Tools integration
Process
Managed Quality assurance In-house rotation (guest Audit execution
reviews auditor) program Audit project planning
Self-assessment Competency models Audit project staffing
IA Procedures Manual Training programs Work Plans
Enterprise risk Professional certifications Standardized Predictable
assessment (global) Performance reviews documentation and
Defined Annual audit plan Succession planning retention requirements
Process
development Management development Follow-up
External audit Computer assisted auditing
coordination techniques Standard,
Integration of 404
strategy
Consistent
Repeatable Anti-Fraud program Process
coordination
Organization's
awareness of IA
Development of IA Disciplined
Initial department on-going
improvement initiatives
Process

Increased Goal State: 2 Goal State: 3 Goal State: 2 Goal State: 2 Goal State: 3 Goal State: 2
Risk Current State: 3 Current State: 4 Current State: 2 Current State: 4 Current State: 4 Current State: 3

38