Table Of ContentThe Audit Value Factor
Internal Audit and IT Audit
Series Editor:
Dan Swanson, Dan Swanson and Associates, Ltd.,
Winnipeg, Manitoba, Canada
The Internal Audit and IT Audit series publishes leading-edge
books on critical subjects facing audit executives as well as inter-
nal and IT audit practitioners. Key topics include Audit Leadership,
Cybersecurity, Strategic Risk Management, Auditing Various IT
Activities and Processes, Audit Management, and Operational
Auditing.
Supply Chain Risk Management: Applying Secure Acquisition
Principles to Ensure a Trusted Technology Product
Ken Sigler, Dan Shoemaker, and Anne Kohnke
Why CISOs Fail: The Missing Link in Security Management—and
How to Fix It
Barak Engel
Practitioner’s Guide to Business Impact Analysis
Priti Sikdar
Data Analytics for Internal Auditors
Richard E. Cascarino
The CISO Journey: Life Lessons and Concepts to Accelerate Your
Professional Development
Eugene M Fredriksen
Implementing Cybersecurity: A Guide to the National Institute of
Standards and Technology Risk Management Framework
Anne Kohnke, Ken Sigler, and Dan Shoemaker
Cognitive Hack: The New Battleground in Cybersecurity … the
Human Mind
James Bone
For more information about this series, please visit https://
www.crcpress.com/Internal-Audit-and-IT-Audit/book-series/
CRCINTAUDITA
The Audit Value Factor
Making Management’s Head Turn
Daniel Samson, CIA
CRC Press
Taylor & Francis Group
6000 Broken Sound Parkway NW, Suite 300
Boca Raton, FL 33487-2742
© 2020 by Taylor & Francis Group, LLC
CRC Press is an imprint of Taylor & Francis Group, an Informa business
No claim to original U.S. Government works
Printed on acid-free paper
International Standard Book Number-13: 978-1-138-19812-8 (Paperback)
This book contains information obtained from authentic and highly regarded sources.
Reasonable efforts have been made to publish reliable data and information, but the
author and publisher cannot assume responsibility for the validity of all materials or the
consequences of their use. The authors and publishers have attempted to trace the copyright
holders of all material reproduced in this publication and apologize to copyright holders if
permission to publish in this form has not been obtained. If any copyright material has not
been acknowledged please write and let us know so we may rectify in any future reprint.
Except as permitted under U.S. Copyright Law, no part of this book may be reprinted,
reproduced, transmitted, or utilized in any form by any electronic, mechanical, or other
means, now known or hereafter invented, including photocopying, microfilming, and
recording, or in any information storage or retrieval system, without written permission
from the publishers.
For permission to photocopy or use material electronically from this work, please access
www.copyright.com (http://www.copyright.com/) or contact the Copyright Clearance
Center, Inc. (CCC), 222 Rosewood Drive, Danvers, MA 01923, 978-750-8400. CCC is a
not-for-profit organization that provides licenses and registration for a variety of users. For
organizations that have been granted a photocopy license by the CCC, a separate system of
payment has been arranged.
Trademark Notice: Product or corporate names may be trademarks or registered
trademarks, and are used only for identification and explanation without intent to infringe.
Visit the Taylor & Francis Web site at
http://www.taylorandfrancis.com
and the CRC Press Web site at
http://www.crcpress.com
Contents
Acknowledgments ix
Author xi
IntroductIon 1
Defining Value 3
Getting Started 8
Bibliography 11
FActor 1 VAlue ProPosItIons 13
Developing a Value Proposition for Internal Audit 16
Value Propositions for Individual Audits 18
Example—Sarbanes–Oxley Controls 19
Example—Business Continuity 19
Basic Assurance 21
Aligned with Strategic Plan 21
Value-Added 22
Strategic Value-Added 22
Chapter Recap 23
Notes 24
Bibliography 24
FActor 2 customer relAtIonshIPs 25
Commitment 27
Everyone Needs to Eat 28
Do You Hear What I Hear? 28
Give Back 28
Grow Your Garden 29
Check Your Investments 30
v
vi Contents
Be Ready and Available 31
Flex Your Muscles 31
Audit Liaisons 32
Respect 33
Customer Centric 34
Listening Tour 34
Acknowledgment 35
Know Your Customer 35
I Do Declare! 35
Opening Meeting—Contrasting Examples 37
Culture Counts 37
The Significance and Insignificance of Titles 38
Empathy 39
Walk in Their Shoes 39
Active Listening and Observation 40
Affirmation 40
Ask 41
Filters 41
Authenticity 42
Self-Awareness 42
Earnest Interaction 43
Life Experiences 43
Be Present 44
Realistic Commitments 44
Humility 45
Trust 46
Knowledge Sharing 47
Transparency 48
Celebrate Success! 49
Confidentiality 50
Be Human 51
Expectations 52
Goals, Strategy, Objectives, and Tactics 53
Communication 55
Audit Committee Communications 55
The Executive Team 57
Process Owners/Individual Contributors/Employees 59
Deliverables/Reporting 60
Expectations on Report Opinions 63
Chapter Recap 63
Notes 65
Bibliography 65
FActor 3 tAlent 67
Trust 69
Leadership Responsibility for Developing Trust 72
Team Member Responsibilities for Developing Trust 73
Empower 76
Contents vii
Empowering Team Members is about Describing Success 78
Building a Competency Model 79
Career Planning 81
Co-sourcing 83
Award (and Reward) 84
Mentoring 85
Chapter Recap 88
Notes 89
Bibliography 89
FActor 4 rIsk exPertIse 91
Understanding Risk 93
Risk Likelihood 94
Risk Impact 95
Risk Velocity 95
Risk Influencers 95
Mega Risk and Enterprise Risk Management (ERM) 96
Identifying Top Risks to the Company 97
Risk Appetite 101
Creating a Risk Universe 103
Company-Wide Risk Dashboard/Landscape Example 106
Defining Residual Risk Vulnerability (Likelihood) 108
Defining Impact 108
Overall Risk Rating 109
Risk Monitoring 109
Employee Risk Surveys 110
Risk Workshops 111
Division Risk Landscapes 112
Connecting the Dots 112
Chapter Recap 114
Notes 115
Bibliography 116
FActor 5 chAnge mAnAgement And Process
oPtImIzAtIon 117
State (the Problem) 118
Create a Vision Statement 122
Measure 123
Workflows 123
Gemba 126
Value-Add Analysis 127
Desirable and Undesirable Effects 130
Team Prioritization of UDEs for Analysis 130
Validation 131
Analyze 131
Surveys 131
Root Cause Analysis 132
Five Whys 132
viii Contents
Synthesize Causes 134
Refine 136
Brainstorm Solutions 137
Failure Mode and Effects Analysis 138
Communicating the Solution/Management Action Plans 140
Refinement of the Solution/Action Plans 141
Track 142
Solution/Management Action Plan Owner 142
Metrics 142
Validate Value 143
Chapter Recap 143
Bibliography 144
FActor 6 dAtA AnAlytIcs 145
Delivering Value in Opening Meetings 146
Critical Thinking and Planning 146
Sources of Potential Cost Savings through Data Analytics 147
Travel and Expense 148
Expense Reasonableness 148
Hotel Expenditures 148
Airfare Booking Timeliness 149
Airfare Credits 149
Duplicate Reimbursements 150
Surface Transportation Providers 150
Personal Mileage Reimbursement 151
Examination of Cash Patterns 151
Most Frequent Travelers 151
Executive Expenditures 152
Telecommunications 152
Mobile 153
Conference Calling Services 153
Voice over Internet Protocol Plans 153
Software Licenses 154
Subscriptions 154
Computer Hardware 155
Office Supplies 156
Shipping 157
Accounts Payable 157
Duplicate Payments 158
Vendor Credits 158
Payment Discounts 158
Cash Flow (Commercial Enterprise) 159
Detecting Fraud 159
Chapter Recap 160
Bibliography 161
Index 163
Acknowledgments
There are many people to thank in supporting this effort, not least
of which is my spouse Tony Paine. Tony has provided encourage-
ment and patience through countless nights and weekends of writing.
A caring partner makes a huge difference.
Effective mentors drive success, and I’ve been the fortunate ben-
eficiary of outstanding mentoring from some great leaders. Larry
Harrington, an inspiring and dedicated champion of the internal
audit profession, has provided numerous opportunities and insightful
feedback for years. Larry has a passion for people and it shows. He
accelerated my career and I’m forever grateful. Dr. Kathryn Bingham,
executive coach and founder/CEO of LEADistics provided thought-
ful coaching and reassurance through the arduous process of becom-
ing a Six Sigma Black Belt. Kathryn is one of the most decent human
beings I know. Dr. Curt Carlson, CEO of Practice of Innovation and
the best-selling author of The Five Disciplines of Innovation, has pro-
vided tremendously helpful disruptive thinking about the profession.
I always look forward to our engrossing talks on innovation and sin-
cerely appreciate his ongoing mentorship. Myra Canterbury and Dr.
Howard Dockery, entrepreneurs, have brought understanding about
the realities of running a business. I thank Richard Chambers, CEO
of the Institute of Internal Auditors (IIA), for his time and wisdom
and helping us all propel the profession. I also thank the dedicated
ix
