Sisäinen tarkastus organisaation riskienhallinnan tukena - empiirinen analyysi

Tutkimuksen tavoitteena on selvittää, millainen rooli sisäisellä tarkastuksella on määritelmänsä mukaisesti organisaation riskienhallinnassa ja kuinka tässä roolissa sisäinen tarkastus säilyttää riippumattoman ja objektiivisen asemansa. Aihepiirin tutkimuksessa on aiemmin nostettu esille huoli objektiivisuuden ja riippumattomuuden toteutumisesta sisäisen tarkastuksen tehtävien laajentuessa perinteisten arviointi- ja varmennustehtävien ulkopuolelle. Sisäinen tarkastus on ottamassa merkittävämpää roolia riskienhallinnassa, jossa konsultointiluonteisten tehtävien osuus jatkaa kasvuaan suhteessa perinteisiin tehtäviin. Tutkimuksen empirialla haetaan vahvistusta lähdeaineiston keskeisille havainnoille ja selvitetään samalla sisäisen tarkastajan riippumatonta ja objektiivista asemaa turvaavia toimia. Empiirinen osio toteutetaan sähköpostihaastatteluna valituille yksityisellä puolella toimiville sisäisen tarkastuksen päälliköille. Haastattelun kysymykset ovat muodoltaan sekä strukturoituja että vapaampia kysymyksiä. Sisäisen tarkastuksen roolia selvitetään deskriptiivisellä lähestymistavalla, jolla kuvaillaan asemaa lähdemateriaalin sekä empiiristen havaintojen puitteissa. Tutkimus luokitellaan kvalitatiiviseksi tutkimukseksi. Kahdeksalle sisäiselle tarkastajalle lähetetystä haastattelulomakkeesta vastaukset saatiin lopulta kahdelta sisäisen tarkastuksen päälliköltä. Tutkimuksen keskeiset havainnot osoittavat, että sisäisellä tarkastuksella on aktiivinen rooli riskien arvioinnissa ja riskeistä konsultoinnissa. Tarkastuksen riippumaton ja objektiivinen toiminta varmennetaan sisäisen tarkastuksen suoralla raportointiyhteydellä ylimpään johtoon sekä sisäisesti että ulkoisesti tapahtuvalla laadun varmennuksella. Tutkimuksessa tehdyt havainnot lisäävät tietoa ja ymmärrystä sisäisen tarkastuksen riippumattomuuden ja objektiivisuuden varmentamisesta riskienhallinnan tukena.

O conselheiro do rei: a função de auditoria interna na governança corporativa de bancos no Brasil

Este estudo tem como tema o papel da Função de Auditoria Interna (FAI) no sistema de governança corporativa (SGC) de instituições financeiras, ou simplesmente bancos, atuando no Brasil. A FAI é um mecanismo de avaliação de políticas, procedimentos e processos que age a partir do ambiente operacional de uma organização. Baseando-se nisso, o objetivo do trabalho foi investigar porquê e como a FAI foi incorporada ao SGC, e as consequências geradas para ambos. O estudo qualitativo, de natureza exploratória e descritiva, utilizou uma abordagem multiteórica, aplicando a teoria da agência e a teoria institucional. Pela abordagem buscou-se utilizar a relação entre à necessidade de monitoramento para atingir a eficiência organizacional e o impacto estruturante das pressões do ambiente externo na definição do papel e do posicionamento da FAI no SGC. A entrevista semiestruturada, utilizada como método de coleta de dados, foi aplicada a dez funcionários de auditoria de cinco bancos de grande porte, além de três indivíduos ligados ao Conselho de Administração em bancos. O estudo apresentou as seguintes conclusões: i) a FAI foi incorporada ao SGC porque a complexidade derivada da evolução do negócio bancário dificultou o monitoramento dos bancos por parte do principal e do regulador; ii) três fatores atuaram de forma inter-relacionada como direcionadores dessa incorporação: a própria evolução do negócio bancário, a regulação e a convergência de premissas e práticas; e iii) o reposicionamento organizacional resultou em consequências quanto ao escopo do trabalho da FAI, à intensificação dos conflitos para a manutenção da independência, à percepção de valor agregado pela FAI ao SGC e ao processo de capacitação dos auditores internos. O estudo apresentou como principais contribuições ao SGC: a revelação do potencial da FAI para gerar insumos para o monitoramento ao atuar como sua extensão no complexo ambiente operacional bancário; e a proposta de utilização da FAI como recursos para gerar insumos às decisões estratégicas. Quanto à FAI, o estudo sugere que, para que se consolide como mecanismo de governança, necessita qualificar seu quadro funcional e se desenvolver metodologicamente para entregar informações condizentes à tomada de decisão pelo SGC.

A função da auditoria interna na Guarda Nacional Republicana: estudo de caso

Mestrado em Auditoria

Situação atual e perspetiva futura da auditoria interna em Angola

Mestrado em Auditoria

Analysis of integrated management systems from various perspectives

This article compiles the main topics addressed by management systems (MSs) literature concerningMSs integration by performing a systematic literature review. In this paper, it is intended to present themain limitations of non-integratedmanagement systems (IMSs), the main motivations driving an IMS implementation, the major resistances faced, the most common resultant benefits, the suitable guidelines and standards and the critical success factors. In addition, this paper addresses the issues concerning integration strategies and models, the integration levels or degrees achieved by an IMS and the audit function in an integrated context. The motivations that drive companies to integrate their management subsystems, the obstacles faced and the benefits collected may have internal or external origins. The publishing of standards guiding companies on how to integrate their management subsystems has been done mainly at a national level. There are several models that could be used in order to support companies in their management subsystems integration processes, and a sequential or an all-in strategy may be adopted. Four audit typologies can be distinguished, and the adoption of any of these typologies should consider resource availability and audit team know-how, among other features.

Auditoria interna e externa – Uma perspetiva de complementaridade

Esta monografia foi elaborada com o intuito do aprofundamento, aperfeiçoamento e o conhecimento académico, pesquisando um tema que contribuísse, de alguma maneira, para a melhoria da área em questão. Também teve a intenção de contribuir na análise da inter-relação entre a auditoria interna e externa numa perspetiva de complementaridade. Procura-se, na presente monografia, proporcionar uma reflexão sobre a relação existente entre a auditoria interna e a auditoria externa. Para tal, realizaram-se pesquisas bibliográficas sobre os principais conceitos, âmbito, métodos, objetivos, funções e procedimentos, normas pertinentes à auditoria interna e externa, relação entre as duas auditorias, complementaridade e cooperação entre elas e auditoria interna e externa na prevenção e deteção de fraudes. Paralelamente foram elaborados dois questionários enviados a 6 empresas que têm departamentos de auditoria interna retiradas do universo das empresas com departamento de auditoria interna e a 2 empresas que fazem auditoria externa nessas empresas, a atuarem no mercado caboverdiano durante o ano de 2013, com o objetivo de verificar a relação entre a auditoria interna e a externa, através da opinião dos auditores internos e cruzamento com a opinião dos auditores externos, a fim de verificar, efetivamente, como estabelecer essa relação. De posse desses elementos, o objetivo geral apresentado pode ser comprovado pela conclusão de que se pode estabelecer uma relação entre auditoria interna e externa e a mesma pode ser de complementaridade. This monograph was developed with the aim of deepening, improvement and academic knowledge, by researching a topic that would contribute in some way to improve the topic in question. It also intended to contribute to the analysis of the inter-relationship existent between the internal and external audit and the notion that both complement each other’s work. This monograph attempts to provide a reflection on the relationship between internal audit and external audit. For this purpose, a library research was conducted on key concepts, scope, methods, purpose, function and procedures, relevant standards for internal and external audit, the relationship between the two audits, complementarity and cooperation between them, and internal and external audit in the prevention and fraud detection. In parallel, we prepared two questionnaires that were sent to 6 companies that have an internal audit department that are part of the universe of companies with internal audit department; and to two companies that make external audits to the companies mentioned above and that operate in the Cape Verdean market during the year 2013. The objective was to verify the relationship between internal audit and external by reviewing the opinion n of internal auditors and to intersect that with the opinion of external auditor in order to verify effectively, how to establish this relationship. With these elements, the overall goal presented can be substantiated by the finding that a relationship establish between internal and external audit and this relationship can be complementary.

Is accountability a double-edged sword? Experimental evidence on the effectiveness of internal controls to prevent fraud

Recent legislations oblige organizations to monitor the effectiveness of internal control mechanisms that are necessary to prevent fraud. However, little is known about the effectiveness of different internal controls. We investigate whether the duty to sign work results-one of the most prominent internal control mechanisms-is effective to prevent fraud under different superior instructions. We use a 2×2 between-subjects experimental design with accountability (duty to sign work results vs. no duty to sign) and superior instructions (with vs. without profit maximization cue) as independent variables. Both manipulations of superior instructions reminded people to respect accounting standards and principles but in one condition, an instruction to increase revenues was integrated as profit maximization cue. We expected this cue to trigger a profit maximization decision frame that increases the likelihood for fraudulent revenue recording. 58 managers from an executive MBA class participated in the experiment. We find that superior instructions interact with accountability. Fraudulent revenue recording was particularly observed when people received instructions to increase revenues and had to sign their work results. Consequently, fraudulent behavior can occur without pressure to commit fraud due to profit maximization cues that are communicated by a superior and despite implemented internal control mechanisms. We discuss possible implications of our results for the prevention of fraudulent behavior.

Between Equity and Differentiation: An Analytical Schema of the Social Function of Education

The educational sphere has an internal function relatively agreed by social scientists. Nonetheless, the contribution that educational systems provide to the society (i.e., their social function) does not have the same degree of consensus. Taking into consideration such theoretical precedent, the current article raises an analytical schema to grasp the social function of education considering a sociological perspective. Starting from the assumption that there is an intrinsic relationship between the internal and social functions of social systems, we suggest there are particular stratification determinants modifying the internal pedagogical function of education, which impact on its social function by creating simultaneous conditions of equity and differentiation. Throughout the paper this social function is considered a paradoxical mechanism. We highlight how this paradoxical dynamic is deployed in different structural levels of the educational sphere. Additionally, we discuss eventual consequences of this paradoxical social function for the inclusion possibilities that educational systems offer to individuals.

Tytäryhtiöiden konserniohjaus ja -valvonta kuntakonsernin riskienhallinnassa Case: Imatran kaupunki

Tutkimuksen päätavoitteena olianalysoida Imatran kaupungin konserniohjausta ja -valvontaa tytäryhtiöihin liittyvien riskien hallitsemiseksi. Tavoitteen saavuttamiseksi tutkittiin tytäryhtiöiden konserniohjausta ja sisäistä valvontaa sekä tytäryhtiöihin liittyviä riskejä Imatran kaupunkikonsernissa. Jotta tutkimustavoite saavutettiin alatavoitteina selvitettiin konsernin, konserniohjauksen, sisäisen valvonnan, riskin ja riskienhallinnan käsitteitä sekä yleisesti että kuntaympäristössä. Lisäksi selvitettiin tutkimuksen teoreettisena viitekehyksenä käytettävää COSO-mallia. Tutkimusaineisto jakautui teoreettiseen ja empiiriseen aineistoon. Tutkimuksen teoreettista osuutta varten käytettiinaiheeseen liittyvää kirjallisuutta ja tutkimuksia. Empiirinen aineisto kerättiin haastatteluin ja organisaation tuottamia dokumentteja tutkien. Haastattelut toteutettiin teemahaastatteluina. Tutkimusstrategialtaan tutkimus oli tapaustutkimus (case study), joka tutkii olemassa olevan Imatra-konsernintytäryhtiöiden konserniohjausta ja - valvontaa. Tutkimuksessa analysoitiin yksityiskohtaista ja intensiivistä tietoa konsernin emon näkökulmasta. Todellista elämää kuvaavana tutkimus voidaan luokitella myös kvalitatiiviseksi eli laadulliseksi tutkimukseksi. Tutkimuksen perusteella voin todeta, että kaupunginhallituksen asettamat päämäärät ja tavoitteet ovat Tiian yleisiä ja jäävät konsernitasolle, joten niiden ohjausvaikutus tytäryhtiöihin ei ole kovin suuri. Tytäryhtiöiden heikosta tavoitteiden muotoilusta johtuen myös tytäryhtiöidentarkoituksenmukaisuuden ja tehokkuuden valvonta on vähäistä. Sen sijaan tytäryhteisöjen taloudellisten raporttien luotettavuus, lakien ja sääntöjen noudattaminen tulee valvottua tilintarkastusten yhteydessä. Lisäksi sisäisen tarkastuksen resurssien vähäisyyden vuoksi yksikön suorittama tytäryhtiöiden sisäisen valvonnan ja riskienhallinnan arviointi on olematonta. Myös riskienhallinnan kannalta tavoitteiden asettaminen on ollut liian suurpiirteistä ja irrallaan tytäryhtiöiden toiminnasta. Lisäksi haastattelujen mukaan sekä riskikäsite että riskienhallinnan käsite nähdään aivan liian suppeina. Ohjauksen, valvonnan sekä riskienhallinnan kannalta olisi tärkeää, että konsernin tavoitteiden asettamisen jälkeen myös tytäryhtiöille asetettaisiin selkeät mitattavat tavoitteet, joilla on yhteys kaupungin strategioihin. Tulisi myös varmistaa, että konsernissa ja sen tytäryhtiöissä on jatkuva riskien tunnistamistoiminto. Suositeltavaa on, että Imatra-konsernissa käynnistetään kokonaisvaltainen riskienhallintaprosessi.

Visões das gerências da auditoriainterna da Petrobras sobre a sua estratégia de atuação em facedas práticas de mercado e da nova modelagem organizacional da companhia

The purpose of this study is to identify the strategic vision of the Internal Audit Department of Petrel Brasileiro S.A. PETROBRAS, in comparison with the audit function's proposals and practices in competitive organizations and their reality. It also aims at the verification of the possible solutions, within Petrobras itself, so as to constantly add value to the business and to the shareholders. With this in mind, a research was carried out, contemplating the conceptual proposals and market practices related to auditing and to the current diagnosis and the organizational model of Petrobras, so as to choose elements for comparison and analysis of such vision. The results of this research pointed in the direction of questioning the organizational value of the internal audit action, concluding that it will only be possible to continuously attain such value by means of a permanent coordination with the organization's strategic level. This is especially true if the audit action participates effectively in the process of Corporate Governance, in defining the risks, the internal control system and the measurement of corporate performance, as related to the development of the strategic plan. However, any action along these lines is still heavily impacted and limited by several aspects of culture and relationship of the organizational power as well as by the beliefs of the organization and of the body of auditors. The involvement of the auditors as employees was also considered relevant in the auditing process, by means of the participation of the audited entities in self assessment2. This procedure is still not sufficiently guaranteed by successful experiments in major organizations, considering that there is not a clear demonstration of the effective benefits of adopting this practice, as ompared to the central control, seldom shared but strongly monitored by integrated information systems. Finally, this research points to the need to renew the concept of the formation and role of the auditors in modern competitive organizations, in the face of information technology and of automation of the instrument controls of the business. Therefore, one may conclude that the trend will be toward an action aiming at the revision of formal internal control matrixes, as they are established in such systems. On the other hand, the majority of audit human resources will be increasingly deployed to the evaluation of risk and control, as related to relevant events of a more abstract nature, as in the case of those connected with the uncontrollable factors of the external environment.

Chief Audit Executives’ Evaluations of Whistle-Blowing Allegations

This study examines the effects of the source of whistle-blowing allegations and potential for allegations to trigger concerns about reputation threats on Chief Audit Executives’ handling of whistle-blowing allegations. The participants for this study, 79 Chief Audit Executives (CAEs) and deputy CAEs, evaluated whistle-blowing reports related to financial reporting malfeasance that were received from either an anonymous or a non-anonymous source. The whistle-blowing reports alleged that the wrongdoing resulted from either the exploitation of substantial weaknesses in internal controls (suggesting higher responsibility of the CAE and internal audit) or the circumvention of internal controls (suggesting lower responsibility of the CAE or internal audit). Findings indicate that CAEs believe anonymous whistle-blowing reports to be significantly less credible than non-anonymous reports. Although CAEs assessed lower credibility ratings for the reports alleging wrongdoing by the exploitation of substantial weaknesses in internal controls, they allocated more resources to investigating these allegations.

Reporting and managing risk:a look at current practice at Tesco, RBS, local and central government

These case studies from CIMA highlight the need to embed risk management within more easily understood behaviours, consistent with the overall organisational culture. In each case, some form of internal audit team provides either an oversight function or acts as an expert link in that feedback loop. Frontline staff, managers and specialists should be completely aligned on risk, in part just to ensure that there is a consistency of approach. They should understand instinctively that good performance includes good risk management. Tesco has continued to thrive during the recession and remains a robust and efficient group of businesses despite the emergence of potential threats around consumer spending and the supply chain. RBS, by contrast, has suffered catastrophic and very public failures of risk management despite a large in-house function and stiff regulation of risk controls. Birmingham City Council, like all local authorities, is adapting to more commercial modes of operation and is facing diverse threats and opportunities emerging as a result of social change. And DCMS, like many other public sector organisations, has to handle an incredibly complex network of delivery partners within the context of a relatively recent overhaul of central government risk management processes. Key Findings: •Risk management is no longer solely a financial discipline, nor is it simply a concern for the internal control function. •Where organisations retain a discrete risk management cadre – often specialists at monitoring and evaluating a range of risks – their success is dependent on embedding risk awareness in the wider culture of the enterprise. •Risk management is most successful when it is explicitly linked to operational performance. •Clear leadership, specific goals, excellent influencing skills and open-mindedness to potential threats and opportunities are essential for effective risk management. •Bureaucratic processes and systems can hamper good risk management – either as a result of a ‘box-ticking mentality’ or because managers and staff believe they do not need to consider risk themselves.

Welke 'acteur' neemt de controllerrol als extraverte business partner?

Which 'actor' takes the management accountant role as an extravert business partner? Does a relation between the personal trait Extraversion and fulfilling a management accountant role as a business partner exist? Open Universiteit Nederland End thesis MSc Management, Accounting & Finance Support 1: Prof. dr. A.C.N. van de Ven RA Support 2: dr. P.C.M. Claes Examinator: dr. P. Kamminga Date of approval: September 3, 2014 student: P.R. van der Wal (studentnumber 839104017 email petervanderwal2003@yahoo.com The main question of this research is: Does a relation between the personal trait Extraversion and fulfilling a management accountant role as a business partner exist? This research is based on the dataset obtained by the controller survey 2013, executed in commission of the 'Open Universiteit' (Bork & van der Wal, 2014). From the literature review it is clear: among other management accountant roles we need business partners. And there is a relation between the personal trait Extraversion and fulfilling the role as business partner. At the same time a lack of necessary personal traits for this role has been noticed, among which is Extraversion. The factor- and cluster analyses reported by Bork & van der Wal (2014) resulted in the identification of two types of management accountant roles. In this extended research TYPE II is identified as a business partner because (s)he practices activity-combinations which are related to strategy, analyzing, supporting management in decision making, advisory, change-agency and representing the organization. 36% of the population of Dutch management accountants with a master degree (or similar) meet with the role of the business partner. Although the fulfillment of the role (TYPE II) is not purely business partnering. E.g. reporting and scorekeeping are still activities executed by TYPE II and it is not clear to what extent. Apart from that, role TYPE I executes change management and risk-management activities, which are (according to the definition) activities that belong to the business partner. The role as business partner is practiced but not that optimal as defined in theory. The logistic regression analyses on the survey-data show that Extraversion among three other triggers is significant for the prediction of the fulfillment of the management accountant role (Bork & van der Wal, 2014). A more extravert personal trait predicts a preference for TYPE II, which relates to the business partner. This 'in depth research' concentrated on the relation between the Big Five personal traits and the six activity-combinations (factors) instead of on the two clusters (I and II). The statistic analyses confirm the predicting influence of Extraversion on the business partner role. Although, except for one factor, no extra significance has been found in this additional research. The essential question can be confirmed positively: the management accountant role business partner exists in practice, some management accountants are more extravert then others, and there is a positive relation between extraversion and fulfilling the business partner role. Some formulated research limitations are related to the statistical weakness of some prediction outcomes and to interpretation differences that might occur. Further research can e.g. concentrate on the other personal traits and the significance for role-differentiation in education programs. The management accountant survey 2013 Management accountant roles in 2013 in the Netherlands Open Universiteit Nederland End thesis MSc Management, Accounting & Finance Support 1: Prof. dr. A.C.N. van de Ven RA Support 2: dr. P.C.M. Claes Examinator: dr. P. Kamminga Date of approval: September 3, 2014 student: P.R. van der Wal and H.J. Bork studentnumber: 839104017 and 838532340) email: petervanderwal2003@yahoo.com and hjbork@hotmail.com This paper describes the conceptual model and results of the 'management accountants survey 2013'. The survey is part of a longitudinal survey, earlier executed in 2004, 2007 and 2010 under responsibility of the 'Open Universiteit Nederland'. Secondly the dataset of this survey will be used by us to do our own analyses on the predicting value of the triggers 'personality factor: extraversion' and 'lever of control: interactive controls' on the management accounting role that comes close to a role defined as 'Business Partner'. Scientific research shows that there are different management accounting roles, and that these roles change and that preferences exist for certain roles (Verstegen B. , Loo, Mol, Slagter, & Geerkens, 2007). The main question that will be answered in this paper is which coherent combinations of activities are being executed by management accountants in 2013 in the Netherlands by master-graduates? And secondly which triggers of management accountants' activities predict to which cluster a management accountant belongs? The conceptual model of this research has been developed in 2004 (Verstegen B. , Loo, Mol, Slagter, & Geerkens, 2007). For this research the same 37 activities as in the former researches are included (appendix 1). In the trigger-set (appendix 1) some adaptations have been made for reasons of restricting the length of the survey and to pinpoint on particular research goals (e.g. personality and levers of control). The coherent combinations of activities were found by a factor-analysis and the groups of controllers by a cluster analysis. A regression analysis shows which trigger-items are most significant. The survey has been sent to 2.353 students that finished a controller-study on a Dutch University. There was a 9% (211) response with a completely filled survey. 137 of which indicated to work in a controller-function at the moment. These controllers have been included in the results. The factor-analysis results in six different coherent combinations of activities (factors). Shortly these factors are: advising top management on strategic level with result-effecting information (1), organizing internal reporting (2) organizing and representing the organization on external reporting (3), advising and managing changes by shortcomings in processes and control systems (4), maintaining and managing administrative organization- , information- and control systems (5) and organizing/executing risk management and internal audit (6). Factors 4, 5 and 6 are clustered in cluster TYPE I (125 controllers) and factors 1, 2 and 3 in cluster TYPE II (69 controllers). TYPE II can be associated with the management accountant role 'Business Partner', although the accountant keeps partly active in a scorekeeper role. The four most significant triggers for predicting being a TYPE II controller are 'Executing a risk-management task in order to meet compliance standards' (1), extraversion (2), company size in terms of fte (3) and gender (4).

Equipment quality control

Mammography equipment must be evaluated to ensure that images will be of acceptable diagnostic quality with lowest radiation dose. Quality Assurance (QA) aims to provide systematic and constant improvement through a feedback mechanism to address the technical, clinical and training aspects. Quality Control (QC), in relation to mammography equipment, comprises a series of tests to determine equipment performance characteristics. The introduction of digital technologies promoted changes in QC tests and protocols and there are some tests that are specific for each manufacturer. Within each country specifi c QC tests should be compliant with regulatory requirements and guidance. Ideally, one mammography practitioner should take overarching responsibility for QC within a service, with all practitioners having responsibility for actual QC testing. All QC results must be documented to facilitate troubleshooting, internal audit and external assessment. Generally speaking, the practitioner’s role includes performing, interpreting and recording the QC tests as well as reporting any out of action limits to their service lead. They must undertake additional continuous professional development to maintain their QC competencies. They are usually supported by technicians and medical physicists; in some countries the latter are mandatory. Technicians and/or medical physicists often perform many of the tests indicated within this chapter. It is important to recognise that this chapter is an attempt to encompass the main tests performed within European countries. Specific tests related to the service that you work within must be familiarised with and adhered too.