PowerPoint Presentation

FROM SYMPTOM TO SUBSTANCE Reframing Internal Audit as a Discipline of Organisational Reflection CORE FUNCTION DATA NODE 01 CONTROL LAYER STRATEGIC LINK.

The Comfort Trap: Confusing Familiarity with Alignment Comfort Vector Purpose Strategic Intent The Comfort Trap Unseen Risk Familiarity The way we've always done it (Comfort). Time Are we comfortable because we are aligned with our purpose—or simply because we have become accustomed to the way things are? We create processes for predictability, policies for consistency, and controls for certainty. Over time, these structures become familiar. Habit is not necessarily effectiveness. History is not a control objective..

The First Signal: When Reality Diverges from Expectation A number behaves differently. An audit does not necessarily begin with disease; it begins with a signal that does not fully reconcile with expectation. A process produces an unexpected result. A recurring issue refuses to disappear. A control operates differently from its design. A management assumption lacks current evidence. Nothing may yet be proven wrong. But something deserves attention..

Professional Skepticism is Not Suspicion The Starting Point The Primary Question The Focus The Ultimate Goal Suspicion I don't trust this. What can I find wrong? Auditing the isolated symptom Correction for correction's sake Professional Skepticism too Help me understand this. What do I need to understand? Understanding the interconnected system Strategic alignment with objectives The professional auditor approaches with an appropriately questioning mind, seeks sufficient evidence, and reaches conclusions based on what the evidence supports..

Moving Past the Surface: Symptom vs. System The core is not the problem. The core is the fundamental objective—the underlying reason something exists. Don't merely audit the symptom. Understand what it is telling you about the system. KPI Achieved The Surface Level Objective Compromised Process Policy Beautifully Report is Followed Accurate Written Risk Unmitigated Irrelevant to Decision-Making Poorly Implemented.

The Alignment Chain: Translating Intent into Outcomes Purpose Strategy Objectives Priorities Resources Action Outcomes Is the strategy still connected to the organisation's purpose? Are the objectives still connected to the strategy? Are the outcomes still connected to the objectives? Audit's Alignment Check Internal Audit moves beyond checking compliance. It examines alignment..

Establishing Boundaries: Who Owns the Risk? Management's Domain Owns the objectives. Owns the risks. Establishes and operates controls. Runs the business. Internal Audit's Domain Independent assurance. Objective evaluation. Advisory insight. Organisation-wide perspective. Risk does not belong exclusively to the Risk Department. Control does not belong exclusively to Internal Audit. Governance does not belong exclusively to the Board. Management owns; Audit assures..

The Control Equation: Responding to Uncertainty Objective Every organization exists to achieve these Where there is risk, there is a control conversation. Uncertainty (Risk) Uncertainty creates risk Response (Control) Risk requires an appropriate response Validation (Assurance) Internal Audifs non-exclusive, independent role A control may exist and still fail to address the relevant risk. The objective is not having hundreds of controls, but having effective governance..

C.O.R.E. Reporting: The Anatomy of a Finding C — CONDITION (What is actually happening?) Describe the observable condition without exaggeration. R — RISK (What could happen?) Connects finding to consequence. Without risk, an observation is merely an administrative complaint. CORE O — OBJECTIVE (What should be happening?) The clear criterion against which the condition can be evaluated. Why does it matter? E — EVIDENCE (What supports the conclusion?) The foundation of professional assurance. This is a discipline for thinking. Before writing a finding, assigning significance, or recommending correction, understand its CORE..

Correction Is Not the Objective Evidence Evaluated Evidence demonstrates a meaningful gap Evidence substantiates no concern Correction is warranted (Moving back toward alignment). No correction is required. • Internal Audit is not successful because it produces a large number of findings. • Professional skepticism must be willing to conclude both: "There is a problem," and "The concern was not substantiated." • The auditor follows the evidence. Not the suspicion. Not the pressure to produce findings..

The CORE Mindset: A Discipline of Thinking 1 Realisation (Something deserves 7 Assurance (Determine alignment) 6 Correction (Act where warranted) attention) This is not simply an audit procedure. It is a way of thinking that continuously moves the organisation back toward alignment. 5 Conclusion (Determine what evidence tells us) 2 Professional Skepticism (Question without prejudice) 3 CORE (Understand objective, purpose, risk, cause) 4 Evidence (Test belief against demonstration).

The Diagnostic Feedback Loop The Living System • Receives signals • Responds to threats • Regulates balance Consider the organisation as a human body. It continuously receives signals, regulates itself, and responds to threats. Purpose / Strategy Symptoms/ Anomalies Internal Audit (Diagnostic Center) The Business System • Outcomes • Risks • Controls The diagnostician does not assume disease. A symptom is a signal that requires investigation. Internal Audit is the diagnostic feedback loop—connecting what is actually happening (Outcomes) back to what should be happening (Strategy/Purpose)..

Internal Audit as the Independent Mirror Management's Reality The mirror does not create the organisation. It does not run it. It reflects what is there. It reveals what is working, where risk is increasing, and where assumptions are changing. Audit's Reflection The mirror does not correct the person looking into it. Management decides what to do with what the mirror reveals.

Purpose Over Comfort The most important question an Internal Auditor can ask is not, "What went wrong?" It is, "What is at the CORE?" The most important question management can ask is, "Are we still aligned with it?" Internal Audit is not about making organisations uncomfortable. It is about making sure that comfort has not replaced purpose..