Internal Audit: Risk, Controls and the Audit Process

What an audit is, and how it differs from analytics and from a compliance check

Five mistakes that turn an audit into a useless exercise

The three levels: compliance, best practice, strategic alignment

Express scoring: diagnosing maturity in ten minutes and producing a priority map

The structure of a checklist across thirteen sections, and the logic of the weights

A demonstration on a 200-person company

Four data collection methods: documents, interviews, observation, systems

Getting through hundreds of items in three days, and turning it into a report

Where an audit sits in the annual cycle: full, focused, continuous

The RACI matrix: who runs it, who supplies data, who implements

Fifteen key metrics with formulas and benchmarks

Five typical objections with answers, the return calculation, and the roadmap

Decision-making as the origin of most organisational damage

What the global financial crisis demonstrated about it

What human risks are

Current research on risk in managing people

The risk heat map

An example of risk management applied to people

The fraud triangle and the safety triangle

The people-risk thermal imager and the risk triangle

How decisions are actually made under pressure

Cognitive biases, and which ones matter most in an audit context

Conflict of interest, including the kind nobody declares

Examples of human risk in practice

The 4I model

Incidents and what they reveal about the control environment

Risk at individual level, at company level, and by industry

Risk management as a discipline, and ISO 31000

The risk hierarchy, and internal versus external risk

Finding and assessing risk

Eliminating, reducing or escalating it

Management maturity as a risk factor

The dynamics inside a senior team

The role of the chief executive

The warning signs that precede most failures

Cultural context and what it permits

Building a risk culture deliberately

Company values under pressure

Trust as a control mechanism in its own right

The three lines of defence

Reducing risk structurally rather than by exhortation

The high-reliability organisation

Managing risk with a functional team, and auditing culture

Surfacing what nobody is currently looking at

Improving the decision-making process itself

A decision-making checklist you can actually use

What a code of conduct has to contain to function as a control

The job description as an accountability instrument

Where personal responsibility begins in a system

Who should own process description

What documenting a process actually buys you

What a process description consists of

Which processes to describe first, since you cannot start with all of them

How processes are described internationally

Which methodology fits which situation

Using flowcharts, and a simple BPMN diagram

Analysing a process once it is on paper

Process description models

Templates worth reusing

The software available

A worked example using online tools

What you actually get as the output

Implementing a described process rather than filing it

Evaluating whether the described process works

Adjusting it afterwards

Documenting an onboarding process

Documenting hiring and training

Documenting performance management

Documenting an exit process

Creating the project team and choosing the processes

Preparing the project concept

Defending it with senior management

Launching it, reporting on it, closing it and monitoring afterwards

Why formal assessment exists at all

A comprehensive approach to it

The performance management and appraisal cycle

The types of assessment, and the difference between performance and competence

What a performance agreement actually is

The job profile and its indicators

Goal setting and cascading objectives

Identifying required skills and behavioural competencies

Why feedback is the mechanism the whole cycle rests on

A model for delivering it

The requirements and criteria for it to work

Evaluating people and building development plans from the result

The problems that show up in performance

Regular one-to-ones as a manager's instrument

The aims and tools of an assessment centre

Implementing one, using Wargaming as the example

How to hold a difficult conversation

Diagnosing why motivation dropped

Deciding between improvement and separation

Building a performance improvement plan that is defensible

How coaching works

Coaching as part of ordinary management

Delegation as a development instrument