So, a couple months ago I committed to earning the Certified Internal Auditor (CIA) designation. The first step was to register with the IIA as a candidate, which is done entirely online.

The next step was to select and acquire study materials. The IIA has their own package, which they’re quite fond of based on some phone conversations I had with one of their representatives, and Gleim is another popular one, as far as I can tell from cruising the various LinkedIn internal auditor group discussions.

I went a different route. I had attended an IIA social event for new members (Toronto chapter) back in April, where I met a fellow CA who had more recently achieved her CIA as well, and she recommended Hock as a cost-effective alternative. So far I’m liking it, having worked my way through the textbook for Part 1 of the exam. I’ve begun to use their software (ExamSuccess) to take even more practice questions. (The textbook also has them, sprinkled throughout.)

The CIA exam is four parts, but if you’re a CA or CPA you can apply to be exempted from the final part. Part 4 covers strategic management, global business environments, organizational behaviour, management skills and negotiating.

I’m quite a nerd, so I actually enjoy studying and answering practice questions. Now that I’ve begun the process, I’m surprised I didn’t start it sooner!

Update (Dec. 6, 2011): The budget dropped out for training for the rest of the year and the CIA fell by the wayside. Maybe in 2012!

The heads of both your marketing and customer service departments should meet regularly. Marketing plans should be shared with — and can even be enhanced by — customer service. Each side should know how to use social media to not only fulfill their own goals but to help one another to get closer to reaching overall company goals.

Ensuring the alignment with the overall strategic plan is the key point, and in many cases KPIs for both groups will be similar. Hopefully customer service is already involved in other marketing efforts, but it’s especially important in the interactive space of social media. Customer service is better positioned to turn feedback into improvements to operations where identified.

Measure results together. As expectations are high for tangible returns on social media marketing investments, bring customer service in to help measure, analyze and tell the story of how social media is effective for the company.

Mine social media for more than sentiment. Instead of just looking for the positive, negative and neutral of what customers are saying about a company’s product or service, look for clues to how the public perceives the company as a whole.

Demonstrating a return on social media investments is a challenge for many companies, but collaboration across functions will help. As well, the social media team should build relationships with others subject matter experts within the company, so that customer feedback can be informed or addressed by the people best able to do so accurately. Tech companies, such as Google with their official blog, tend to do really well with this.

Building social media competence across the organization should also have the side effect of nurturing responsible personal use, which is still a risk, although one which I believe often unnecessarily overshadows the potential for beneficial use of social media to a company.

How are social media responsibilities organized in your company?

So to celebrate, I’m raiding the archives and taking a stroll down memory lane.

Google Docs to surpass Office in a year: Google Docs has made great strides, but it still didn’t really happen, did it? A great alternative though for the cash-strapped with basic needs.

Why your organization should be using open document standards: What can I say, I’m a standards kinda guy. I still strongly believe in open standards, but I’ve also become pretty enamored with the XML-based formats for Office. Such small file sizes compared to the old binary formats!

Return to blogging: Ah my initial return from hiatus. I left public accounting and took a year long sabbatical to strike out into the world of internal audit. A year later, I knew everything there was to know and returned to share my knowledge. (Kidding!)

Today I am a CA: This is what I’d been working toward and blogging about since the beginning, and it was a very proud day to announce it to my readers! Next up: Certified Internal Auditor!

Here’s the hoping I blog more frequently over the next five years. Thanks for being a part of it.

The most important attribute is referred to as business acumen, but the description that accompanies it has more to do with having an in-depth knowledge of the business the auditor works for. Splitting hairs I guess, but acumen is the ability to make good decisions and exercise sound judgment. A strong understanding of what is driving the success of the business is important to cultivate, as is staying on top of developments within the industry in which it operates. I think both are important, but one is easier to develop than the other.

Communication skills come next, and I would broaden that to be people skills in general. The ability to read people and adapt to any given situation and personality is very helpful, so both the outward skills like communicating clearly and succinctly and the inward skills like listening actively and processing information quickly will come in handy when dealing with people within the organization.

Integrity comes in at 3rd, and is critical to establishing and maintaining your reputation as a professional. Being consistently honest and forthright in your interactions with your “customers” will allow you to build strong working relationships across the business.

Experience is next, and it’s not a subject I feel especially qualified to discuss, since I’m only in my third year as an internal auditor, sixth as an auditor. What I will say is that each day I strive to learn and get better at my job, and working with staff that have, among them, decades more experience than I provides a constant reminder of the value of that experience.

Number five on the list is a solid grasp of business risks, which to me means the exact same thing as the first item. Let’s just put them both together at the top and shorten the list to six, shall we? After that is talent development skills, which is important to have once you reach a certain level and have people reporting up to you. I could make the case that this is essentially a subset of people skills.

Last (but not least in my opinion) is courage and that’s important for auditors whether they’re external or internal. Part of the job is being the bearer of bad news and you’ve got have the stones to deliver it straight!

The agreement is formalized in a Memo of Understanding that has been signed by both parties. The MoU lists a few areas where this agreement makes cooperation possible:

• Speaking and exhibiting at each other’s conferences, seminars and events
• Conducting jointly sponsored events
• Mutually recognizing, where appropriate, each other’s continuing education programs for continuing education credits to satisfy requisite certification requirements
• Participating in training and educational programs offered by either association where such collaboration benefits the attendees
• Encouraging similar cooperation and collaboration among local chapters of ISACA and The IIA (an activity that already thrives in many places throughout the world)
• Identifying opportunities for joint projects that advance the global internal audit profession and the professional standing of its members
• Engaging in periodic discussions on matters of public policy that impact the internal auditing profession
• Where appropriate, coordinating and promoting unified messages and responses to standards setters, regulators, and legislators globally, and providing them with information regarding best professional practices

In order of value to each organization’s members, the top 3 in my mind are:

1. Joint projects to advance the internal audit profession

To me this is going to have the biggest impact on stakeholders because the combined knowledge and experience in both groups should lead to higher quality standards and improved best practices. Perhaps a combined set of standards down the road?

2. Recognizing each other’s continuing education

For members of both organizations this is huge. Program content frequently overlaps (e.g. the IIA’s GTAGs) and internal audit departments generally have staff with CIA and CISA designations (as well as CA and CPA, and others), so significant cost savings may be realizable.

3. Collaborating on continuing education

This could open up each organization’s continuing education programs to the other one’s members, which immediately introduces fresh topics and facilitators to both groups. Synergy here will allow members to broaden their training, and provide an easier transition from one to both certifications.

The agreement should work out to be a win-win-win — for the organizations, members, and stakeholders. What do you think?

The Decisions Matter ad campaign is aimed at shifting the traditional perception of the CA designation and promoting CAs as business leaders and key decision-makers in every organization. The campaign is very different from what we’ve done in the past. It is more assertive in establishing CAs as the leading business professionals and, in its originality, has been specifically designed to break through the media clutter.

I like the direction in which this strategy is taking us. For one, it is vocation agnostic, in that it doesn’t focus on CAs in public practice more than those in industry. And I like the attention that “decisions” are receiving, but I think that execution needs to be emphasized as well. Making the right decision is great, but acting on it is critical.

As a CA you have an important role to play in supporting this campaign. You can promote the CAs’ reputation as business leaders with a few simple steps:

• Include your CA designation on business cards and other communications;
• Ensure your professional network knows you are a CA. This includes the organizations you volunteer with;
• When making presentations, discuss how your CA training has powered your achievements;
• In interviews, introduce yourself as a CA; and
• Talk about the Decisions Matter campaign with your family, friends and business contacts.

No mention of starting a blog and establishing your online brand in concert with the CA designation, but you can’t win ‘em all I guess. If there’s one area that the CICA has thus far completely ignored it’s the social media space. Excuse me though, it’s time to ring the family and discuss this campaign with them, that’ll really promote our reputation!

My recommendation is to follow up the Decisions Matter campaign with something more focused on executing great ideas/decisions. Advising is valuable, deciding is important, but executing is key. What do you think of the campaign’s message and how it’s positioning CAs?

If you follow me on Twitter, you might have seen this:

@neilmcintyre: IT problems for Audit Director Roundtable delay the start of the Enterprise Risk Audit Planning webinar

The problem was that the large group attempting to log in to the presentation were jamming the conferencing phone system. It was sorted out within 10 minutes of the scheduled start time. Good problem to have, really.

I was introduced to ADR when I joined the world of internal audit in May 2008 and have been taking advantage of the site’s features ever since, such as case studies, internal control questionnaire (ICQ) templates, audit department benchmarking tools and example audit work plans.

Today’s webinar was valuable to me because it focused on how five companies’ internal audit groups are dealing with the challenge of providing assurance over strategic risk. This is a topic that I have championed in my capacity as an internal auditor, and the companies in the webinar were actually walking the walk.

Some of the highlights:

• One group enabled management to better identify and assess complete risk information by developing a tool that required them to drill down from higher level risks to their lower level components. What I liked in particular about the tool was that it discouraged the tendency to choose medium likelihood and medium impact (what they called “midpointing” although I’d never heard the term) by making those assessments lead to a “signficant” rating.
• Another group credited management for its efforts in identifying processes which were well-controlled versus those that were less well-controlled, by tailoring the assurance strategy to the former. Simply the act of identifying a poorly-controlled process would spur management to implement the necessary controls, at which point the process would migrate to the well-controlled side.
• Yet another group maps the principal risks identified at a high level to each applicable business process to ensure adequate coverage. Internal audit focuses on the processes involved in executing on the strategic priorities, to provide assurance that those risks are well-controlled.

I enjoyed the webinar because it took what can be a challenging theoretical problem and showed examples where leading internal audit groups are concretely addressing the concerns of management over the key risks driving the performance of the business.

How are you implementing practices like these to provide assurance over the risks that primarily drive enterprise value?

“In the high-powered committee report on Satyam scam, we have proposed that internal audit should be outsourced and not be in house so that there is more independence. If the auditor is from the organisation, it is as good as being an employee of the organisation and the chances of remaining unbiased decline. Market regulator Sebi through clause 49 and the corporate affairs ministry through the Companies Law should make it mandatory that the internal auditor should be from outside the organisation,” ICAI president Amarjit Chopra told The Indian Express.

I can’t really argue with the logic, but the feasibility of the idea is fair game. The logistics of putting this into place is giving me a headache, and it does seem like an overreaction to a single instance of fraud.

The voice of reason comes from the director of KPMG in India:

“More important [than outsourcing] is the communication between head the of internal audit and CEO or chairman of audit committee. The success depends more on how freely and directly the internal auditor can discuss the shortcomings in a firm with the CEO of audit committee.”

Boards should be ensuring that the lines of communication between the Chief Audit Executive and the Audit Committee are direct and communications frequent and frank. That applies even if IA is outsourced as well.

I blogged a while ago about the Satyam scandal.

The data in .pst files has been accessible through the Messaging API (MAPI) and Outlook Object Model (two things of which my understanding is minimal at best), but only if the user has Outlook installed:

In order to facilitate interoperability and enable customers and vendors to access the data in .pst files on a variety of platforms, we will be releasing documentation for the .pst file format. This will allow developers to read, create, and interoperate with the data in .pst files in server and client scenarios using the programming language and platform of their choice. The technical documentation will detail how the data is stored, along with guidance for accessing that data from other software applications. It also will highlight the structure of the .pst file, provide details like how to navigate the folder hierarchy, and explain how to access the individual data objects and properties.

The documentation will be released under Microsoft’s Open Specification Promise, which means that it is protected against patent claims. Other Microsoft Office formats, such as the XML-based .docx and .xlsx, and the older binary formats .doc and .xls, are covered under this promise.

This seems like a big win for users of Microsoft Outlook. Along with CodePlex, which hosts open source projects, it seems like Microsoft is slowly opening things up and making life easier for their customers. It certainly has the potential to make it easier for customers to leave the Outlook platform. From GigaOM:

In the past, if someone was moving from Outlook/Exchange to Gmail or any other platform, there was a pretty tedious process of exporting pieces of data from Outlook into various formats before moving over to the new platform. Basically, once you didn’t have Outlook, that .pst was a useless brick of data. Now in that case you’ll be able to take that .pst file with you and if other apps/platforms build readers, they will be able access that data. So migration to other platforms is a valid use case where there’s some benefit.

Some more ideas as to the reasons why Microsoft is making this change were floated on ZDnet a day after the announcement:

[Rob Helm, an analyst with Directions on Microsoft,] added that he believed Microsoft is trying to wean large customers from storing mail in .PST files or file systems “because doing that makes it hard for organizations to back up all their e-mail, enforce e-mail retention policies, and locate relevant e-mails during legal discovery.”

Not just retention, but perhaps helping organizations mine their email data for knowledge which can all too frequently be lost forever if an employee leaves the company? Here’s an idea: How about a tool that will gather information from emails dating back years and populate a wiki automatically for new employees?

[Rob Sanfilippo, another Directions on Microsoft analyst] added that .PSTs “are used most frequently for archiving purposes and Exchange Server 2010 includes a new server-based Personal Archive feature that gives users a separate mailbox to use for archiving on the server instead of using a PST.” He said this gives weight to the aforementioned idea that Microsoft is trying to help organizations get users off PSTs and onto server storage.”

Then, in February of this year, the promised documentation was released on the MSDN website. Finally, about a month ago, two open source tools that make use of the documentation were released on CodePlex:

• The PST Data Structure View Tool is a graphical tool allowing the developers to browse the internal data structures of a PST file. The primary goal of this tool is to assist people who are learning .pst format and help them to better understand the documentation.
• The PST File Format SDK is a cross platform C++ library for reading .pst files that can be incorporated into solutions that run on top of the .pst file format. The capability to write data to .pst files is part of the roadmap will be added to the SDK.

The project has seen some exciting progress, which is good news for organizations that use Outlook. And as you might know, data visualization used to enhance understanding is a favourite topic of mine!

What risk do these developments address within Outlook’d organizations? Knowledge/information management is critical to so many companies. The use, retention and (hopefully) reuse of knowledge developed by employees and stored in email conversations within Outlook will be enhanced through this openness.

Has your organization taken these developments into account in your audits of knowledge/information management and strategy?

Organisations need to break out of the compliance cocoon and evolve into a fully fledged leadership role that delivers real value to the business. In the current economic climate, the biggest risk for most companies is not a failure to meet compliance requirements, but a failure to meet strategic targets.

The study also assessed last year’s top 10 business risks. In it, the analysts ranked the aftershocks of the credit crunch and the deepening global recession as the most important business risks, displacing regulation and compliance from the top spot.

Still more evidence that the Internal Audit profession demands an expanding skill set and well-rounded people with experience in more varied aspects of business. Auditors are going to have to continue to push themselves outside of their comfort zone in order to provide the greater value that shareholders require of the function.

How does your IA department stack up?