In this context, the UMC Utrecht has expressed the ambition to set up a best practice Internal Audit department based on the 'Three Lines of Defense' philosophy. Since this is a new function and people are not familiar with operational audits and a broadly operating Internal Audit function, a lot of attention needs to be paid to creating support and getting the function 'properly established'.
Since mid-March 2017, I have started shaping this ambition through a phased approach. Initially, through desk research and interviews, I formed a picture of the organization, its processes, the system of controls and governance. On that basis, I developed an audit universe, process diagrams and risk analysis model. These tools are ideally suited for "getting into the conversation" with 1st and 2nd line functions and have been enthusiastically received. The next step is the validation of this toolkit in collaboration with various stakeholders, followed by a risk analysis, with the goal of arriving at a risk-based audit annual plan 2018.
Meanwhile, I am working on an audit methodology including a quality system, in accordance with the professional standards of the IIA, and pilot audits are being carried out in the 2nd half of the year, so that the organization can become acquainted with Internal Audit, its methods and added value. During this period, staffing of the department will also take place and governance will be set up in terms of consultation, reporting and accountability structures.
This great assignment allows me to apply all my knowledge in the areas of internal audit, risk management, compliance and governance and help the UMC in its ambitions in the area of controlled and sound business operations. This gives me great satisfaction!
Michel Vlak:
After about 25 years of experience as a Risk Manager and Head of Internal Audit at various organizations, I took the step early this year to work as an independent consultant. Through AuditPeople I obtained my first interim assignment, at UMC Utrecht.