Rubik’s Cube Audit Approach Johnny Cagle April 20, 2017 Agenda • Session 1 – Introduction • Session 2 – Rubik’s Cube • Session 3 – Reporting Audit • Session 4 – Operations Audit • Session 5 – Compliance Audit • Conclusions 2 Why? FROM: “When I finish, I know enough to start.” TO: “When I start, I know enough to finish.” 3 Introduction Johnny Cagle April 20, 2017 4 Agenda • Background • Sarbanes-Oxley Act of 2002 • Research (“SOX”) • Fruit of the Loom • SEC Guidance on SOX • Berkshire Hathaway • Integrated Audit • Fruit of the Loom Internal Audit • Risk & Internal Audit • Auditors’ Dilemma • “Risk” • Theory of Constraints • Cost of Risk • Strategic Architecture • Risk-Based Audit • Foreign Corrupt Practices Act • Model-Based Audit (“FCPA”) • Summary • Committee of Sponsoring • Insights Organizations (“COSO”) • Conclusions 5 Background • BS Accounting, Lipscomb, 1971 • MBA, Samford, 1982 • IIA Member #31919 (1970s) • Certified Fraud Examiner • “Innovative Auditor” • Gulf States Paper Corporation • Intergraph Corporation • SAIC (DoD, USDA, DOI, NASA…) • Tempurpedic • Rhino Energy • Fruit of the Loom 6 Research Universities Corporate • “Auditing Real-Time Systems” (1971) • “Statement of Business Ethics” (1989) • “Christian Code of Ethics for Business” (1980) • “Internal Control Objectives” (1991) • “Forecasting the GNP, Price Level & • “Corporate Business Model” (1998) Unemployment” (1980) • “Integrating Methodology & Technology” (1999) • “Occupational Stress and Productivity” (1981) • “Strategic Mapping – Mapping Business Success in Three Dimensions” (2002) • “Model-Based Auditing” (2004) • “Business Process Engineering / Business Process Improvement” (2009) • “Risk Accounting – A New Way to Control Period Cost” (2014) • “A Top-Down, Risk-Based Approach to Performance Auditing for Internal Auditors” (2015) • “Rubik’s Cube Audit Approach” (2017) 7 Fruit of the Loom (“Fruit”) • Founded in 1851 • Awarded trademark # 418 in 1871 for the Fruit of the Loom brand • Purchased by Berkshire Hathaway Inc. in 2002 • Purchased Russell Corporation in 2006 • Purchased Vanity Fair Intimates in 2007 • $2+ Billion annual revenue • 33,000 employees globally Fruit of the Loom Corporate Headquarters – Bowling Green, KY 8 Berkshire Hathaway (“Berkshire”) • Original Berkshire Hathaway Inc. Founded in 1839 • Bought by Warren Buffett in 1964 • Headquarters in Omaha, Nebraska • Over 60 wholly-owned subsidiaries with some also owning several subsidiaries • Significant investments in Coca-Cola, American Express, IBM, Wells Fargo and others • $224 Billion annual revenue • 368,000 employees globally Warren Buffett, CEO Berkshire Hathaway Inc. • 25 headquarters staff “Risk comes from not knowing what you’re doing.” 9 Berkshire Subsidiaries Acme Brick Company Central States Indemnity International Dairy Queen, Inc. National Indemnity Company Applied Underwriters Company IMC International Metalworking Nebraska Furniture Mart Ben Bridge Jeweler Charter Brokerage Companies NetJets® Benjamin Moore & Co. Clayton Homes Johns Manville Oriental Trading Company Berkshire Hathaway Automotive CORT Business Services Jordan's Furniture Pampered Chef® Berkshire Hathaway Energy CTB Inc. Justin Brands Precision Castparts Corp. Company Duracell Kraft Heinz Precision Steel Warehouse, Inc. Berkshire Hathaway GUARD Fechheimer Brothers Company Larson-Juhl Insurance Companies RC Willey Home Furnishings FlightSafety LiquidPower Specialty Products Berkshire Hathaway Homestate Richline Group Forest River Inc. (LSPI) Companies Scott Fetzer Companies Fruit of the Loom Companies Berkshire Hathaway Specialty Louis - Motorcycle & Leisure See's Candies Garan Incorporated Insurance Lubrizol Corporation Shaw Industries Gateway Underwriters Agency BH Media Group Marmon Holdings, Inc. Star Furniture GEICO Auto Insurance BoatU.S. McLane Company TTI, Inc. General Re Borsheims Fine Jewelry MedPro Group United States Liability Insurance Brooks Helzberg Diamonds Group Buffalo NEWS, Buffalo NY H.H. Brown Shoe Group XTRA Corporation BNSF HomeServices of America Business Wire 10 Fruit IA Mission Provide independent audit and assurance services to help the Company reach its goals Goals, Objectives & while maintaining ethical business practices Requirements Risk of and effective internal controls with respect to Material Audits & Adverse Projects personnel, processes and systems. Event Responsibilities • Assess Risks Risk of Material Management • Test Controls Missed Requests Opportunity Laws, Focus on Service Regulations, • Standards, Policies, • “Audit Forward” Processes & Systems 11 Fruit IA Organization Johnny Cagle, CFE VP Internal Audit (US) Stephen Thompson, CA Matthew Pendel, CIA Amanda J. Brown, CIA Director Manager Supervisor Europe, Morocco & Americas Operations, IT Global Ethics & Vietnam & Reporting Compliance & Asia Pacific (UK) (US) (US) Rachid Badoui Jackie Perkins Lesly Reyes Chase Carver Staff Auditor IT Auditor Staff Auditor Staff Auditor (Morocco) (US) (Central America) (US) 12 Berkshire Audit Focus Continuity Management (ITGC) Privacy Access Management Management (EU GDPR) (ITGC) Reputation Management (GRC) Relationship Change Management Management (FCPA) (ITGC) Evidence Management (SOX / FCPA) 13 The Auditor’s Dilemma • Financial vs. Operational • Substantive vs. Control • Balance Sheet vs. Income Statement • Analytics vs. Sampling • Values vs. Processes • Internal vs. External • Testing vs. Interviewing • Actual vs. Forecast • Cost vs. Benefit • Control vs. Risk • Certainty vs. Uncertainty • Global vs. Local “When you come to a fork in the road, take it!” – Yogi Berra • COSO vs. COBIT • etc. vs. etc… 14 Theory of Constraints • The Theory of Constraints (TOC) is a management paradigm that views any manageable system as being limited in achieving more of its goals by a very small number of constraints. There is always at least one constraint, and TOC uses a focusing process to identify the constraint and restructure the rest of the organization around it. • Developed by Eli Goldratt • Books: – “The Goal” (1984) – “Critical Chain” – “Beyond the Goal” – Many others… 15 Theory of Constraints • The Goal: • Five Focusing Steps: – Maximize Throughput (Margin) 1. Identify the Constraint – Minimize Inventory 2. Exploit the Constraint – Minimize Operating Expense 3. Subordinate everything to the • The #1 Constraint is “making Constraint decisions without all of the 4. Elevate the Constraint relevant data”. 5. Prevent Inertia from Becoming • The Thinking Process helps the Constraint determine: • “Technology can bring benefits if – What to Change? and only if it diminishes a limitation.” – What to Change To? – How to Change? 16 Strategic Architecture • “How Strategic Architecture Wins Technology Wars” • Harvard Business Review – March-April 1993: – Charles R. Morris – Charles H. Ferguson • Proposed assumptions on how technology companies survive(d) technology architecture evolution. • “Organizational architecture and decision making mirror technical architecture.” – What is our “technical architecture”? 17 Strategic Architecture • Follow-Up HBR Article – April • Architectural Standards Setters: 2000 – Lessons Learned: – Microprocessor – Intel – Competitive success flows to the – Operating System – Microsoft company that manages to establish – Network System – Novell proprietary architectural control over – Printer Page System – Adobe, HP a broad, fast moving competitive space. • IBM opened its architecture too – Architectures impose order on the broadly. system and make interconnections • Apple held its architecture too possible. closely. – Proprietary architectures are under constant competitive attack. • “Point Product” vendors (e.g. – Legislated standards usually settle to Lotus) are always at risk when the the least common denominator. architectural leader changes the rules of the game. 18 Foreign Corrupt Practices Act • "(A) make and keep books, records, and accounts, which, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the issuer; and • "(B) devise and maintain a system of internal accounting controls sufficient to provide reasonable assurances that— – " ( i ) transactions are executed in accordance with management's general or specific authorization; – " ( i i ) transactions are recorded as necessary (I) to permit preparation of financial statements in conformity with generally accepted accounting principles or any other criteria applicable to such statements, and ( I I ) to maintain accountability for assets; – " ( i i i ) access to assets is permitted only in accordance with management's general or specific authorization; and – "(iv) the recorded accountability for assets is compared with the existing assets at reasonable intervals and appropriate action is taken with respect to any differences.” FCPA – December 1977 19 COSO • Committee of Sponsoring Organizations of the Treadway Commission (“COSO”): – Internal Control – Integrated Framework - 1992 – Refreshed in 2013 • In an “effective” internal control system, the following five components work to support the achievement of an entity's mission, strategies and related business objectives: – Control Environment – Risk Assessment Integrated Internal Control Framework - 1992 – Control Activities – Information and Communication – Monitoring 20 Components & Principles 21 COSO ERM • The COSO Enterprise Risk Management (“ERM”) framework defines essential components, suggests a common language, and provides clear direction and guidance for enterprise risk management. • Relationship