Alpha Flow Zenith

Under this umbrella company, established a new healthy energy drinks venture made from Matcha and Mate, due to launch in the US market in 2025 with the potential to expand worldwide.

In addition, offered advisory services to other organisations, such as K2 Integrity, the Institute of Internal Auditors (IIA) in Switzerland and the Global IIA.

Founder, Board Member and Strategic Advisor

Various organisations

During this period, acted as a trusted Board Member and Investor in several established and flourishing businesses:

➡️𝗔𝗟𝗔𝗦 𝗱𝗼𝗼: enabled Serbian mature IT outsourcing and Quality Assurance company to attract new clients. 

➡️𝗦𝗬𝗡𝗖 𝗕𝗿𝗮𝗻𝗱 𝗟𝗟𝗖: entered pioneering health and wellness company as the largest investor, collaborating with inspiring founders as a Board Member, supporting future funding pitches and securing international selling rights.

Board Member and Advisor

Veblen Director Programme

Veblen works with Executives, Thought Leaders and Entrepreneurs to train and connect them with public and private companies needing Board support. Veblen is a global network focused on board priorities such as Investor Relations, Good governance, DEI, AI, ESG and Fundraising.

Member

Resided as Chairman of the Board for six months, welcoming the opportunity to enhance the dynamics, governance and risk management aspects, maximising overall impact and effectiveness. 

Selected six new ‘engaging’ board members who added value, enabled members to become paid board members, and mitigated critical risks.

Chairman of the Board

In 2024, selected as a Board Member and served a six-month term. Provided strategic insight, guidance and advice to unlock opportunities, reviewing operational progress, financial performance and key initiatives. 

Instrumental in attracting the largest collaboration to date for the programme, the most valuable growth element for Veblen.

Board Member

Glencore

Played a pivot role in scaling Glencore’s audit capabilities worldwide with hubs across five continents, and embedded robust internal controls and an inventive audit strategy to prepare the business for a digital future. 

Supported the largest M&A and integrated the audit function of a pure mining company. 

Successfully retained the audit services for a newly carved-out agriculture entity. 

Offered invaluable support during the transition to a publicly listed company.

Chief Audit Executive

Senior Business Risk Auditor

Ascom

Internal Auditor

With over two decades of international business experience, I am a 𝗖𝗵𝗶𝗲𝗳 𝗔𝘂𝗱𝗶𝘁 𝗘𝘅𝗲𝗰𝘂𝘁𝗶𝘃𝗲, 𝗕𝗼𝗮𝗿𝗱 𝗖𝗵𝗮𝗶𝗿𝗽𝗲𝗿𝘀𝗼𝗻 𝗮𝗻𝗱 𝗧𝗿𝘂𝘀𝘁𝗲𝗱 𝗕𝗼𝗮𝗿𝗱 𝗔𝗱𝘃𝗶𝘀𝗼𝗿 with comprehensive ‘hands on’ 𝗚𝗼𝘃𝗲𝗿𝗻𝗮𝗻𝗰𝗲, 𝗥𝗶𝘀𝗸, 𝗖𝗼𝗺𝗽𝗹𝗶𝗮𝗻𝗰𝗲 (𝗚𝗥𝗖) and audit expertise, who advocates ethics, integrity and innovation. 

Recognised as a 𝗚𝗥𝗖 𝘁𝗵𝗼𝘂𝗴𝗵𝘁 𝗹𝗲𝗮𝗱𝗲𝗿, 

I have delivered many speeches, lectures, videos and podcasts to global audiences on related topics, such as ‘Achieving Goals in Governance’, ‘Value Driven Auditing’ and ‘Using the Power of Scenario Simulation to Remodel Control Testing - A Game Changer’.   

In 2024, I was recognised as an Audit Beacon at The 𝟲𝘁𝗵 𝗔𝗻𝗻𝘂𝗮𝗹 𝗜𝗻𝘁𝗲𝗿𝗻𝗮𝗹 𝗔𝘂𝗱𝗶𝘁 𝗕𝗲𝗮𝗰𝗼𝗻 𝗔𝘄𝗮𝗿𝗱𝘀, one of my proudest moments. 

As a multilingual communicator, fluent in three languages, I engage effectively with diverse stakeholders up to board level, steering and influencing strategic agendas relating to Environmental, Social and Governance (𝗘𝗦𝗚), Diversity, Equity and Inclusion (𝗗𝗘&𝗜), Artificial Intelligence (𝗔𝗜) governance, and cybersecurity. 

I served as 𝗖𝗵𝗮𝗶𝗿𝗺𝗮𝗻 of the Veblen Director Programme, enhancing the board dynamics and unlocking opportunities with global leaders. 

At 𝗚𝗹𝗲𝗻𝗰𝗼𝗿𝗲, a FTSE company, I developed audit innovation hubs spanning five continents comprising over 45 high-performing auditors, and advanced the company’s 𝗱𝗶𝗴𝗶𝘁𝗮𝗹𝗶𝘀𝗮𝘁𝗶𝗼𝗻 𝘀𝘁𝗿𝗮𝘁𝗲𝗴𝘆 with a new team of data scientists and rollout of digital tools and technologies. 

I was instrumental in supporting Glencore through a turbulent time caused by the commodities crisis, retaining $MM audit services for a carved-out agriculture business, and reducing working capital.    

Over the years, I have headed high-profile fraud investigations and mitigated risks, ensuring compliance during complex situations, and safeguarding positive outcomes. 

I created and maintained Glencore’s 𝗘𝗻𝘁𝗲𝗿𝗽𝗿𝗶𝘀𝗲 𝗥𝗶𝘀𝗸 𝗠𝗮𝗻𝗮𝗴𝗲𝗺𝗲𝗻𝘁 (ERM) framework, systems and standards, reporting upwards to the board. 

I inspire people and enrich companies of all sizes, from startups to multinationals, offering impact-orientated leadership and a forward-thinking approach.

𝗧𝗵𝗲 𝗢𝗿𝗴𝗮𝗻𝗶𝘇𝗮𝘁𝗶𝗼𝗻'𝘀 𝗠𝗲𝗱𝗶𝗰𝗮𝗹 𝗘𝘅𝗽𝗲𝗿𝘁: 𝗖𝗹𝗮𝗿𝗶𝗳𝘆𝗶𝗻𝗴 𝗜𝗻𝘁𝗲𝗿𝗻𝗮𝗹 𝗔𝘂𝗱𝗶𝘁

It's amusing, throughout my career, I’ve often been mistaken for an accountant. 

While some of us certainly have an accounting background, Internal Audit is a 𝗰𝗼𝗺𝗽𝗹𝗲𝘁𝗲𝗹𝘆 𝗱𝗶𝗳𝗳𝗲𝗿𝗲𝗻𝘁 𝗳𝗶𝗲𝗹𝗱! 

We're probably one of the most misunderstood professions out there.

To clarify things, I like to think of Internal Auditors as the doctors for an organisation. 

Here's why:

• 𝗛𝗲𝗮𝗹𝘁𝗵 𝗖𝗵𝗲𝗰𝗸: Just like a doctor performs a general health check, we assess the organisation's health, searching for vulnerabilities and areas that need attention.

• 𝗗𝗲𝘁𝗲𝗰𝘁𝗶𝗼𝗻: We employ various tools (like data analytics!) and methods to examine the organisation, spotting anomalies that could indicate a problem – what we call "risk exposure."

• 𝗣𝗿𝗲𝘃𝗲𝗻𝘁𝗶𝗼𝗻: We suggest measures to mitigate risks, similar to how a doctor recommends a cure or treatment plan for an ailment. Our aim is to prevent issues from escalating.

• 𝗖𝗼𝗿𝗿𝗲𝗰𝘁𝗶𝗼𝗻: When there's an incident requiring urgent action, especially in cases of (alleged) fraud, we're often called in to advise and help amend the situation.

• 𝗔𝗱𝘃𝗼𝗰𝗮𝗰𝘆: Beyond resolving problems, we promote a strong culture of governance, encouraging the organisation to "live a healthy lifestyle" to avoid future issues.

We're always listening to our "patients" – our clients – to truly understand their concerns, just like a doctor listens to understand your pains. 

Essentially, as long as perfect health doesn't exist, there will always be a need for Internal Audit. 

𝗘𝗻𝘀𝘂𝗿𝗶𝗻𝗴 𝘁𝗵𝗮𝘁 𝘁𝗵𝗲 𝗯𝗼𝗮𝗿𝗱 𝗮𝗻𝗱 𝘀𝗲𝗻𝗶𝗼𝗿 𝗺𝗮𝗻𝗮𝗴𝗲𝗺𝗲𝗻𝘁 𝗰𝗮𝗻 𝘀𝗹𝗲𝗲𝗽 𝘀𝗼𝘂𝗻𝗱𝗹𝘆 𝗮𝘀 𝘁𝗵𝗲𝘆 𝗻𝗼𝘄 𝘄𝗲 𝗮𝗿𝗲 𝗼𝗻 𝘀𝘁𝗮𝗻𝗱𝗯𝘆 𝗮𝗻𝗱 𝗿𝗲𝗮𝗱𝘆 𝘁𝗼 𝗮𝗰𝘁 𝗶𝗳 𝗻𝗲𝗲𝗱𝗲𝗱 𝗮𝘁 𝗮𝗻𝘆 𝘁𝗶𝗺𝗲.

𝙒𝙝𝙖𝙩'𝙨 𝙩𝙝𝙚 𝙢𝙤𝙨𝙩 𝙪𝙣𝙪𝙨𝙪𝙖𝙡 𝙬𝙖𝙮 𝙮𝙤𝙪'𝙫𝙚 𝙚𝙭𝙥𝙡𝙖𝙞𝙣𝙚𝙙 𝙄𝙣𝙩𝙚𝙧𝙣𝙖𝙡 𝘼𝙪𝙙𝙞𝙩 𝙩𝙤 𝙨𝙤𝙢𝙚𝙤𝙣𝙚?

Nam Phong Ho, CFA, CIA, CISA, CFE, QIAL

𝗧𝗵𝗲 𝗛𝗶𝗱𝗱𝗲𝗻 𝗧𝗿𝗮𝗽 𝗼𝗳 "𝗧𝗶𝗺𝗲𝗹𝘆" 𝗔𝘂𝗱𝗶𝘁 𝗥𝗲𝗽𝗼𝗿𝘁𝘀

My friend shared a story recently. Their board mostly measures them on meeting deadlines for audit reports. 

So, you can guess what happens: 𝘀𝗽𝗲𝗲𝗱 𝗯𝗲𝗰𝗼𝗺𝗲𝘀 𝘁𝗵𝗲 𝗺𝗮𝗶𝗻 𝗴𝗼𝗮𝗹.

Now, the Global Internal Audit Standards (Standard 11.2, to be precise) 𝘥𝘰𝘦𝘴 talk about communicating audit results in a timely way. And that's important! 

But focusing 𝗼𝗻𝗹𝘆 𝗼𝗻 speed can actually cause problems. I've seen it firsthand.

Here's why chasing only "𝘁𝗶𝗺𝗲𝗹𝘆" 𝗿𝗲𝗽𝗼𝗿𝘁𝘀 𝗰𝗮𝗻 𝗯𝗲 𝗮 𝗵𝗶𝗱𝗱𝗲𝗻 𝘁𝗿𝗮𝗽:

𝟭. 𝗞𝗣𝗜𝘀 𝗮𝗿𝗲 𝗹𝗶𝗸𝗲 𝘀𝗶𝗴𝗻𝗽𝗼𝘀𝘁𝘀, 𝗻𝗼𝘁 𝘁𝗵𝗲 𝘄𝗵𝗼𝗹𝗲 𝗺𝗮𝗽. A delayed report isn't always bad. Sometimes, it means we found bigger, nastier issues that need more digging. If we just look at the delay without understanding 𝘸𝘩𝘺, we miss the real story. 

𝟮. 𝗜𝘁 𝗰𝗮𝗻 𝘁𝘂𝗿𝗻 𝗶𝗻𝘁𝗼 𝗮 𝘁𝗶𝗰𝗸-𝗯𝗼𝘅 𝗲𝘅𝗲𝗿𝗰𝗶𝘀𝗲. When people are judged solely on hitting deadlines, the focus shifts from deep understanding to simply getting the report out. Auditors might not dig deep enough, miss root causes, and just do a quick, surface-level check. This leaves the organization thinking they're safe when, in reality, big risks are still hiding. 

𝟯. 𝗤𝘂𝗮𝗹𝗶𝘁𝘆 𝗼𝘃𝗲𝗿 𝗾𝘂𝗮𝗻𝘁𝗶𝘁𝘆, 𝗮𝗹𝘄𝗮𝘆𝘀. For me, an internal audit report is a bit like a 𝗽𝗶𝗲𝗰𝗲 𝗼𝗳 𝗮𝗿𝘁. It needs care and attention. I've always told boards and senior management: 𝗶𝘁'𝘀 𝗻𝗼𝘁 𝗮𝗯𝗼𝘂𝘁 𝙝𝙤𝙬 𝙢𝙖𝙣𝙮 𝗿𝗲𝗽𝗼𝗿𝘁𝘀 𝘆𝗼𝘂 𝗴𝗲𝘁, 𝗯𝘂𝘁 𝘁𝗵𝗲 𝙦𝙪𝙖𝙡𝙞𝙩𝙮 𝗮𝗻𝗱 𝙞𝙢𝙥𝙖𝙘𝙩 𝗼𝗳 𝗲𝗮𝗰𝗵 𝗼𝗻𝗲. A few impactful reports are far better than many superficial ones. 

𝗦𝗼, 𝗵𝗼𝘄 𝗱𝗼 𝘆𝗼𝘂 𝗵𝗮𝗻𝗱𝗹𝗲 𝗱𝗲𝗹𝗮𝘆𝘀 𝘄𝗵𝗲𝗻 𝗮𝗻 𝗮𝘂𝗱𝗶𝘁 𝘁𝗮𝗸𝗲𝘀 𝗹𝗼𝗻𝗴𝗲𝗿 𝗯𝘂𝘁 𝘆𝗼𝘂 𝘀𝘁𝗶𝗹𝗹 𝗻𝗲𝗲𝗱 𝘁𝗼 𝘀𝗵𝗼𝘄 𝗽𝗿𝗼𝗴𝗿𝗲𝘀𝘀? Here are a few 𝗽𝗿𝗮𝗰𝘁𝗶𝗰𝗮𝗹 𝘁𝗶𝗽𝘀:

𝟭. 𝗖𝗼𝗺𝗺𝘂𝗻𝗶𝗰𝗮𝘁𝗲 𝗽𝗿𝗲𝗹𝗶𝗺𝗶𝗻𝗮𝗿𝘆 𝗳𝗶𝗻𝗱𝗶𝗻𝗴𝘀. Share what you have so far, clearly stating that more work is ongoing and the final results might change. 

𝟮. 𝗦𝗲𝗽𝗮𝗿𝗮𝘁𝗲 𝗻𝗲𝘄 𝗶𝘀𝘀𝘂𝗲𝘀. If new risks pop up, finish the current report, then launch a 𝘯𝘦𝘸, quick engagement for those fresh issues instead of dragging out the first one. 

𝟯. 𝗕𝗲 𝘁𝗿𝗮𝗻𝘀𝗽𝗮𝗿𝗲𝗻𝘁 𝗮𝗯𝗼𝘂𝘁 𝗱𝗲𝗹𝗮𝘆𝘀. Explain 𝘸𝘩𝘺 there's a delay and what the potential risk exposure is. 

𝙃𝙤𝙬 𝙙𝙤 𝙮𝙤𝙪 𝙛𝙞𝙣𝙙 𝙩𝙝𝙖𝙩 𝙨𝙬𝙚𝙚𝙩 𝙨𝙥𝙤𝙩 𝙗𝙚𝙩𝙬𝙚𝙚𝙣 𝙙𝙚𝙡𝙞𝙫𝙚𝙧𝙞𝙣𝙜 𝙤𝙣 𝙩𝙞𝙢𝙚 𝙖𝙣𝙙 𝙚𝙣𝙨𝙪𝙧𝙞𝙣𝙜 𝙩𝙤𝙥-𝙣𝙤𝙩𝙘𝙝 𝙦𝙪𝙖𝙡𝙞𝙩𝙮 𝙞𝙣 𝙮𝙤𝙪𝙧 𝙖𝙪𝙙𝙞𝙩 𝙬𝙤𝙧𝙠?

𝗧𝗵𝗲 𝗔𝘂𝗱𝗶𝘁 𝗣𝗮𝗿𝗮𝗱𝗼𝘅: 𝗪𝗵𝗲𝗻 𝗦𝘁𝗮𝗻𝗱𝗮𝗿𝗱𝘀 𝗧𝗮𝗸𝗲 𝗮 𝗖𝗼𝗳𝗳𝗲𝗲 𝗕𝗿𝗲𝗮𝗸

"What criteria do you measure us against?" and "How can you audit without clear, established requirements?"

These are the real-life, frontline questions from Management and Function Managers we encountered during internal audit engagements. 

The Global Internal Audit Standards (2024) Standard 𝟭𝟯.𝟯 (𝗖𝗿𝗶𝘁𝗲𝗿𝗶𝗮 𝗳𝗼𝗿 𝗘𝘃𝗮𝗹𝘂𝗮𝘁𝗶𝗼𝗻) supports having clear criteria set by the board and discussed with management.

However, this is not the reality because even the most mature organisations will not have formal, approved criteria for every process. Trying to maintain this in our fast-changing business environment is unrealistic. 

Additionally, demanding discussion and some form of agreement can lead to issues if management does not concur. 

Another issue with this approach is that it reduces to a compliance and checklist exercise against these criteria. 

So, what are the ways to solve this problem?

𝗧𝗵𝗲 𝗦𝗼𝗹𝘂𝘁𝗶𝗼𝗻: 𝗥𝗶𝘀𝗸 𝗮𝘀 𝗢𝘂𝗿 𝗖𝗿𝗶𝘁𝗲𝗿𝗶𝗮

The way to answer these challenging questions is by adopting a risk-based approach to meet the organisation’s objectives.

𝗪𝗲 𝗶𝗱𝗲𝗻𝘁𝗶𝗳𝘆 𝗿𝗶𝘀𝗸𝘀 𝗮𝗻𝗱 𝗮𝘀𝘀𝗲𝘀𝘀 𝘄𝗵𝗲𝘁𝗵𝗲𝗿 𝗰𝗼𝗻𝘁𝗿𝗼𝗹𝘀 𝗮𝗿𝗲 𝘀𝘂𝗳𝗳𝗶𝗰𝗶𝗲𝗻𝘁 𝘁𝗼 𝗲𝗻𝘀𝘂𝗿𝗲 𝘁𝗵𝗲 𝗳𝘂𝗻𝗰𝘁𝗶𝗼𝗻'𝘀 𝗼𝗯𝗷𝗲𝗰𝘁𝗶𝘃𝗲𝘀 𝗮𝗿𝗲 𝗮𝗰𝗵𝗶𝗲𝘃𝗲𝗱. Our role includes identifying risks and opportunities for improvement, rather than following a strict script that quickly becomes obsolete.

By prioritising risk mitigation in our criteria, we shift the conversation from mere compliance to strategic effectiveness, positioning ourselves as business partners.
 
𝙈𝙮 𝙦𝙪𝙚𝙨𝙩𝙞𝙤𝙣 𝙛𝙤𝙧 𝙮𝙤𝙪:

When faced with no criteria for a new topic, such as AI adoption or entering a new market, do you prefer starting with an advisory engagement to assist management in developing criteria first, or jumping straight into an assurance audit using ad hoc criteria?

𝗠𝗼𝘃𝗲 𝗕𝗲𝘆𝗼𝗻𝗱 '𝗞𝗶𝗱𝘀' 𝗦𝗼𝗰𝗰𝗲𝗿' 𝗮𝗻𝗱 𝗣𝗹𝗮𝘆 𝗮𝘀 𝗮 𝗧𝗲𝗮𝗺

In Internal Audit, and while the theory is admirable, the reality can be frustrating.

The Global Internal Audit Standards encourage alignment with other assurance providers (like Compliance or Risk Management), perhaps through an 𝘼𝙨𝙨𝙪𝙧𝙖𝙣𝙘𝙚 𝙈𝙖𝙥.

It also requires essential conditions like clear accountability, roles, and responsibilities (like the 𝙏𝙝𝙧𝙚𝙚 𝙇𝙞𝙣𝙚𝙨 𝙈𝙤𝙙𝙚𝙡). 

This ensures comprehensive coverage and helps avoid gaps or overlaps.

But what do we observe in most organisations? 

🅢🅘🅛🅞🅔🅢. Everyone works diligently, but genuine communication is lacking.

𝑰 𝒆𝒏𝒋𝒐𝒚 𝒕𝒉𝒆 𝒂𝒏𝒂𝒍𝒐𝒈𝒚 𝒐𝒇 𝒂 𝒇𝒐𝒐𝒕𝒃𝒂𝒍𝒍 𝒎𝒂𝒕𝒄𝒉.

That reminds me of school children playing football. As soon as the ball is kicked, every child rushes towards it in a chaotic, confused scramble. The ball hardly advances, and they rarely score. 

That's similar to how many assurance functions operate today.

Now, observe a professional team. The striker stays up front, the midfielders control the flow, the defence maintains the line, and the goalkeeper shields the net. 

Each member has a clear role, they trust one another, and they collaborate to succeed.

𝐖𝐞 𝐧𝐞𝐞𝐝 𝐭𝐨 𝐬𝐭𝐨𝐩 𝐩𝐥𝐚𝐲𝐢𝐧𝐠 '𝐤𝐢𝐝𝐬' 𝐟𝐨𝐨𝐭𝐛𝐚𝐥𝐥' 𝐢𝐧 𝐚𝐬𝐬𝐮𝐫𝐚𝐧𝐜𝐞. 

𝐖𝐞 𝐦𝐮𝐬𝐭 𝐚𝐥𝐢𝐠𝐧, 𝐭𝐫𝐮𝐬𝐭 𝐭𝐡𝐞 𝐫𝐨𝐥𝐞𝐬 (𝐅𝐢𝐫𝐬𝐭 𝐋𝐢𝐧𝐞, 𝐒𝐞𝐜𝐨𝐧𝐝 𝐋𝐢𝐧𝐞, 𝐓𝐡𝐢𝐫𝐝 𝐋𝐢𝐧𝐞), 𝐚𝐧𝐝 𝐛𝐫𝐞𝐚𝐤 𝐝𝐨𝐰𝐧 𝐬𝐢𝐥𝐨𝐞𝐬 𝐭𝐨 𝐛𝐞𝐜𝐨𝐦𝐞 𝐬𝐭𝐫𝐨𝐧𝐠𝐞𝐫 𝐭𝐨𝐠𝐞𝐭𝐡𝐞𝐫.

𝙇𝙚𝙩 𝙢𝙚 𝙠𝙣𝙤𝙬 𝙬𝙝𝙖𝙩 𝙮𝙤𝙪 𝙩𝙝𝙞𝙣𝙠 𝙖𝙗𝙤𝙪𝙩 𝙩𝙝𝙚 𝙖𝙨𝙨𝙪𝙧𝙖𝙣𝙘𝙚 𝙤𝙧 𝙩𝙝𝙚 𝙨𝙞𝙡𝙤 𝙖𝙥𝙥𝙧𝙤𝙖𝙘𝙝?

𝗔𝘀𝘀𝘂𝗿𝗲, 𝗔𝗱𝘃𝗶𝗰𝗲 𝗮𝗻𝗱 𝗔𝗻𝘁𝗶𝗰𝗶𝗽𝗮𝘁𝗲

This presentation will be held online, and anyone around the world is welcome to join. to join. 

You will experience an approach that seamlessly combines assurance, advice, insight, and foresight into one cohesive audit engagement - the kind that truly resonates with Senior Management and the Board, 𝗽𝗼𝘀𝗶𝘁𝗶𝗼𝗻𝗶𝗻𝗴 𝘆𝗼𝘂 𝗮𝘀 𝗮 𝘀𝘁𝗿𝗮𝘁𝗲𝗴𝗶𝗰 𝗮𝗱𝘃𝗶𝘀𝗼𝗿 without making it loud.

IA Manager | Risk Consultant | President IIA PNG

🌏 Meet Nam Phong Ho, CFA, CIA, CISA, CFE, QIAL

Institute of Internal Auditors PNG proudly presents Nam Phong Ho, Founder and Board Member at Alpha Fow Zenith, as one of our prominent speakers at the Inaugural Pacific International Conference 2025.

Nam brings over two decades of leadership expertise in finance, risk management, and corporate governance. As former #ChiefAuditExecutive at Glencore PLC, he led the internal audit function, reporting directly to the board and senior management, and developed robust governance and risk management frameworks. Nam is also an entrepreneur and investor, bringing a wealth of business insight and global experience to the Pacific audit community.

Join us to hear Nam present on “Internal Audit as a Strategic Advisor”, discover practical approaches to elevating internal audit’s strategic impact and driving organisational success in the #Pacific and beyond.

📅 24-26 November 2025 | APEC Haus, Port Moresby
📧 Register: https://lnkd.in/gbv5RqmX or inquire via admin@iiapng.org | +675 325 1229

𝗜𝗻𝘁𝗲𝗿𝗻𝗮𝗹 𝗔𝘂𝗱𝗶𝘁 𝗮𝗻𝗱 𝘁𝗵𝗲 𝗣𝘂𝗿𝗽𝗼𝘀𝗲 𝗼𝗳 𝗩𝗮𝗹𝘂𝗲 𝗔𝘀𝘀𝘂𝗿𝗮𝗻𝗰𝗲

The purpose of internal auditing is described as providing assurance, insight, and foresight.

But behind these words lies a greater mission — to protect, enhance, and sustain organisational value.

I like to call this broader mission 𝗩𝗮𝗹𝘂𝗲 𝗔𝘀𝘀𝘂𝗿𝗮𝗻𝗰𝗲.

It is not only about risks and controls; it is about how every part of the organisation contributes to creating, protecting, and enhancing value.

Ultimately, it is about how internal audit provides independent assurance that this value is being realised and maintained.

The 𝗧𝗵𝗿𝗲𝗲 𝗟𝗶𝗻𝗲𝘀 𝗠𝗼𝗱𝗲𝗹 offers a solid framework for governance. It clearly defines roles, responsibilities, and accountability for effective oversight and value delivery:

• The first line creates value through execution and performance.
• The second line supports and monitors by guiding and challenging.
• The third line – internal audit – provides independent and objective assurance, linking the different parts of the organisation.

Each line plays a vital role, but accountability for value always remains with management and the board.

Internal auditors, by focusing on value rather than solely on compliance, can genuinely elevate their role — f𝗿𝗼𝗺 𝗰𝗼𝗻𝘁𝗿𝗼𝗹 𝗲𝘅𝗽𝗲𝗿𝘁𝘀 𝘁𝗼 𝘀𝘁𝗿𝗮𝘁𝗲𝗴𝗶𝗰 𝗽𝗮𝗿𝘁𝗻𝗲𝗿𝘀.

To become more strategic, we must think and speak the language of value, aligning our work with the real purpose of our profession: 𝗩𝗮𝗹𝘂𝗲 𝗔𝘀𝘀𝘂𝗿𝗮𝗻𝗰𝗲.

"𝗜𝗳 𝘆𝗼𝘂 𝘁𝗮𝗹𝗸 𝘁𝗼 𝗮 𝗺𝗮𝗻 𝗶𝗻 𝗮 𝗹𝗮𝗻𝗴𝘂𝗮𝗴𝗲 𝗵𝗲 𝘂𝗻𝗱𝗲𝗿𝘀𝘁𝗮𝗻𝗱𝘀, 𝘁𝗵𝗮𝘁 𝗴𝗼𝗲𝘀 𝘁𝗼 𝗵𝗶𝘀 𝗵𝗲𝗮𝗱. 𝗜𝗳 𝘆𝗼𝘂 𝘁𝗮𝗹𝗸 𝘁𝗼 𝗵𝗶𝗺 𝗶𝗻 𝗵𝗶𝘀 𝗹𝗮𝗻𝗴𝘂𝗮𝗴𝗲, 𝘁𝗵𝗮𝘁 𝗴𝗼𝗲𝘀 𝘁𝗼 𝗵𝗶𝘀 𝗵𝗲𝗮𝗿𝘁." -Nelson Mandela

𝙒𝙝𝙖𝙩 𝙡𝙖𝙣𝙜𝙪𝙖𝙜𝙚 𝙖𝙧𝙚 𝙮𝙤𝙪 𝙨𝙥𝙚𝙖𝙠𝙞𝙣𝙜 𝙩𝙤 𝙮𝙤𝙪𝙧 𝙘𝙡𝙞𝙚𝙣𝙩𝙨?

𝗗𝗮𝘁𝗮 𝗔𝗻𝗮𝗹𝘆𝘁𝗶𝗰𝘀 (𝗗𝗔): 𝗛𝘆𝗽𝗲 𝗼𝗿 𝘁𝗵𝗲 𝗙𝘂𝘁𝘂𝗿𝗲 𝗼𝗳 𝗜𝗻𝘁𝗲𝗿𝗻𝗮𝗹 𝗔𝘂𝗱𝗶𝘁?

When I began as an internal auditor, we processed SAP data through ACL for analytical reviews. We looked for exceptions. 

Honestly, for quite a while, I wasn't convinced that pursuing outliers was the most effective use of our time. That seemed more like external audit practice.

Then, around 2018, the technology became more affordable, and with some AI integration, Data Analytics (DA) experienced a resurgence. 

Today, if you don't mention 𝗖𝗼𝗻𝘁𝗶𝗻𝘂𝗼𝘂𝘀 𝗔𝘂𝗱𝗶𝘁𝗶𝗻𝗴 or 𝗠𝗼𝗻𝗶𝘁𝗼𝗿𝗶𝗻𝗴, your audit team seems outdated.

The fact is, DA and Continuous Monitoring aren’t new. They’ve been in use for decades!

My team and I built a full-blown Continuous Auditing suite. We even hired data scientists and engineers. We did this because neither the business (First Line) nor the Internal Control team (Second Line) was doing it. We filled a big gap.

After the Internal Controls (Second Line) team was established, the responsibility for this matter was brought into consideration in relation to their role.

This raises the question of where continuous monitoring should be placed within an organisation❓

𝗗𝗮𝗶𝗹𝘆 𝗿𝗶𝘀𝗸 𝗺𝗮𝗻𝗮𝗴𝗲𝗺𝗲𝗻𝘁 𝗮𝗻𝗱 𝗰𝗼𝗻𝘁𝗿𝗼𝗹 𝗮𝘀𝘀𝗲𝘀𝘀𝗺𝗲𝗻𝘁: 𝗗𝗼𝗲𝘀 𝘁𝗵𝗶𝘀 𝗳𝗮𝗹𝗹 𝘂𝗻𝗱𝗲𝗿 𝗧𝗵𝗶𝗿𝗱 𝗟𝗶𝗻𝗲 𝗮𝘀𝘀𝘂𝗿𝗮𝗻𝗰𝗲 𝗼𝗿 𝗿𝗼𝘂𝘁𝗶𝗻𝗲 𝗰𝗼𝗻𝘁𝗿𝗼𝗹 𝗮𝗰𝘁𝗶𝘃𝗶𝘁𝗶𝗲𝘀? 

𝙇𝙚𝙩'𝙨 𝙘𝙡𝙖𝙧𝙞𝙛𝙮 𝙬𝙝𝙤 𝙨𝙝𝙤𝙪𝙡𝙙 𝙗𝙚 𝙧𝙚𝙨𝙥𝙤𝙣𝙨𝙞𝙗𝙡𝙚 𝙛𝙤𝙧 𝙘𝙤𝙣𝙩𝙞𝙣𝙪𝙤𝙪𝙨 𝙖𝙪𝙙𝙞𝙩𝙞𝙣𝙜 𝙖𝙣𝙙 𝙢𝙤𝙣𝙞𝙩𝙤𝙧𝙞𝙣𝙜.

Where does Continuous Auditing and Monitoring ideally belong?

taplio

Nam Phong Ho, CFA, CIA, CISA, CFE, QIAL's Linkedin Analytics

Nam Phong Ho, CFA, CIA, CISA, CFE, QIAL

Performance ScoreNam Phong Ho, CFA, CIA, CISA, CFE, QIAL's LinkedIn Performance

Who is engaging with Nam Phong

Nam Phong Ho, CFA, CIA, CISA, CFE, QIAL's Best Posts (last 30 days)

Ready to grow your LinkedIn presence?

taplio

.css-6ytdur{background-image:linear-gradient(284deg, rgba(39, 43, 72, 1) 0%, rgba(33, 47, 183, 1) 100%);color:transparent;-webkit-background-clip:text;background-clip:text;}Nam Phong Ho, CFA, CIA, CISA, CFE, QIAL's Linkedin Analytics

Nam Phong Ho, CFA, CIA, CISA, CFE, QIAL

Performance Score.css-goub6s{font-size:var(--chakra-fontSizes-md);font-weight:500;color:var(--chakra-colors-gray-600);display:block;margin-top:var(--chakra-space-1);}Nam Phong Ho, CFA, CIA, CISA, CFE, QIAL's LinkedIn Performance

Who is engaging with Nam Phong

Nam Phong Ho, CFA, CIA, CISA, CFE, QIAL's Best Posts .css-1emoo84{font-size:var(--chakra-fontSizes-md);font-weight:400;color:var(--chakra-colors-gray-600);}(last 30 days)

Ready to grow your LinkedIn presence?

Nam Phong Ho, CFA, CIA, CISA, CFE, QIAL's Linkedin Analytics

Performance ScoreNam Phong Ho, CFA, CIA, CISA, CFE, QIAL's LinkedIn Performance

Nam Phong Ho, CFA, CIA, CISA, CFE, QIAL's Best Posts (last 30 days)