Internal Audit Reduces SOX Burden to Raise Profile and Help Atlas Remain More Risk-Focused

Internal Audit Reduces SOX Burden to Raise Profile and Help Atlas Remain More Risk-Focused

Internal Audit Reduces SOX Burden to Raise Profile and Help Atlas Remain More Risk-Focused

Company Headquarters — United States

Number of Countries Operates in — 124

Number of Employees in Company — 1,800

Industry — Aviation

Annual Revenues — US$1.6 billion (as of Dec. 31, 2013)

Number in IA Function — 7

Number of Years IA Function Has Been in Place — 9

IA Director/CAE Reports to — Audit Committee and Chief Financial Officer


“ Now, everyone on the team thinks to ask, ‘How can we do this better?’ ” 

Charles Windeknecht


Atlas Air Worldwide (Atlas) is the world’s largest operator of Boeing 747 freighter aircraft. It moves just about everything: military vehicles, Formula 1 race cars, rock stars, Olympic hockey players, thorough-bred horses, college marching bands and more. Atlas also provides exclusive training to the pilots of Air Force One, the U.S. president’s aircraft. Atlas is the parent company of Atlas Air, Inc., which launched in 1993 with one aircraft, a Boeing 747-200, to become a leading global provider of outsourced aircraft and aviation operating services for commercial and military customers.

Atlas reported revenues of US$1.6 billion in 2013. Based in Purchase, N.Y., the company has four primary operating segments: ACMI, AMC Charter, Commercial Charter and Dry Leasing.

  • ACMI: Historically, the core of Atlas’s business has been providing cargo aircraft outsourcing services to customers on an ACMI (aircraft, crew, maintenance and insurance) basis in exchange for guaranteed minimum revenues at predetermined levels of operation for defined periods. Also included in the ACMI segment are the results of operations for CMI. CMI provides crew, maintenance and insurance services, with the customer providing the aircraft.
  • AMC Charter: This segment primarily provides full planeload charter flights to the Air Mobility Command (AMC). In addition to cargo flights, the AMC Charter segment includes passenger flights, which the company began providing in the second quarter of 2011.
  • Commercial Charter: Atlas’s Commercial Charter business segment provides full planeload cargo and passenger capacity to customers for one or more flights based on a specific origin and destination. Commercial Charter customers include charter brokers, cruise ship operators, freight forwarders, direct shippers and airlines.
  • Dry Leasing: Atlas’s Dry Leasing segment provides for the leasing of cargo and passenger aircraft and engines to customers. Through this segment, customers are provided a specific aircraft or engine without crew, maintenance or insurance. 

Charles Windeknecht has been vice president of internal audit for Atlas for six years. He reports directly to the board’s audit committee, and administratively to the chief financial officer. Atlas’s team of seven internal auditors is based at the company’s headquarters. The function is provided additional support through outsourcing arrangements as business needs and audits dictate.

The internal audit department at Atlas was established in 2005. “When I got here, the function was driven primarily by Sarbanes-Oxley (SOX) testing,” says Windeknecht. “The internal audit team did not seem to be achieving all that it was capable of. They did not have a prominent position within the organization and therefore may not have had the credibility to be completely effective.”

Windeknecht made improving internal audit’s image in the organization a top priority. “In my first two months at the company, I met with all of the department heads and the leadership team and asked them, ‘What’s your view of internal audit?’ I wanted to know their perceptions to better understand our current state. I also conducted a self-evaluation against The Institute of Internal Auditors’ Standards and shared the results with management. The Standards provided a reference point and helped us to identify a number of gaps and other issues.”

Less SOX, more focus

One issue that was making it difficult for the internal audit function at Atlas to build a positive image was the way it performed audits and presented findings – in short, there was no defined process. “So, I got right in the middle of it, right away, to address this,” says Windeknecht.

Trimming down the amount of SOX work was job one, according to Windeknecht, because the burden of that work was preventing internal auditors from focusing on anything else. “SOX gave life to the original internal audit function here, and that was good. But we were devoting more than 10,000 hours per year to testing. The hard part was that I couldn’t get a sense of how efficient or effective those hours were. I told management and the audit committee that we had a lot of focus on financial reporting risk and not much else – and that became an important area of focus for me.”

Windeknecht says the internal audit function at Atlas has made a “tremendous amount” of progress since defining their current state and setting a course for greater efficiency and effectiveness. One milestone was achieved in 2010, when an audit committee member approached Windeknecht and said, “You’re relevant.”

“That was a turning point,” Windeknecht says. “It was clear we were on the right track, and people were noticing internal audit and the good things we were doing.”

The second milestone, according to Windeknecht, was earning high marks for the internal audit function following an independent third-party review in 2012. “It was a testament to our efforts to continually improve,” he says. “ Now, everyone on the team thinks to ask, ‘How can we do this better?’ ”

A chronology of risk

Today, the strategic objective of the internal audit function at Atlas is to provide independent assurance that the company’s risk management and internal control processes are working effectively so it can achieve its strategic goals. The internal audit function’s objective is to be a business partner and a trusted adviser to management. The team’s mission is to provide an independent and objective assessment of strategic, operational, financial, regulatory, and information technology risks and control effectiveness to management and the audit committee, according to Windeknecht.

He says, “We recognize and accept the role of being one of the company’s key risk management processes. We also want to deliver tangible value by making practical recommendations that help support Atlas in achieving its strategic objectives.”

Another key objective for the company is, of course, making sure its aircraft are operating optimally. Windeknecht says: “When they’re utilized, we’re making money. So, one of our key objectives as a company is to make sure we have great reliability and full utilization of our planes. Anything – safety issues, compliance issues, security issues – that could impair our ability to have high degrees of reliability is a concern. We work closely with management to ensure we have the proper controls in place to manage the risks that could potentially impair our key objectives.”

As part of their annual risk assessment, the internal audit team at Atlas now provides a tool to help management focus more on strategic issues. “We provide a chronology – a five-year view – of what the top 10 strategic risks have been for Atlas,” explains Windeknecht. “This has had a significant impact on moving the organization toward issues of strategic importance.”

Finding a voice

Another reason Windeknecht knows internal audit is now making more of a difference at Atlas is that the team is being approached to do things outside of their traditional role, such as special projects and consultative reviews.

Internal audit is also adding value to Atlas proactively. For example, the team introduced a survey on the fraud risk assessment process and made it part of an important compliance review. When management saw the results, they asked internal audit to do the surveys every year so Atlas could start trending the data. “We plan to use this tool more, as appropriate, to build a database over time so we can spot trends and potential risks,” says Windeknecht.

The internal audit team is also working to help Atlas refine its risk management process, and make better use of annual enterprise risk assessment findings to get more clarity and visibility around risks and how well the company is managing them.

It has taken most of a decade for internal audit at Atlas to move squarely out of the shadow of SOX, earn more respect, and have more of a voice in the organization – but Windeknecht says his job is far from over. “I have to sell the credibility of the function every day because it’s too easy for people to see internal audit only in a traditional role,” he says. “I think it has been, and still is, a challenge for internal audit functions everywhere to find their voice. You need credibility first, though – otherwise the voice is not heard as well, or at all. But to earn credibility, sometimes you have to push back. The trick is learning how to do it right.”