Auditing Strategic alignment

This technical guidance is written for all internal auditors, regardless of experience or sector. Although senior internal auditors often lead discussions on strategic matters, all internal auditors should be able to identify and raise issues relevant to this topic.

The aim of this guidance is to encourage critical thinking, gain a unique perspective and to consider information you are familiar with in a different way. It is primarily informative rather than a how to.

What is strategic alignment?

Why audit it?

Which risks might be relevant?

How to audit it?

What is strategic alignment?

Strategic alignment is the proactive linkage of what the board intends for the organisation and how the organisation operates day to day. It begins at board level with the endorsement/setting of a mission, vision and values and should flow into the operational level through structure, people, processes, rewards and link to the strategy.

Alignment is relevant for a variety of factors from external stakeholders through to digitalisation and everything between. This guidance focuses on the alignment of overarching core concepts.

There should be a golden thread between key elements such as Mission/Vision, Objectives/KPIs, Operations and Strategy. Internal audit should be alert as to the condition of this thread – whether it is strong, frayed or broken.  

Hold the image of this thread as you read on. It is a helpful way to think about the alignment of elements at all levels of the organisation.

Typically, an organisation’s Mission, Vision and Values (MVV) are the foundation for strategic decision making and pivotal in defining the organisations culture.

An organisation’s (MVV) should align:

mission | why does the organisation exist.

vision | where does the organisation aspire to be.

values | how the organisation will behave.

Although the majority of large organisations have an MVV which guides organisational culture, behaviours and actions, it is not the only option for a board. Management guru Henri Mintzberg defined ten schools of strategic thought of which having an MVV was one option. If your organisation does not have an MVV, look for other cues that provide the linkage between strategic thinking and operational activities, delegation of authority, business case, policies, recruitment, training etc.

Why audit it?

Strategic alignment is not the same as strategy although they are related. Here is our guidance on Auditing Strategy. Although alignment might not be an immediate consideration for the audit plan - it should be. In the same way as internal audit provides assurance that risk appetite thresholds set by the board are being respected at all levels, an audit of strategic alignment can provide assurance that linkages are effective rather than relying on trust or assumption.

Strategic alignment is of critical importance to an organisation. It should be designed, such as the flow of authorities and communications, to unite executives and leaders behind a common goal. Without it an organisation is unlikely to succeed as different elements can develop in silo’s – efficient and effective in isolation but not as a cohesive unit.

It is a risk for organisations of all sizes and across all sectors. For example, most organisations sign up to the strategic vision of reporting transparently about sustainability matters – ensuring this can be done accurately is a significant challenge and one that is exacerbated if all employees are not clear of the shared vision and objectives.

Enron and Wells Fargo are classic examples of misalignment. A mission and vision focused on commercial success with espoused values ignored in pursuit of shareholder value. Organisations such as the United Nations and Oxfam have clear alignment although are not without scandal when individuals rather than the board violate them.

Alignment can be taken for granted and overlooked by governance leaders, the board and audit committees; particularly when their time is prioritised to managing disruption from crises and the economy. Non-executives for example, spend their limited time at a strategic level and rarely see it in action operationally.  Given the complexity of strategic risk it is a good start point for internal audit assurance. It is a tangible subject for chief audit executives to build credibility with and develop the role of internal audit as trusted advisor at a strategic level.

What risks are relevant?

Here are five risks with context to get you started.

1. Strategy setting process does not sufficiently consider risk resulting in misalignment of strategy with organisation’s MVV

Enterprise risk management (COSO framework) enables the board to understand what types of risk and what level of risk are acceptable when setting strategy. It maintains the linkages with mission, vision and values. Consideration of risks and unintended consequences can be done through a combination of workshops, research, scenario games and modelling.

For example, to expand market share and increase revenue in a changing market, Wells Fargo’s strategy of increasing client accounts was sensible. The board however failed to consider the risks, that sales incentives might be abused with fraudulent accounts.

2. Rewards systems encourage risk taking in excess of the MVV with negative consequences for strategic objectives and potential reputational damage

Alignment of remuneration and performance schemes (such as bonuses or internal promotions) with strategy, critical success factors, and value is fundamental. Informal rewards such as status and recognition also come into play not just the structured schemes.

Look at your own organisation’s arrangements. Can you find potential unintended consequences? Wells Fargo is again a good example of this together with the widespread mis-selling of Payment Protection Insurance for two decades from the early 90’s. The ongoing diesel emissions scandal also highlights how high levels of variable pay (performance bonuses) can negatively impact behaviour. Also, consider financial services and the delicate balance on the trading floor (Barings Bank, Société Générale) plus the Libor scandal, all reward driven.

3. Organisational structure does not adapt with MVV and/or strategy creating an ineffective and inefficient framework within which to operate

In architecture there is a saying that “form follows function”; the design of something should support its purpose. The same is true of organisations. Changing an organisation’s structure (hierarchies, power base, geography, etc) can be slower and more complex than adapting strategy – sometimes even overlooked. Warning signs for misalignment include i) procrastination, delayed or ineffective decision making, ii) inability to innovate and iii) frequent tension and conflict. 

Any organisation going through change, such as a new CEO, a major transformation programme or using a redefined MVV to shift culture can find themselves in this situation as there can be a lag in the time it takes for people, governance, processes etc. to adapt.

4. Operational decisions disconnected from the MVV/strategy reduces the potential for success

Genuine alignment is embedded throughout day-to-day decisions. Famously, when President Kennedy toured NASA in 1962 he asked a cleaner about their work, to which the cleaner replied his job was to put a man on the moon.

Think about the treads that links decisions within your organisation such as personal objectives, department targets and KPIs.

The year before BP’s Deepwater Horizon disaster their annual report stated that safe, reliable and compliant operations were their first priority. Despite this, operational pressures among other factors led to decisions that resulted in the largest marine oil spill in history. In 2020, fashion retailer Boohoo was exposed for modern slavery activity in its Leicester factory leading to a drop in share price. Two years later after extensive remedial activity including stakeholder engagement and a new factory, their share price was still only a quarter of what it had been prior to the exposure.   

5. Not all members of the board and executives engage with the MVV of the organisation creating an environment where personal agenda, silo activity and/or disengagement can thrive

Executive alignment on the MVV is a key driver of successful organisations. Engagement surveys, one-to-one interviews can identify potential issues, although such discussions require mutual trust and a great deal of skill on the part of the internal auditor.

How is the MVV included in the induction of new members of the executive? Chief audit executives can ask insightful questions a few weeks after executives join – do they see the values in action, is the vision embedded and do they feel inspired by the mission? What process was used for setting the MVV? Was it inclusive and involved all the key players, then worked through disagreement to reach consensus? 

Prior to its liquidation in 2017, Carillion plc’s annual report included its vision to be a trusted partner bringing lasting benefits based on values such as ‘we care’. A stark difference to the toxic culture identified during the parliamentary inquiry into its affairs.

Internal audit’s role

The golden thread of alignment can be audited in two ways.

A standalone audit enables a snapshot at a given point, useful perhaps after a crisis or at key milestones during extended periods of change to provide assurance that alignment is being maintained/identify where disconnects are emerging or where the thread has broken.

A thematic review obtains evidence over a longer period of time, embedding standard tests within all engagements or from a series of discrete engagements leading to a single opinion. This may be useful in organisations that are highly innovative or dynamic to take account of natural cultural fluctuations.

Some questions to consider in deciding which approach to take might include:

• How risk mature is the organisation?
• Has the audit committee expressed interest in receiving assurance on strategy and/or strategic alignment throughout the business?
• Has the audit committee sought advisory input regarding strategic alignment?
• Does internal audit have a strong relationship with governance leaders?
• Is there concern about misalignment?
• How effectively does the organisation measure its success?
• Is data readily available along the golden thread?

Regardless of approach, planning is essential. For example, it may be useful to signpost thematic reviews for the audit committee with short progress updates. A thematic review will require consistency of data collection in order to collate opinions. Some standalone engagements may benefit from the CAE developing as an advocate at executive level to build credibility for internal audits involvement.

A consideration for chief audit executives is whether to include an opinion on strategic alignment as part of regular reporting to the audit committee. This might be particularly relevant for organisations in transformation, where there are disparate sites/function or where innovation is a priority. It may be appropriate to use the standard internal audit opinion framework for this work or it may be necessary to develop an alternative rating system in discussion with the audit committee. 

Tools and tips for internal auditors

When planning your audit, here are some tools and tips to consider. They are in no particular order. You may find some or all of them useful during your engagement.

Professional scepticism

When asked ‘does ‘this’ align to the strategy’ individuals accountable for the activity will undoubtedly agree and support it with evidence. Be alert to confirmation bias. For example, a project or objective may be part highly effective but part of a personal agenda or legacy goals and distracting resource away from the core priorities.

When evidencing alignment, look for the contribution that the element in question makes to the strategy and purpose. Maintain a healthy level of professional scepticism.

Measuring success

Bringing objective measurement into the alignment discussion is highly effective. Ideally, this will be embedded in engagement surveys, investment decisions and performance management frameworks as part of first- and second-line activities.

In the absence of formal measurement, internal audit could include a simple questionnaire (such as Survey-Monkey) to test the effectiveness of the organisations approach to alignment. The example below is for a commercial business and questions should be tailored to suit.

1. What are our top 3 priorities as a company?
2. Name 2 or more major initiatives?
3. How does our company sell? What are the primary channels for doing business?
4. Describe one or more of our user/customer personas? Who are they? What do they like?
5. Who are our key stakeholders e.g., suppliers?
6. What makes them choose our offering over a competitor?

You could also ask questions using ‘who, what, when, where, how, why’ often referred to a root cause analysis:

• Why do we exist as an organisation?
• Who are our key stakeholders?
• What are the most important processes/events for our organisation?
• When does our organisation add value/matter the most for stakeholders?
• Where are our most important assets?
• How do we achieve our mission?

Another option might be to devise a simple 0-5 scale using descriptors to ascertain whether projects, processes, tasks etc are strategically aligned. Internal audit should analyse multiple perspectives to avoid biases.

Targeted evidence

Avoiding rabbit holes and staying on track is a challenge with the breadth of possibilities for this type of audit engagement.

The example below uses a typical decision matrix for evaluating projects; the theory being that projects or processes that are not strategically aligned are a drain on finite resources. It is adapted for internal auditors to target the evidence required to provide insight into alignment evaluations. This type of analysis can be useful to surface routine legacy tasks in categories three and four that are not challenged day-to-day.

Next steps

As you will see from reading this, there is no prescribed approach, each organisation and internal audit functions approach will be unique. What is important is that internal audit provides insight and foresight about the condition of the golden thread of alignment. If it is fraying or broken the board need to know so they can address it.

Auditing strategic alignment

• is tangible and achievable
• demonstrates business acumen
• enables constructive discussion
• positions internal audit in the strategic space

Further reading

IIA Guidance | Auditing Strategy

IIA Global – Position Paper on the Role of Internal Audit in Enterprise-Wide Risk Management

Beehive | Purpose, Mission and Values Alignment