Internal Audit 2019 highlights: interview with Charlotte Valeur, chair of the IoD
Image credit: Director Magazine
When Charlotte Valeur speaks to internal audit she wants to hear opinions, an overview of emerging risks and comparative assessments about how her organisation is aligned with others in the sector. If necessary, she wants to be challenged about the existing way of doing things. A mere confirmation that past audits show that risks are being managed adequately is unlikely to fill her with confidence.
“I’ve been sitting on boards for the past 14 years and have worked with all kinds of internal audit teams, in-house teams and those provided by external firms and a combination of both,” she says. “The most important thing for me is that they have a risk-based approach and, surprisingly, that has not always been the case.”
Her investment banking background means that risk is something she is familiar with and understands well. She therefore wants to see a clear link between internal audit’s activities and the organisation’s risk appetite and its risk universe. Assurance on the key risks that are already clearly on the organisation’s radar and are regularly discussed by the board is useful, but internal audit can provide a more valuable role if it offers the board a wider view of emerging or concealed risks and examples of what other organisations in the sector are doing.
“I want to draw on the wider experience of the internal audit team. I want to know how we compare with others in the sector and I want informed opinions on whether we are currently monitoring and mitigating all the right risks,” she explains. “An internal audit team should know what good looks like and auditors need to tell us how they think we rank against others. I want the head of internal audit to tell me if we are not doing enough and to explain why not and what we need to do
to improve.”
While it is not internal audit’s role to tell management the exact solution to a shortcoming or a problem, she adds, it is helpful if a head of internal audit can draw on knowledge of other organisations or a network of contacts to suggest ideas
for improvements.
“The more eyes we have on important issues the better,” Valeur points out. “But we then need these eyes to be teamed with a clear voice. No directors or chief executives can see everything and they tend to focus on specific concerns. Internal audit can look into the detail.”
It is also important for directors to know that someone is keeping an eye on emerging risks, or those that are minor at present, but are likely to become more important. “What are other organisations looking at?” Valeur asks. “Do the risks we audit align with those recognised in other comparable organisations? What are the newest developments in data, culture and other vital risk areas?”
The wider perspective
An isolated internal audit is of limited value. What directors need, Valeur says, is the informed view of a well-connected internal audit function. Internal auditors who regularly talk to their peers, who keep up to date with national and international developments and who have a network they can call on for advice and suggestions are likely to spot forthcoming developments and highlight potential shortcomings before they become problems.
Ironically, it seems, the more we collect data and monitor processes internally, the more human connections, imagination and curiosity become part of the essential internal audit toolkit.
This kind of wide-ranging, ever-questioning, imaginative internal audit also requires a regular input of new people. “We need to bring in external experience of all kinds and we need internal auditors to move between organisations so they can ask different questions and provide an outsider’s view,” Valeur says. “People naturally resist change, but without it you can’t improve.”
This also is where the importance of diversity is clear, she adds. Ensuring that an organisation is diverse is essential, but internal audit needs to consider the issue on several levels. Not only will a diverse team enable internal auditors to provide the broad, fresh view that directors need, but they should also have an opinion on whether the organisation as a whole is benefitting from diversity as much as it could do and whether it is at risk from diversity-related failings.
“I once sat on an interview panel for a new external provider of internal audit,” Valeur recalls. “One provider gave us a wonderful spiel about diversity. I asked ‘so why am I looking at four white men then?’ Why should I engage a company that cannot show me proof of their commitment to diversity. I need to see evidence, not just words. Failing to ask these questions and to look for evidence would be a massive risk for me and my organisation.”
The same goes, she adds, for issues around the environment and sustainability. “We need to look at our own diversity and environmental and cultural issues, but we also need to look at our procurement strategies. Good practice has to go right through the system, not just because it’s the right thing to do, but because not doing it is a stupid risk to take.”
A business case for change
Diversity and the environment used to be the kind of issues that some directors would pay lip service to in public and then privately roll up their eyes and sigh, she explains. But things are changing fast. Both are now becoming issues that directly affect the bottom line.
“Investors are asking questions about these issues and will back away from organisations that are not doing the right things,” Valeur points out. “Similarly, your actions affect the contracts you will get. So these are improvements I want to see, but as a director I know that I need to see them. There is a clear business case.”
Her message for internal audit is also clear. The risks around organisational culture, diversity and sustainability are becoming ever more important and are affecting more areas of the business ¬– and more business risks.
In addition, Valeur wants internal audit to be drawing the board’s attention to key issues that could become risks in future. For example, if climate change causes sea water to rise and flooding to become more frequent, expensive headquarters in capitals across Europe could become uninsurable and factories and supply chains could be cut off or disabled. The risks associated with climate change and weather problems that cannot any longer be regarded as freaks may also be uninsurable.
“If these issues are not yet an important element of risk and governance in organisations they should be – soon,” Valeur says. “Much of central London could be at serious risk of flooding. If insurers start pulling out things could change very fast. A house you buy today could be uninsurable, and therefore unsellable in ten years’ time. The same is true of Denmark and lots of other European countries that have not been seen as high risk in the past.”
Such risks need to be on organisational risk registers and someone has to put them there, she adds. “If your organisation doesn’t have environmental risk on their risk register, you should be pushing for it to be on there.”
People don’t believe that the status quo will change and boards tend to look at the most pressing issues of the moment, which is why internal audit needs to raise this kind of potential future risk loudly and clearly and present measurable evidence of the business case, Valeur explains. This brings us back to the importance of a diverse group of minds able to think the unexpected, imagine unusual situations and ask the awkward questions.
“We don’t put enough value on people who think differently,” she says. “We want people with different experiences, but we also want to talk to people who look at things in a different way from the traditional people we’ve hired into audit and managerial roles. This is why we should be including people who are, for example, neuro diverse, or who see the world in a different way from most of us.”
Even when you are confident that you are considering all the risks that everyone else in your sector is considering, you cannot sit back and feel sure that you’re missing nothing, she adds. “You need people to remind you that there is still a strong possibility that you’re missing something important. It’s not enough to assume you’re looking at everything, just because you can’t think of anything else.”
This article was first published in September 2019.
Interested in attending the conference?
Book your tickets to Internal Audit 2019 today!
