View from the institute: Consequences – time to assess your risks A&R Magazine Nov Dec 21

Anyone who hoped that emerging from Covid lockdowns would return us to business as it was in 2019 has been swiftly disillusioned. Since the economy began to re-open fully in the summer, we have seen chronic shortages of HGV drivers, soaring gas prices, empty petrol pumps and a lack of carbon dioxide causing gaps on supermarket shelves. 

Some of this has been attributed to panic-buying by consumers and dire warnings in the press about “cancelling Christmas”, but the shortages of products, materials and people are not fictional. They are affecting retailers, hospitality venues and factories and, ultimately, pretty much everyone in our society.

That is the trouble with risks. As internal auditors are well aware, they ripple outwards, causing wave after wave of disruption, inconvenience, and worse. It’s human nature to seek to blame someone – “irresponsible” people, the government, Brexit or Covid – but complex risks usually have multiple causes as well as multiple, hard-to-predict consequences.

This makes internal auditors’ jobs even more challenging right now. Many are under pressure to get “back to normal”, but what does that mean? It cannot mean going back to the way we worked before the pandemic. The world has changed and so must internal audit – as Richard Chambers told the Internal Audit Conference this week, no one will decide the future of internal audit except internal auditors themselves.

Understanding the interrelated nature of the broad, structural and endemic risks we now face is crucial to this. Things change rapidly and constantly and, each time they change, they shift the pattern of the ripples. Things that start small can escalate rapidly causing major, shifting, challenges. Some are local, or confined to one sector, but Covid has taught us that geographies and sectors are so closely connected that any “trouble at t’mill” soon affects not only other “mills” but many other industries and locations as well.

It is therefore not surprising that our landmark Risk in Focus 2022 research highlighted three key concerns that should be on all internal audit leaders’ radar – workforce fatigue and culture erosion, supply chain strains and the race to flexibility, and the climate change and sustainability parts of the environmental, social and governance (ESG) agenda. 

All of these are wide-ranging risks that have a tendency to grow and extend tentacles into new areas of concern the more you explore them. These are the issues that internal audit leaders told us are keeping them awake at night. And they are all issues likely to continue to throw up new risks, and exacerbate the severity of existing risks, in the future.

If internal auditors are to help their organisations manage such risks, we need to develop innovative systems and ways to monitor the risk ripples as they spread. We need to become better at connecting different categories of risk, because the consequences of a rapidly changing environment do not lie in convenient packages marked “supply chain” or “transport”. This is not new, but the degree and extent of the disruption and the number of ripples currently travelling around the world is exceptional.

Internal audit teams that coped well in the pandemic should hope that their organisations look to them for help in the subsequent crises that loom large. We need to rise to this challenge and offer substantial support to help management cope in difficult times, which seem likely to continue.

Make no mistake; many of these emerging risks could destroy a business. The pandemic is not over and new variants may yet cause further disruption or even lockdowns. Pubs, restaurants and shops are closing early or for part of the week, because they lack supplies and staff. Scarcities and record prices for materials and fuel are threatening the viability of building projects and challenging online retailers, many of which thrived in lockdowns. 

There is little point hiring new HGV drivers if there are no goods to transport – or customers have to focus their spending on heating their homes instead. Consequences matter, but may not play out in the way they have in the past.

Internal auditors also need to assess how evolving issues affect their own ability to work “as usual”. They must continue to seek ways to circumvent barriers and offer new forms of assurance, and accelerate their reactions to emerging risks, planning and reporting. 

How will internal audit teams identify and attract the best people when good employees can look further afield and think differently about how and where they want to work? Can you still do site audits and, if these are necessary, how will you get there and what will this cost? How sustainable is the internal audit function and how resilient is it to deal with further, rapid change?

The Chartered IIA continues to monitor emerging risks and to provide forums and opportunities for members to discuss these and other challenges in a safe, supportive environment. We are continuing to support and evolve the networks and hubs we set up in 2020 and build on the lessons we learnt, even as we open up our face-to-face events and courses again.

Our flagship Internal Audit Conference demonstrated how we can blend traditional and new ways of providing support to ever more members simultaneously – and, importantly, develop further the sense of community that has proved important to many people in the past year and, we hope, will encourage more members to share their experiences and their concerns to benefit us all in future. So keep checking our website and emails for details of new guidance and events – our guidance for audit committees on climate change is out this month – and read Risk in Focus 2022 as a starter for ten.

The years ahead may be tough, but they should also be exciting, so brace yourself for a bumpy, but exhilarating ride. 

This article was published in November 2021.