View from the top: Inspirational Leaders

Holly Sykes is head of internal audit, risk, insurance and fraud at Cornwall Council, Isles of Scilly Council and Corserv (comprising Cornwall Housing Limited, Cornwall Airport Limited, Cormac, Cornwall Development Company). She previously held a number of roles at Cornwall Council, including principal audit manager at Cornwall Council, European Elections presiding officer and general election count supervisor.

Before joining the council, Sykes was head of internal audit at the Ministry of Defence Internal Audit from 2014-2018. Among other responsibilities at the MoD, she was head of internal audit for Defence, Equipment and Support (DE&S) and Assets in Industry, which had an annual budget of £14bn and 10,000 employees.

From 2007-2016 she was an examiner for the Institute of Internal Auditors Advanced Diploma, while also working in roles at the MoD including combat air communications, business planning and transformation manager and typhoon fast jet programme governance and assurance manager. 

Her career began at RSM Tenon – Bentley Jennison Chartered Accountants.

Nicholas Crapp was the chief audit executive at NatWest Group from 2012 to 2021. Prior to joining NWG, he was the international director of audit at Goldman Sachs, a post he had held since 2008.

He joined Goldman Sachs in New York in 1993 in product control. Between 1998 and 2006, he held a variety of financial and control roles in Europe and Asia. He was appointed directeur générale of a French bank based in Paris from its acquisition to operational closure and worked in Hong Kong and then Japan as head of the operations, finance and services divisions with responsibility for all of Asia. In 2006 he joined the executive office in London, where he was responsible for the firm’s implementation of MiFID as well as running operational risk in EMEA.

Crapp started his career with Coopers & Lybrand in London where he qualified as a chartered accountant in 1988, subsequently moving to New York in 1992.

He is a passionate advocate for diversity and was the executive sponsor for LGBT inclusion at NWG. 

What do you see as the key attributes of a good leader?

HS: You must be consistently fair and transparent – it’s important to know that you could justify every decision if necessary and explain your reasons for it, and that you treat people the way in which you would like to be treated.

You have to lead by example. If I know that I have not lived up to my own values, or that I have been unfair to someone, it keeps me awake at night. It’s also important to see the positive in all that we do wherever possible. Internal audit is an overwhelmingly positive function because it’s about driving change and making things better, so there’s nothing wrong with a leader being a “nice” person as well. When people are difficult, you get better responses if you take a deep breath and respond by being nice. You may still need to make tough decisions, but you can do this well, in a fair, transparent way.

NC: Effective communication is essential if one is going to succeed, especially in the kind of challenging times we have witnessed in the past year. If you are to take your team with you, your communications need to be both regular and transparent. You need to be able to tell your team the whole truth, even when the news is bad, to be honest when you do not have all the answers and to answer all the difficult questions head on. 

When dealing with other stakeholders, your communications and reports need to be concise and precise, providing  robust feedback where it is required.

Other key attributes for leaders are flexibility and the ability to cope with change and to drive a response – you never know what is going to happen next and you need to be ready to steer the ship on a new course if necessary.

An internal audit leader also needs to be a champion for diversity, because a diverse internal audit team is likely to find more issues and because, if you want to attract the best people, you need to look for them in the largest pool. 

Leaders need to maintain a diversity focus on everything that happens in their team, for example, who is chosen to
be on a panel, what is the selection procedure and what message does the diversity of the panel send to the rest of
the organisation? 

They also need to drive the diversity agenda through the organisation – including promoting conversations about what it means to be diverse and inclusive – with the aim of ensuring that everyone feels they can bring their whole selves to work and be happy and confident in their workplace. Diversity has been hugely important to me and I am much richer for what I have learnt from engaging on this topic.

Last but not least, leaders need to have personal resilience, especially in internal audit, where the job of the leader can be very lonely.

What, if anything, did the pandemic teach you about leadership?

HS: I tend to worry a lot. I take pride in what I do and strive for perfection, but that can mean that I over-worry about how to achieve this for the team and for my own work. The pandemic taught me to let go of the smaller issues and focus on the bigger picture. We had to respond to the first Covid lockdown overnight and that was a powerful lesson about not getting obsessed with details. It’s important to keep your sense of perspective.

I’ve also learnt to compartmentalise. I made myself close the door on work when working from home. If it’s not a matter of life and death, overworking sets the wrong culture for the team and puts them under pressure.

NC: The pandemic reinforced the importance of authentic leadership – and especially the value of being present and accessible. Even before the Covid crisis, I held regular “Crapp’s Corner” sessions during which anyone in the team could book a 15-minute slot to speak to me. Managers in the team would often encourage individuals to take up this opportunity and helped to promote it. 

We continued these sessions virtually during lockdowns and they helped me to understand what others were going through. The team at NatWest comprised around 450 internal auditors, so, while I could not speak to everyone, I found that if you do enough of these one-on-one sessions you can learn a lot about common experiences. This helps to inform your decision-making, while also sending the positive message that you are listening and that your door is open.

The crisis also served as a reminder that empowerment is at the heart of good leadership. You cannot give a second opinion on everything and you need to have the
right people in the right seats – and then trust them to do their jobs.

In addition, it reinforced the importance of empathy, both for internal audit staff and also for stakeholders. 

What do you wish someone had told you when you first became a CAE?

HS: It would have been useful if someone had told me to trust my instincts. Internal auditors always look for evidence and assurance, but you also need a good “audit nose” and to have faith in your professional judgment, because sometimes you have to act fast or make a decision without all the facts. There may be no “right” answer and you need to trust yourself and the people around you.

NC: I believe that new leaders should be more willing to break eggs earlier. In a new role, there is perhaps a tendency to tiptoe around and take advice from too many people.

I’ve also learnt that you can never move too fast to establish the right team around you – while you also have to be seen as approachable to the whole team. 

You need to establish what is important to you upfront and directly; be tough and personable at the same time. 

And, above all, you must be unequivocally fair – leadership is all about establishing trust.

What advice would you give someone in your team if they want to move from being a good internal auditor to being an internal audit leader? 

NC: Build perspective to hone your judgment and develop the confidence to have the difficult conversations. I believe both of these abilities are rooted in knowing your subject thoroughly. A CEO once questioned a proposed adverse rating and, to break the impasse, I simply had to highlight one detail. This convinced him that the proposed rating was appropriate. Situations like this are daunting, but each time you succeed, it reinforces your faith in your own judgment.

I also strongly believe that the number one skill of an internal audit leader is to listen and that no leader should be afraid of changing their mind if they discover new evidence.

HS: Take every opportunity you are offered, because you will learn from it and it will take you somewhere. Every new experience becomes a building block that is part of what you become and what you can do – and this is true in other parts of life, not just work. If someone offers you a job in, say, procurement, do it. You will be a better internal auditor for it.

My career has not been linear, and I’ve worked in lots of functions. I’m also a trustee of a surf life-saving club and of an academy trust. A good leader could be dropped into most situations and lead, and internal audit is a great place to learn to be a leader, because you see all parts of the organisation. Every audit is different. It’s a great starting block for leadership positions.

One of the most important skills of a leader is to listen – leaders don’t have to be the loudest people in the room.

You also need to learn to deal with confrontation. Internal audit leaders face situations that can become heated. I find that working with stakeholders before important meetings helps to ensure that the conversations will be positive, professional and constructive, even when they tackle difficult areas.

Similarly, you need to be able to give bad news as well as good news. Leadership isn’t just about the happy days and you don’t always get it all right, but you can ensure you are fair and can justify any hard decisions. That’s why it’s vital to have a good team around you. You need to rely on each other, and a leader needs to know that the people around them will challenge them if they think they’re getting it wrong.

Leaders should know the strengths of their team and always look to help people develop and grow in their roles, but you will never have the perfect, harmonious team and there will always be new challenges. The important thing is to keep the overall goals in sight.

What element(s) of leadership do you find most challenging – and why?

NC: Trust and empowerment – it can take a long time to find the individuals you need to trust and empower. 

Trust is also a two-way process; you need to trust people to tell you when they need help or support and they need to trust you to look after their interests and support them when necessary.

 This is why I prefer to promote people from within the internal audit team, rather than hiring people from elsewhere (although new blood is important too). It means I trust them and they know me, so they are more likely to tell me if they need help. If mistakes are made, we need to spot these fast and act to resolve them. Mistakes are fine as long as we learn from them. 

Juggling the needs of all your stakeholders – management, the board, regulators and staff – is challenging. Looking back, I often think I should have focused more on the internal stakeholders, but at whose expense? 

It is a constant balancing act. This is another reason why it is crucial to have good people around you, whom you trust to talk to management, regulators and other stakeholders, while
you are engaged with another constituent.

HS: I had my children early so I was able to focus on my career later, but it means that being a mother has to come first. I make this clear to my team and I really understand the pressures of home life that other people have.

The pandemic, oddly, made it easier to balance life and work, because I wasn’t spending time travelling, but I’m aware that the situation was very different for other members of the team, who found it more challenging. 

The wellbeing of my team was always a major focus for me, but during lockdowns it was far more difficult to manage. I’ve tried to make it absolutely clear throughout the pandemic that no one should feel guilty if they need time to deal with family or wellbeing issues.

I’ve learnt so much from people who have managed me and leaders I’ve met – some have been truly inspiring and others showed me what not to do. The key is to take value from even the most negative situations by understanding why the relationship is not working and how you could change this dynamic in future. I hate egotism more than anything else at work. I don’t think there’s any room for it in a team.

What do you see as the main challenges for internal audit leaders in the future?

NC: Conducting internal audit work remotely will continue to be a challenge and many organisations plan to do more of this in future. We need to think hard about how to overcome the downsides – for example, is it easier for people working remotely to obfuscate the facts or tell you what they think you want to hear. 

Other challenges related to increased numbers of people working remotely include the different risk that individuals working from home may pose when they try to deal with problems with less support because they cannot put their hands up for help or advice in the same way they would in an office.  

For example, individuals  who used to work in call centres must now have difficult conversations at home, where it is likely to be more stressful because they are working in isolation. Similarly, how do you induct new employees and establish culture without a central office. These are huge changes and I am not sure we have really understood the full impact of these new working practices yet.

Other challenges for internal audit include artificial intelligence and understanding any inherent bias in data used to train algorithms. The risks are relatively well understood, but does internal audit have the necessary skills to assess and offer assurance on them?

Behavioural risk is an area that I have spent a lot of time on, because at NatWest we took behavioural risk beyond culture and began to look at customer outcomes. 

We were looking to see whether the choices of medium used by a company were more or less likely to lead to a favourable customer outcome. For example, we undertook work around customers’ understanding of the loans they took out under the various government Covid schemes. Given the current focus on customer outcomes, this work is a must for internal audit, although it requires a skillset that most internal auditors do not have. 

I think we may see more specialisation in internal audit and teams will have to source specialists from outside for some of these.

As I said earlier, diversity remains a challenge and it feeds into everything else we have discussed – authentic leadership, honest communications, the strength of the team and the skills we need in the future. Working from home affects diversity and the visibility of different groups in top teams and panels and this also needs to be considered. 

HS: Capacity will be a major challenge as organisations become leaner and need to take more risks, so internal audit becomes ever more important. We need to improve our understanding of the first and second lines and where assurance lies in the organisation. In the past few years, we have been saying that internal audit needs to be more strategic, which we are, but we also need to ensure that the first and second lines are in the right place, because once things start going wrong, problems spread rapidly.

During the pandemic we were there when we were needed and we had a clear function. I was a civil servant for a long time and I feel strongly driven by a sense of public service. The pandemic showed how internal audit can manoeuvre itself to be wherever it’s needed, because internal audit teams are highly skilled and versatile.

I don’t think we will need lots of specialist skills beyond great internal audit abilities in future, because we can buy in specialist advice when we need it. The true skill of a good internal auditor is to be flexible and to learn quickly about lots of different areas. We need access to the right people and we can learn from the experts. In future, I’d like to see more internal audits becoming the start of a conversation, not the end of it. 

his article was first published in September 2021