Heads of Internal Audit Virtual Forum

1 December 2021

Please note:

  • All Institute responses are boxed and highlighted in blue
  • Where the chair comments in that capacity, the box is highlighted in yellow
  • For confidentiality, the identities of all delegates/attendees are anonymised

Participants

Chair: Derek Jamieson - Director of Regions, Chartered IIA
InstituteJohn Wood - CEO, Chartered IIA
Institute: Liz Sandwith - Chief Professional Practices Advisor, Chartered IIA

Chair's opening comments

This is our last session for 2021 and we thought it would be appropriate to welcome back a speaker from a very successful session we held in February this year to reflect on the year and look forward to 2022: another year of uncertainty, but also a year in which we hope to see ongoing recovery, progression of the climate emergency response and greater opportunity. 


Key takeaways

John Devine, Chair of the Audit Committee at Abrdn and Chair of the Board at Credit Suisse International

The last 18 months have been challenging beyond belief, but the profound level and rate of change is not over yet. If an organisation isn’t focused on managing change, then it is going to be very difficult.

It has been disappointing to hear about how internal audit has struggled over the last 20 months. Internal audit is positioned for success and its position enables it to be an influencer for good within organisations, along with a trusted adviser.

Some reflections on key challenges faced at board level (think about how engaged your organisation is with internal audit on these issues):

  • Navigating your organisation’s context and how the world is changing around it
  • Logical shifts in the strategic business plan in response to the geopolitical environment and economic uncertainty and whether related processes remain fit for purpose
  • Understanding culture - a million and one different elements each day, not just internally but in terms of regulator and other stakeholder expectations
  • Flexible governance models in response to rapid change
  • Managing the complexities of cyber risk
  • Climate risk and its wider potential implications on how organisations operate
  • Business resilience is pivotal but there is more to think about than simply technology

These are not an add-on to the role of the Chief Audit Executive (CAE) but need to be subsumed within the role. The CAE should be one of the most important roles within an organisation. These are challenges that boards need an informed opinion on from their CAEs, considering the underpinning processes and information that supports strategic decision-making.

Ask yourself these questions:

  1. Do you feel that you are positioned with right status, connectivity and degree of influence to help your organisation address these challenges?
  2. Over the last 18 months, do you feel that you have had an impact in your organisation? If not, what do you need to do about it?
  3. Do you feel that your organisation understands and is ready for these issues? If not, do you need to improve your relationships in order to ask the right questions and educate at the top table?
  4. Do you know as much about your organisation as you possibly can?

Internal audit is a fantastic activity that has so much to give to the organisation if it is positioned correctly. Your challenge is to reflect on these questions and where you stand.


Institute's comments

Much of what has been said should be in our New Year resolutions for 2022. It is too easy as a CAE to wait to be asked to share an opinion, but we have learned that is not how it will be moving forward. We need to be a partner of our audit committee, working with them to ensure that our organisations are sustainable and that they understand governance, risk and control. Sometimes you need to be willing to bang the table when needed.


Chair's closing comments

Thank you for such passionate insights. There were a number of very important challenges, clear expectations and relevant questions from a key stakeholder.

At our last session, we took a poll to identify preferred topics for discussion in the first half of 2022. The four top choices were cyber, climate, culture, and human capital. We have blended these topics into our planning and have set our schedule for the first three months.

Last night, we were able to congratulate our 2021 Audit & Risk Award winners at the annual celebration dinner, and we have now opened nominations for the 2022 awards. It is important that internal audit as a profession celebrates our achievements, so please take time to consider whether anyone within your organisation may deserve a nomination and submit an application.

I would like to personally thank all of those who attended, contributed to and offered suggestion to support the development and delivery of the forum this year. You have helped keep the forum relevant and we very much look forward to welcoming you back in 2022.


Chat box comments and discussion

Q: In the absence of a supportive and strategic audit committee, how can a CAE meet the challenges raised?

A: Many audit committees need to step up as well. In regulated industries this is forced but it is more challenging in other sectors. In the absence of a supportive audit committee chair, the relationship with the Chief Executive becomes more important. Look at the governance structure, a weak audit committee is a significant control weakness in an organisation and needs to be called out.

Discussion

  • If you are a CAE, then you need a strong spine to be able to deliver your informed evidence-based opinion, even if it doesn’t align with that of the executive. You may not be sat at the top table on a regular basis outside of the audit committee, but you are the eyes and ears of the non-executive directors. If you are not willing to have difficult conversations then you should not be in the job.

  • Too many CAEs sit around like plants waiting for the audit committee to water them. A lot of audit committee members don’t have a strong awareness of internal audit and will accept their contribution without truly seeing the value of their work. We need to help them understand.

  • If the audit committee aren’t pushing you, then you need to push them to push you. They need to understand your role as a business advisor, not an accountant, promoting the work that internal audit can do outside of the normal audit sphere.

Chat box

  • I have found the periodic review of audit committee performance to be helpful in addressing a weak ARAC. Being direct about weaknesses might be difficult but working through a structured, facilitated, impartial evaluation is a more constructive and 'comfortable' way to address points of weakness.

  • I agree on the message from John, especially the point about the added value of internal audit. We have to be proactive to do this and not wait around, and to understand the power of internal audit to do this within the right governance structure.

  • In addition to what has been said, one of the key things that I look out for when taking on a CAE role is understanding if it’s a strategic role rather than a box ticking role.