Heads of Internal Audit Virtual Forum

1 December 2021

Please note:

• All Institute responses are boxed and highlighted in blue
• Where the chair comments in that capacity, the box is highlighted in yellow
• For confidentiality, the identities of all delegates/attendees are anonymised

Participants

Chair: Derek Jamieson - Director of Regions, Chartered IIA
Institute: John Wood - CEO, Chartered IIA
Institute: Liz Sandwith - Chief Professional Practices Advisor, Chartered IIA

Key takeaways

John Devine, Chair of the Audit Committee at Abrdn and Chair of the Board at Credit Suisse International

The last 18 months have been challenging beyond belief, but the profound level and rate of change is not over yet. If an organisation isn’t focused on managing change, then it is going to be very difficult.

It has been disappointing to hear about how internal audit has struggled over the last 20 months. Internal audit is positioned for success and its position enables it to be an influencer for good within organisations, along with a trusted adviser.

Some reflections on key challenges faced at board level (think about how engaged your organisation is with internal audit on these issues):

• Navigating your organisation’s context and how the world is changing around it
• Logical shifts in the strategic business plan in response to the geopolitical environment and economic uncertainty and whether related processes remain fit for purpose
• Understanding culture - a million and one different elements each day, not just internally but in terms of regulator and other stakeholder expectations
• Flexible governance models in response to rapid change
• Managing the complexities of cyber risk
• Climate risk and its wider potential implications on how organisations operate
• Business resilience is pivotal but there is more to think about than simply technology

These are not an add-on to the role of the Chief Audit Executive (CAE) but need to be subsumed within the role. The CAE should be one of the most important roles within an organisation. These are challenges that boards need an informed opinion on from their CAEs, considering the underpinning processes and information that supports strategic decision-making.

Ask yourself these questions:

1. Do you feel that you are positioned with right status, connectivity and degree of influence to help your organisation address these challenges?
2. Over the last 18 months, do you feel that you have had an impact in your organisation? If not, what do you need to do about it?
3. Do you feel that your organisation understands and is ready for these issues? If not, do you need to improve your relationships in order to ask the right questions and educate at the top table?
4. Do you know as much about your organisation as you possibly can?

Internal audit is a fantastic activity that has so much to give to the organisation if it is positioned correctly. Your challenge is to reflect on these questions and where you stand.

Chat box comments and discussion

Q: In the absence of a supportive and strategic audit committee, how can a CAE meet the challenges raised?

A: Many audit committees need to step up as well. In regulated industries this is forced but it is more challenging in other sectors. In the absence of a supportive audit committee chair, the relationship with the Chief Executive becomes more important. Look at the governance structure, a weak audit committee is a significant control weakness in an organisation and needs to be called out.

Discussion

• If you are a CAE, then you need a strong spine to be able to deliver your informed evidence-based opinion, even if it doesn’t align with that of the executive. You may not be sat at the top table on a regular basis outside of the audit committee, but you are the eyes and ears of the non-executive directors. If you are not willing to have difficult conversations then you should not be in the job.

• Too many CAEs sit around like plants waiting for the audit committee to water them. A lot of audit committee members don’t have a strong awareness of internal audit and will accept their contribution without truly seeing the value of their work. We need to help them understand.

• If the audit committee aren’t pushing you, then you need to push them to push you. They need to understand your role as a business advisor, not an accountant, promoting the work that internal audit can do outside of the normal audit sphere.

Chat box

• I have found the periodic review of audit committee performance to be helpful in addressing a weak ARAC. Being direct about weaknesses might be difficult but working through a structured, facilitated, impartial evaluation is a more constructive and 'comfortable' way to address points of weakness.

• I agree on the message from John, especially the point about the added value of internal audit. We have to be proactive to do this and not wait around, and to understand the power of internal audit to do this within the right governance structure.

• In addition to what has been said, one of the key things that I look out for when taking on a CAE role is understanding if it’s a strategic role rather than a box ticking role.