Heads of Internal Audit Virtual Forum

10 November 2021

Please note:

  • All Institute responses are boxed and highlighted in blue
  • Where the chair comments in that capacity, the box is highlighted in yellow
  • For confidentiality, the identities of all delegates/attendees are anonymised

Participants

Chair: Derek Jamieson - Director of Regions, Chartered IIA
InstituteJohn Wood - CEO, Chartered IIA
Institute: Liz Sandwith - Chief Professional Practices Advisor, Chartered IIA

Chair's opening comments

A warm welcome to those of you who are attending the forum for the first time today. I hope you all enjoyed the session and benefit from this investment of your time.

A poll of preferred topics for future forums has been set up using Risk in Focus 2022 to inform planning for the first half of next year’s calendar of events.

Today’s topic is financial sustainability, and I would recommend you read our recent report Avoiding the blind spot: supporting financial stability and resilience as reading to accompany this session. The report reflects on the impact of COVID-19 and the potential path back towards the new norm. It provides a guide for navigating financial, capital and liquidity risk and includes actions and considerations for internal audit as well as case study examples from different sectors.


Key takeaways

Nick Forrest, UK Economics Consulting Leader, PwC

Macro risks

  • There are many macro-risks to be concerned about currently.
  • There are many sources of information on emerging risks but significant sectoral differences. For example, the Bank of England's Systemic Risk Survey showed that financial services firms are most worried about cyber attack but not climate change or global economic downturn.
  • Most risks are predictable, but the timings and interactions are hard to predict as risks move over time.

Regional risks

There are significant regional variations to consider. For example, inflation in the US, high natural gas prices in Europe, and property markets and geopolitical conflicts in Asia. Some risks move from one region to another, often causally e.g. trade flows.

Global risks

  • Tailor risk analysis for different probability/impact risks.
  • Consider collisions and combinations of risks.
  • Plan different scenarios for these risks.
  • Assess direct and indirect/secondary impacts, the latter are often stronger e.g. trade, confidence.
  • Anticipate mitigating effects (e.g. fiscal/monetary policy) which can present opportunities rather than focussing solely on risks.

Emma Patten, Director – Restructuring and Insolvency, PwC

The last 18 months:

  • The restructuring market has been unusually quiet due to unprecedented government support and capital markets with available liquidity to pursue returns, although there are signs that mergers and acquisitions markets may have peaked.
  • Lenders and sponsors have been supportive through extensions and other measures, and these will have to be resolved in due course.
  • Emerging from the pandemic brings fresh challenges, such as supply chains and the labour market.
  • As organisations shift their focus to restoring operations, this has working capital and investment implications.

Looking forwards:

  • Sector-specific challenges will determine which companies are more susceptible to pressures.
  • Some sectors will already have been disproportionately affected by the pandemic (e.g. travel and hotels) and may therefore have less underlying resilience to absorb further pressures.
  • Industries more reliant on seasonal workers such as hospitality will be affected by labour shortages.
  • Industries such as automotive and construction that have most exposure to raw material price increases and supply chain issues will have been heavily affected.
  • Energy costs impact those companies with high energy usage the most.
  • ESG requirements are an increasing focus for companies and lenders, making it challenging for less environmentally friendly industries such as mining to access financing.
  • Broader transformational challenges such as digitalisation and pressure on companies to remain relevant.
  • Scenario planning and the shape of recovery will look very different for different sectors.

What does this mean for internal audit?

  • A lot of significant decisions will be made over the coming months, and therefore a strong focus on financial resilience will be key.
  • Robust processes and controls are critical, particularly:
    • visible financial forecasting
    • treasury and liquidity management
    • working capital management
    • cost control and spend management
    • stakeholder management.
  • The March 2021 BEIS consultation will have a significant impact with the proposal for directors of Public Interest Entities to create a resilience statement. This will likely require:
    • disclosure of any material uncertainties considered during the going concern assessment
    • a mandatory assessment period of five years
    • at least two reverse stress testing scenarios
    • further specific disclosures.
  • Having robust processes in place and being able to articulate these to external auditors and other parties will be really important.

Institute's comments

In particular, the importance of internal audit input into reverse stress testing scenarios is worthy of consideration, so as to ensure all options/scenarios have been robustly tested.

Much of that information may be sobering and presents challenges for internal audit moving forwards. There may be a level of uncertainty that is beyond our present comprehension. Internal audit will need to be more fleet of foot, adapting within organisations to reflect emerging risks. However, it will be an exciting time.


Chair's closing comments

Thank you to our speakers – this is definitely a session to reflect on.

Our next meeting on 1st December sees us welcoming John Devine, Chair of the Audit Committee at Abrdn and Chair of the Board at Credit Suisse International. We had an excellent response when he spoke earlier this year and he will return in December to offer his reflections on the year but more importantly his views on the year to come and the potential challenges for internal audit.

I would like to thank those of you who attended the national conference last week. We had our largest attendance ever, nearing 1,000 people. I hope you enjoyed the event and that you took away many insights to share with your teams.

Finally, the South-West Region’s 40th Anniversary event is rapidly approaching now and is also heading for a record attendance. They would be delighted to welcome old and new friends.


Chat box comments and discussion

Q: What do you think about the possibility of organisations tripping from one risk event to another, and potentially cyber-attack being the tipping point?

A: This is definitely a risk. It feels as though there are a lot more individual challenges now than over the last 18 months rather than focusing solely on the Covid risks. Have we taken our eye off of risks that are now coming to the fore? As mentioned, transformation risk and cyber risk – companies may now be under pressure to change very quickly and with that comes risk. When you put this all together it could snowball into a bigger issue. To be optimistic, some risks do fade quickly (e.g. petrol queues) and we can work through them. Economically, there may be a better year ahead. The risks of Brexit, Covid and US uncertainty have materially reduced, so although there is uncertainty ahead, we must keep track of the risks that are fading away as well as those emerging.

Discussion:

  • The resilience statement will be a really good tool for internal audit and touches on the key risks that we’re dealing with - liquidity risk, supply chain and cyber risk. It is time for internal audit to engage with companies to be in the know about what is going into the resilience statement to shape coverage. It’s going to be a challenging but exciting year for internal audit and we will be at the forefront of driving change and giving our opinion on what needs to be done.
  • It feels like an ever-moving rollercoaster that we are on – financial resilience is just a key word and another thing to contend with.
  • Lots of challenge for us at the moment and lots of focus on cyber risk with a dedicated team to keep it at the front of minds.

Chat box:

  • I think that concept of the final straw to break the proverbial camel’s back is extremely applicable now, especially for executives.