Heads of Internal Audit Virtual Forum

10 November 2021

Please note:

• All Institute responses are boxed and highlighted in blue
• Where the chair comments in that capacity, the box is highlighted in yellow
• For confidentiality, the identities of all delegates/attendees are anonymised

Participants

Chair: Derek Jamieson - Director of Regions, Chartered IIA
Institute: John Wood - CEO, Chartered IIA
Institute: Liz Sandwith - Chief Professional Practices Advisor, Chartered IIA

Key takeaways

Nick Forrest, UK Economics Consulting Leader, PwC

Macro risks

• There are many macro-risks to be concerned about currently.
• There are many sources of information on emerging risks but significant sectoral differences. For example, the Bank of England's Systemic Risk Survey showed that financial services firms are most worried about cyber attack but not climate change or global economic downturn.
• Most risks are predictable, but the timings and interactions are hard to predict as risks move over time.

Regional risks

There are significant regional variations to consider. For example, inflation in the US, high natural gas prices in Europe, and property markets and geopolitical conflicts in Asia. Some risks move from one region to another, often causally e.g. trade flows.

Global risks

• Tailor risk analysis for different probability/impact risks.
• Consider collisions and combinations of risks.
• Plan different scenarios for these risks.
• Assess direct and indirect/secondary impacts, the latter are often stronger e.g. trade, confidence.
• Anticipate mitigating effects (e.g. fiscal/monetary policy) which can present opportunities rather than focussing solely on risks.

Emma Patten, Director – Restructuring and Insolvency, PwC

The last 18 months:

• The restructuring market has been unusually quiet due to unprecedented government support and capital markets with available liquidity to pursue returns, although there are signs that mergers and acquisitions markets may have peaked.
• Lenders and sponsors have been supportive through extensions and other measures, and these will have to be resolved in due course.
• Emerging from the pandemic brings fresh challenges, such as supply chains and the labour market.
• As organisations shift their focus to restoring operations, this has working capital and investment implications.

Looking forwards:

• Sector-specific challenges will determine which companies are more susceptible to pressures.
• Some sectors will already have been disproportionately affected by the pandemic (e.g. travel and hotels) and may therefore have less underlying resilience to absorb further pressures.
• Industries more reliant on seasonal workers such as hospitality will be affected by labour shortages.
• Industries such as automotive and construction that have most exposure to raw material price increases and supply chain issues will have been heavily affected.
• Energy costs impact those companies with high energy usage the most.
• ESG requirements are an increasing focus for companies and lenders, making it challenging for less environmentally friendly industries such as mining to access financing.
• Broader transformational challenges such as digitalisation and pressure on companies to remain relevant.
• Scenario planning and the shape of recovery will look very different for different sectors.

What does this mean for internal audit?

• A lot of significant decisions will be made over the coming months, and therefore a strong focus on financial resilience will be key.
• Robust processes and controls are critical, particularly:
  • visible financial forecasting
  • treasury and liquidity management
  • working capital management
  • cost control and spend management
  • stakeholder management.
• The March 2021 BEIS consultation will have a significant impact with the proposal for directors of Public Interest Entities to create a resilience statement. This will likely require:
  • disclosure of any material uncertainties considered during the going concern assessment
  • a mandatory assessment period of five years
  • at least two reverse stress testing scenarios
  • further specific disclosures.
• Having robust processes in place and being able to articulate these to external auditors and other parties will be really important.

Chat box comments and discussion

Q: What do you think about the possibility of organisations tripping from one risk event to another, and potentially cyber-attack being the tipping point?

A: This is definitely a risk. It feels as though there are a lot more individual challenges now than over the last 18 months rather than focusing solely on the Covid risks. Have we taken our eye off of risks that are now coming to the fore? As mentioned, transformation risk and cyber risk – companies may now be under pressure to change very quickly and with that comes risk. When you put this all together it could snowball into a bigger issue. To be optimistic, some risks do fade quickly (e.g. petrol queues) and we can work through them. Economically, there may be a better year ahead. The risks of Brexit, Covid and US uncertainty have materially reduced, so although there is uncertainty ahead, we must keep track of the risks that are fading away as well as those emerging.

Discussion:

• The resilience statement will be a really good tool for internal audit and touches on the key risks that we’re dealing with - liquidity risk, supply chain and cyber risk. It is time for internal audit to engage with companies to be in the know about what is going into the resilience statement to shape coverage. It’s going to be a challenging but exciting year for internal audit and we will be at the forefront of driving change and giving our opinion on what needs to be done.
• It feels like an ever-moving rollercoaster that we are on – financial resilience is just a key word and another thing to contend with.
• Lots of challenge for us at the moment and lots of focus on cyber risk with a dedicated team to keep it at the front of minds.

Chat box:

• I think that concept of the final straw to break the proverbial camel’s back is extremely applicable now, especially for executives.