Heads of Internal Audit Virtual Forum

16 February 2022

Please note:

• All Institute responses are boxed and highlighted in blue
• Where the chair comments in that capacity, the box is highlighted in yellow
• For confidentiality, the identities of all delegates/attendees are anonymised

Participants

Chair: Derek Jamieson - Director of Regions, Chartered IIA
Institute: John Wood – Chief Executive, Chartered IIA
Institute: Liz Sandwith - Chief Professional Practices Advisor, Chartered IIA

Key takeaways

To have impact, add value and be able to rigorously challenge, we must recognise that people have emotions and not be task orientated – we need to be human and have empathy.

There are four elements to being a brave, courageous leader and internal auditor.

These are as follows:

Clarity

• You need a sense of purpose – personal and organisational
• Align your professional purpose with the needs of the organisation

Courageous

• Develop a view on non-factual areas
• Build resilience to be able to push back

Connections

• Empathise – put yourself in other’s shoes
• Acknowledge the impact that you have

Confidence

• Create a positive story about your own value
• Learn to be comfortable with isolation (independence can be lonely)

Click here for Carolyn’s slide with more detail on the 4Cs.

The 4Cs come with experience and learning. Carolyn’s tip for accelerating this is to seek out the opportunity to be a board member (trustee, non-executive, school governor) gaining personal experience of the skills and value that internal audit brings to the audit committee. This is invaluable.

Chat box comments and discussion

Q: How far can internal audit ‘challenge’ when prescribing a solution? What is our independence line?

A: Being bold is important. Internal auditors are not always great at thinking through the risk lens and articulating the risks that our findings identify. This can give management room to devise/agree solutions that might not address the risk completely. Independence should not be about box ticking; it’s really about objectivity and relationships, with the audit committee chair/CEO, to have impact as referenced in the Internal Audit Codes of Practice.

Q: You said this is about human interaction rather than process, what does that approach deliver?

A: Internal auditors tend to fall back on processes and facts: sampling, testing, analytics. It can be too easy to get drawn into auditing and reporting on what is in a neat box rather than being risk-based. There should always be a way to provide assurance over any risk - it might not be immediately obvious, but it will be there. The value can often be in what is less straightforward to audit and unpick: thematic, behaviour, culture. As audit leaders, we have to be prepared to express a point of view – to have professional judgement and not simply reporting findings.

Q: Internal audit can be accused of having too much empathy sometimes and weakening its message. What are your thoughts on that scenario?

A: Our job is like that of a doctor: we’re not doing anyone any favours if we tell them they are ok if they are unwell. Doctors are prepared for an emotional response when they deliver a diagnosis and, as internal auditors, we should do the same. We have to deliver an honest message as to the reasons why a pill isn’t always the only solution and that lifestyle changes may also be needed.

Q: Does our ability to be brave depend on the maturity of the organisation?

A: We have a range of ways of working to give real-time (agile) delivery that the organisation is operating in line with its risk appetite (assurance/advisory). Ultimately, we are about assuring and sometimes delivering a tough message. It is our role to find a way to do that. Our ability to look across the organisation is unique, except for our Chief Risk Officer counterpart, and we need to use that to offer a different perspective.

Q: How do I help my team gain confidence to stand their ground with executives?

A: People often talk down to others to cover up their own weaknesses/behaviour. Everyone has the choice whether to be intimidated or bullied. Focusing on the 4Cs gives individuals licence to speak up. As an internal auditor it’s not personal. We are fulfilling a responsibility -  internal auditors at all levels should be proud of their work and stand up for it. Instilling the confidence is not easy.

Q: Our bravery is only one angle. How can we encourage the business to be braver in addressing issues?

A: In owning the 4Cs, internal auditors can become coaches to their organisations and help them apply the 4Cs for themselves. Rarely do people intentionally overlook controls or put the wrong ones in place – it often stems from a lack of clarity, poor connections, etc.