Heads of Internal Audit Virtual Forum

20 May 2020

Please note:

• All Institute responses are boxed and highlighted blue.
• Where the interim CEO comments in that capacity the box is highlighted yellow.
• Where the President comments in that capacity the box is highlighted heather.
• All delegate/attendee comments/statements/replies are un-highlighted and un-boxed.
• For confidentiality, the identities of all delegates/attendees are anonymised.

Chat box comments

The scenario the meeting explored was:

Q1. What have you learnt over the last 6-8 weeks?

Our organisations are having to be more innovative which is leading in many cases to efficiencies - maybe the key challenge will be maintaining that focus, and internal audit can definitely help. Helping the organisation to horizon scan, as the icebergs (and opportunities) might look very different in the ‘new world’.

In the Technical Guidance Working Group meeting this morning, we discussed this as being a great opportunity to remind our members and the wider sector on the different roles that internal audit can play. We're not just about assurance but can, within agreed parameters, add real value into current thinking by boards and executive teams into what the next 6 months looks like, challenge the risks attached and facilitate discussion in relation to the risks and opportunities, etc.

• I agree, sometimes auditors can be too fussy about the three lines, but we should embrace working with the executives and bringing our skills to help the organisation.

Picking up on guest panellist 2’s point (see notes from the meeting below) about data analytics. This is something we've been talking about and are starting to use more in our internal audit team, specifically as a way to provide assurance and identify potential concerns without taking up any staff time where teams are resource stretched.

• So, a way in which your internal audit team too has become more efficient and helped the business be better at the same time!
• It is reassuring that auditors are embracing data analytics and realising the benefits of this and understanding the assurance that can be gained.

No comments from attendees regarding question 2 which was - Where and how have you supported your organisation through these challenging times?

Q3. Looking forward what do you think the challenges will be for the next 90 days and beyond and what will your 2020/21 plan look like?

I agree with guest panellist 2, we are also adjusting our 2020 plan to minimise travel and on-site auditing and using data analysis and virtual meetings as much as possible.

Do we have opportunities to audit more through how management are controlling the business...? After all, management should be focusing more on data and remote controls - I am sure we can help them! 

Attendee comments, questions, and actions

Nearly all internal auditors, especially internal audit leaders, are confronting a new reality. With some companies in survival mode and others addressing drastically different business environments, nearly everything has shifted in just a few short months. Never before has business changed so much, or so fast. 

Today, our guest panellists will be sharing their thoughts based on their own experiences and challenges within their organisations in relation to the following questions.

Q1. What have you learnt over the last 6-8 weeks? 

Guest panellist 1

Personally, I have learnt that I can balance a number of things that are going on in my life whilst trying to work from home. Let me provide you with the landscape, where was I, what was I doing 6-8 weeks ago. I was part way through transformation, having to deliver a 10% saving within my service area, coming up to year-end, writing my year-end opinion and planning my audit programme for the new year, 2020/21. I was also transferring to new audit software and the whole of the organisation were transferring onto a new finance and HR platform, Oracle. We were in a huge state of flux with all this before COVID-19.

Then all of a sudden came lockdown. In terms of the environment that I was in, we were all working at quite a pace, with a lot going on. Taking a step back from that and having to work in a whole new way, I quickly had to learn how to do that and how to work with my team and how to become agile.

I find in internal audit in the last few years the term agile has been thrown around quite a lot ‘let’s be agile internal auditors’, and actually, without even realising it, we have become agile. I have learnt that I have a really resilient team who have the ability to take on everything that was going on and to continue to deliver their work, and to do a really good job. I am not an expert on Zoom, but I’ve become an expert on MS Teams - we have embraced new technology like we never thought that we would.

I’ve learnt that in respect of working from home, I’ve always been a huge advocate of it. I have two children and I’ve always had to balance what’s going on in my life, as so many people do, but I’ve always felt that there has been a little bit of a stigma in whatever environment I’ve worked in. I’ve had a long career and there’s always been a little bit of ‘ooh working from home’. But we can do it and actually, that’s fine, as internal auditors we have the ability to do that, we can flex and change the way we work.

So, I have learnt that assurance and agility work hand-in-hand, they are not two separate things. It is amazing, I am so pleased with all the things we have been able to achieve during this time.

Guest panellist 2

For context, I have been with my organisation since June 2019, a retailer, prior to this I spent 9-years in a manufacturing environment. My current organisation started out with one retail outlet 25-years ago and now has over five hundred sites.

I had a brand-new team. Only two people were from the former internal audit team. When I came in, I ramped up the team to eight plus myself, so still a relatively small team. We were just getting to know each other and then got launched into COVID-19 and remote working. I had such a lovely audit plan to execute for the new year. So, all our hard work and we cannot actually execute the plan or travel and deliver on our site audits, I think the word of the moment is ‘agile’. My audit manager on the team said, “what does agile really mean” and I said, ’we’ll see’, but then when we were thrown into COVID-19 - we now completely understand what ‘agile’ actually does mean. My audit manager loves to have the audit plan and all the back-up information before him and all the analytics completed before we start, but sometimes in a fire fighting mode, when you’re asked to do something you just have to go and get on with it.

What I have learnt about myself and the team over the last six to eight weeks is that I find it a lot easier with human interaction, being able to read the temperate of people standing in front of me, I have found it has been a lot harder actually on-line and through remote working.

What I have learnt as well is that we invested a lot of time last year on data analytics and we invested a lot of time through Power BI, that’s our preferred tool in the organisation and when you’re facing five hundred sites, with the best will in the world you are not going to get a team of eight around five hundred sites in a year. We were always going to go down the data analytics route in terms of our strategy for internal audit. Thank goodness that we put the investment and the resources into Power BI to enable us to get up and running and have visibility over the regions. We operate in Ireland, the UK and USA so having that visibility meant that we could support the organisation and from a risk perspective that really helped.

So, that is the majority of things that I have learnt.

Q2. Where and how have you supported your organisation through these challenging times?

Guest panellist 1

It has been a bit of a two-pronged approach. When this crisis happened, I had to take a step back and think about my role and what I was going to be doing as part of the response to this. Part of my response was working in the business. The governance structure within my organisation reacted and a number of cells were set-up in order to work through COVID-19. One of the cells is called ‘excess deaths’. I am sorry I know this sounds very morbid, I had to step in and work with that cell. Not in terms of my role as head of internal audit but in my role as being part of the organisation. I looked at the planning around what would happen if COVID-19 was going to be as drastic and awful in terms of death rates as were being talked about at the beginning. For me, that was a huge personal challenge, given what the subject area was. It was completely out of my comfort zone. Never did I think that I would be discussing body bags for instance, it was unreal. It put me in probably a good place, to then react with my internal audit perspective.

I took a step back and looked at the audit plan with my team and realised that a lot of the work that we had intended to go ahead and in normal circumstances, would have done, it just wasn’t going to be viable, we weren’t practically going to be able to do it.

That wasn’t about working remotely, it was about engaging members of the organisation who were probably going to be 150% focused on the COVID-19 response. One of my audit team pitching up and saying ‘I’m going to do an audit,’ would have gone down like a lead balloon. Appreciating that, I spoke with my S151 Officer (Chief Finance Officer) and the audit committee chair around what I could do, so I reset the audit year.

I know that it is going to impact next year, and I am having to work around that. I have added another two months onto this audit year to enable me to deliver an assurance plan, however, that aside, I have put together a COVID-19 response plan. Part of the COVID-19 plan is around looking at all the good things to do with business grants, adult and social care and the significant work that they need. But it is also around more of the transactional pieces of work that we can be doing in the background. They still offer a level of assurance, they may not be strategic, but actually, they support the organisation.

I mentioned earlier that we have moved from one finance system to another during this period. I was able to provide continuous assurance over the payroll, ensuring that the payroll transferred for instance, and around starters and leavers, doing this work remotely from home. Some of those good HR things around getting new employees onto the books, taking people who have left off the books – people can forget, so we have covered some work around that. It may sound very transactional, but we have been able to provide a level of assurance, in the background, that has been able to provide a good comfort blanket for the organisation, whilst thinking and planning ahead for the future.

I have reviewed the whole audit plan in light of COVID-19. It has made me put a different light on things and think, actually is that still relevant in the way that we are now working and the way the organisation is now working? Some of those risks I worried about two months ago, I don’t worry about so much now. It is more around emergency planning, critical planning, how financially viable the organisation is, all those things that have become a real highlight now. So, it has been a very busy time for internal audit, and I feel that we have reacted in a really positive way.

Guest panellist 2

At the outset, before the remote working kicked in and the lockdown was implemented in Ireland, I was asked by our CFO (Chief Finance Officer) and our COO (Chief Operating Officer) to advise on their BCP (Business Continuity Plan), well in advance of even getting into lockdown.

That was a huge piece of work we did, and it really did pay dividends in the end, in terms of moving everyone into remote working and actually advising the organisation on that.

Just so you know how the team actually supported the operations, I was very upfront and said if we need to be redeployed then ’you have an internal audit team with an amazing skill set. You have three qualified accountants, you have people who have come from the business, and you have people who were external who came in from other retail environments.’ I said, ‘you can, if needs be redeploy internal audit staff.’

Actually, it was interesting. It was in the BCP plan itself (the redeployment of internal audit staff). It was discussed with the Chair of the audit committee. He and the board agreed that, if need be, we could be redeployed.

Then, low and behold, I think every finance function in the world in every organisation came under extreme pressure, because everyone wanted information, and everyone wanted it yesterday. It meant that they were actually able to, for two to three weeks redeploy internal audit into central finance and actually help the central finance team get through those critical two to three weeks. I just think the flexibility, skill set, that roll up of the sleeves and get stuck in with our colleagues in finance, it just worked so well and the board and the audit committee were very supportive and I am thankful that we were actually able to do that.

From a risk and assurance perspective, again, I come back to my data analytics and again thank goodness that we had it ready to go for our audits in Ireland. By having that we were able to replicate it quite quickly across other jurisdictions and it actually meant that we could technically do remote auditing. What we can’t do is roll up the sleeves and go in and count the cash and count the stock, which is what we would do on normal site audits. What we can do with full visibility into our POS (point of sale) system, as we have it on dashboards, we’ve created our red flags, we know the risk areas and we also can get access to the back office systems as well to check documentation, our systems and our data.

It means that we can still perform that level of auditing and give a certain amount of assurance to the business even though we cannot go physically on site and count the cash and the high value stock items, which is what we would normally do on a site audit. That worked quite well and the head of operations in all our jurisdictions were delighted that we were able to deliver that as an assurance service to them. Management were able then, if they saw a red flag, get one of the regional managers closer to the site, to go in and investigate if needed, that actually worked quite well too.

Another area that we wanted to get into, but I think they were keeping us away from it, is SAP (software), which was implemented in July 2019. I worked in an organisation for nine years where they had SAP implemented, so I know it inside out and backwards and so do certain members of my team. I think that they wanted to get it embedded in the organisation first. But again, we had this opportunity where, over recent weeks we’ve actually done walkthroughs of all the key sub-processes, for example, accounts payable in finance from a SAP perspective and we’ve actually given feedback to our CFO, to our head of finance and to our IT team.

We are also providing best practice recommendations, which are kicking off in the background and are proving quite helpful to the organisation. The recommendations are also helping to leverage SAP more post implementation.

These would be the main supporting areas.

Q3. Looking forward, what do you think the challenges will be for the next 90 days and beyond and what will your 2020/21 plan look like?

Guest panellist 1

Key challenges, in respect of the future, is thinking about how this might be the ‘new normal’. Going into the organisations offices I believe, may become less frequent and, that is fine, we can make it work. On a personal level, I miss those social interactions, around the water cooler or the coffee point, and having those meaningful but not necessarily specific conversations around audit and actually feeling what is going in the rest of the organisation.

It is also about the ability to check in with people, check in with your client and feel the mood and that is difficult to do over technology. You have to make quite a lot of effort. So, if I want to check in with a client, I have to physically ring them or go through MS Teams or Zoom, whatever the technology might be. You don’t have that bumping into people in the organisation, I do think that you miss that.

It is also thinking about the organisation going forward - this is going to have a huge impact. You see on the news headlines about a recession and what’s going to happen and, for the sector I work in, that is going to be huge. We have been under a lot of pressure anyway, and it is just going to add more, so I am having to think about the assurance in that respect and how I support the organisation with whatever that might look like.

I am speaking more and more to the S151 Officer, we would normally meet every couple of weeks. I am now having a couple of meetings a week with her to understand what the new normal looks like and how internal audit is going to be there to support, and it is about doing the right thing and being part of the organisation. Although I am the independent auditor, I have a responsibility to be doing the right thing. It is also having the confidence around the technology and feeling that this is fine. As auditors we always tend to be a bit suspicious of this, but it is about embracing it and going along with it and providing assurance around it.

Guest panellist 1

The organisation has a good audit committee, but the chair is opposition, so it makes it quite an interesting environment anyway. So, yes, I do rely on my relationship with my S151 Officer.

Guest panellist 2

I think with the best will in the world, this whole travel piece is going to reduce in the ‘new world’.

I think that proving the data analytics concept, the red flags and risk approach concept through data will have to be embedded in the organisation. Obviously, it is quite new to them, but it is a new concept, people love the traditional site audit approach. What I think we have proven is that you can still do remote auditing and get a certain level of assurance without having to get on a plane every other week and travel to the UK or to the USA or get in a car and drive all around all the sites Ireland for example.

It should be more risk based and there has to be and there should be an element of remote testing as well, that’s the bread and butter, that’s the operational side of audits that’s not going to go away. I think it is going to be learning and more conversations with the chair of the audit committee, other members of the audit committee themselves and the business. The business like having a certain amount of, and a certain percentage of site audits done every single year. But it is about bringing them along the journey of risk, we can actually see it through the data to a certain extent and balancing that with remote audits and actually physically being on site to count the cash and count the stock as well as everything else that we do.

That would be the big takeaway thing for me.

Participant invited to share their thoughts

We don’t have as many centres as guest panellist 2, but we have over one hundred locations around the country. We normally try and get round to visiting these over a period of a few years, in different audit cycles. It is just not practical now, a lot of these, as I said a few weeks ago, are centres where people who are vulnerable to COVID-19 in particular, with underlying health conditions are located, now it is just trying to be a bit more creative.

One of the interesting things that has come from this is how our colleagues have embraced digital a lot more and that’s opened up opportunities for us in that we would use IDEA (data analysis software) for our data analytics. A lot our problems have often been getting the quality of data but that is starting to build up, allowing me to really reimagine how we are working. As for the on-site work and site visits, they have to be kept down to a minimum for the foreseeable future. It’s an interesting area for me because its making things quite exciting, giving me the chance to bring in simple things from my previous career - I was used to digital signatures, this wasn’t in my current world, but it has come in and it’s happening quickly, in the space of a month. Now that, all of a sudden, opens up a whole range of opportunities for me to give assurance to our audit and risk committee.

Participant invited to share their thoughts

The three lines of defence exist for good reasons. I think sometimes, we can be too fussy about it and sometimes we do just have to roll our sleeves up and get stuck in. We have got a lot to offer the executive, particularly with the skill set and integrity that we bring. It was interesting to listen to other people talking about offering their teams up for redeployment which is very much what my team has done. I was also directly involved in supporting the disaster recovery, I suppose that is probably not quite the right term. I think at times we can almost make excuses to ourselves to not involve ourselves in things. It is good to hear that others have had the same sort of experience throughout the COVID-19 panic.