AuditBoard Live Webinar banner advert Diligent One Platform World tour ad April 2024 TeamMate ESG advertising banner 2023

Heads of Internal Audit Virtual Forum

7 September 2022

Please note:

  • All Institute responses are boxed and highlighted in blue
  • Where the chair comments in that capacity, the box is highlighted in yellow
  • For confidentiality, the identities of all delegates/attendees are anonymised


Chair: Derek Jamieson - Director of Regions, Chartered IIA
Institute: Liz Sandwith - Chief Professional Practices Advisor, Chartered IIA

Chair's opening comments

Good afternoon everybody. I am Derek Jamieson, Director of Regions at the Institute and welcome back to the Heads of Internal Audit Virtual Forum. Welcome also to those attending for the first time today. I have spoken with a couple of you in the last few days and I am delighted that you have shown interest in participating.  I sincerely hope you all enjoy this and future sessions.

As most of you will know we took a short break during the summer to allow us to reflect on feedback we have received over the last few months. The good news is that this feedback is supportive of both the approach and format of the forum so on this basis we are continuing with only a couple of tweaks being made. 

I am joined today by: Liz Sandwith, Chief Professional Practices Advisor for the Institute in the UK and Ireland. 

Today’s session is “What’s on your mind?”. A simple question but one which may have a multitude of responses. 

We picked the heading simply because of the circumstances we all find ourselves in at the moment.

War, economic pressures, geopolitical manoeuvring, domestic and workplace pressures, skills shortages, wage inflation, Covid, migration, transport, political uncertainty, NHS, increasing crime etc. The list does appear endless at times and yet all our organisations, irrespective of sector or geography are impacted, and this on top of any of the routine challenges of running the organisation successfully. 

Resilience, whether human or organisational, has not been tested so severely probably since WWII.  

As we all know, the role of internal audit is to provide independent assurance that an organisation’s risk management, governance and internal control processes are operating effectively. 

How do we do that efficiently in the current environment? Many of the issues above are facing not just our organisation but our internal audit function itself. We are potentially operating at a fundamentally critical point in our organisations’ history. 

With this potentially perfect storm in mind as context and ignoring any promised silver bullets that may be announced in the next day or so, our guests today are going to talk for 10-15 minutes and share what is on their minds just now.

Please listen, consider what you are hearing and offer your own thoughts, either by question or comment in the chat facility. If this session works well, it is likely to shape many of our discussions in the coming weeks and months. 

Key takeaways

Guest 1:

  • Thank you. Whilst a number of things are currently affecting my organisation, I thought today I would focus on something that will affect all of us – the People aspect.
  • Post-Covid, the market has changed. It has become very fast paced and there are a huge number of vacancies – it’s a very different world.
  • It remains extremely difficult to compete with London salaries and increments, which have become more accessible to everyone.
  • Like many of our peer firms, we are in the midst of a huge digital transformation project. Types of skills I'm looking for are IT, data, cyber, AI and digital. These skills are scarce and expensive, but I need these to audit effectively. They’re also scarce in the first line. It is very hard to attract these skills into internal audit, and probably harder than before.
  • Flexibility was previously a USP for us and a key attraction to our staff. We've lost that competitive advantage because everybody now offers it.
  • Despite being an advocate for flexible working, I'm currently trying to entice my team back in. I think they are missing things. I think they don't see that big picture, that impact, that can happen to the business.
  • When in the office you'd see other people's Kanban boards and targets and what they were trying to achieve. That gave you insight, like those water cooler moments, drinks after work or coffee. I think in terms of being trusted advisers, you need to build those relationships.
  • We're only as good as what people will share with us. And I think being in person is a huge element of that - being able to see the whites of people's eyes when discussing things with them.
  • How do you explain to a new associate what they’re missing?
  • How can they think of bigger picture if they never get to see what’s going on?
  • We have mandated that team meetings have to be in person, and I think that’s worked because the team do enjoy seeing each other. What's been important is to make sure that the meetings themselves are purposeful – we prepare them to make sure they’re worthwhile.
  • We have developed team norms which were developed by the team themselves and we as senior management work with them so to make sure they got embedded.
  • In terms of agile, Nationwide kindly gave training which I really liked so we have worked in a similar way. We undertook an agile approach with a HR audit, which meant we literally moved in with them. We had the Kanban boards and the daily stand-ups and they knew where we were the whole time. It meant we could really go where the risks were and stop immediately where there were blockers and we got to where it really mattered quickly, but that it was the constant communication that that made the biggest difference.
  • On the other hand, we tried it elsewhere and it didn’t work So we learned quickly that we were going to have to use agile techniques but not pure ‘Agile’ all the time.

Guest 2:

  • I recognised the points you make Kate around skills shortages, talent shortage, I think the social, economic and geopolitical changes combined with Brexit, is impacting UK ability to get people from overseas into the UK.
  • Big distinguishing factor is that more companies are saying employees can work completely remotely. Tech companies are also recruiting internationally as well working remotely, so if you have cyber skills, AI skills, ML skills; you’re now competing globally. It’s not so much about where you physically sit now and companies are flying people in once a quarter or year for team building but are able to offer a much bigger salary.
  • It is difficult to compete on salaries, particularly in IT. Salaries will impact those in other sectors too, such as government or non-profits as they probably have different budgets available.
  • Culture is important – what's your DNA, what type of team are you, what type of organisation company do you want to be and how do you get the right internal audit culture and team to be part of that environment?
  • I don’t think we will ever replace human interactions - but I’m seeing less and less people in the office.
  • In my team we have a day in the office that we all come in and the rest is up to the individual.
  • How do you balance having people into the office? Some people may not want to come in and look elsewhere for roles.
  • For those interested in podcasts – on 24th August there was a NY Times podcast which talked about the rise of workplace surveillance monitoring. One of the examples they gave is that every 15 minutes or so the camera takes a screenshot of the screen. And then if you're not working, there's some type of robot monitoring if there's a person there or not, and if they weren’t there, they weren’t getting paid. It's an interesting topic I think, some of you may want to consider this and have these conversations within the office and the impacts on culture and other things.
  • When I joined I was tasked with setting up a new function, so there’s lots to do here with a small team. I can only do this in an agile way. I know different companies are experimenting with this at the moment some are a long way into their journey but we’re just starting. I can see some real benefits but also some risks around the methodology we’re trying to develop.

Institute's comments

Thank you very much. I'm absolutely on side. I think the hybrid working/ return to work coordination of who's in the office and when is really challenging. I've spoken to a CAE recently who said their organisation allocates days. So, finance might be in on a Monday, internal audit on a Thursday. So as internal audit if you're doing an audit on finance you know you've got to be in on Monday as well as perhaps on the Thursday. People are beginning to find workarounds in the hybrid world.

What is concerning me a little bit is that I'm hearing from heads of internal audit, from colleagues and other organisations, is that there is becoming a two- tier workforce: those that come into the office and, wrongly in my opinion, are seen to be more committed. That's why they're coming into the office. They’re given opportunities, allocated to projects, their views are heard as opposed to those who are working from home who are almost not considered as part of this. And I think that's quite dangerous territory. I think as internal audit in our organisations we need to be mindful of that and I think if we see it, we need to call it out.

I was also talking to CAE in London, and they were saying a number of their workforce now are not commuting and given the cost, even if it's only £20 or £30 a week, they now need that money for other things to just survive. Therefore, there's a fear about if we are forced to come back into the office, what in our home life, in our domestic world, might suffer because we're back commuting again?

There was also a comment about pay pressures and I think that's going to become a factor. Do I keep saving my commuting money, stay at home, work from home in the winter, miss out on opportunities in organisations and be cold because I can't afford to put the heating on? Or do I come into the office, pay commuting, miss out on a couple of meals every week and get some opportunity?  

These are some really challenging questions that organisations and heads of internal audit for their internal audit teams are going to have to face as we move through into the winter. I don’t have an answer for that - I think it's going to be really challenging.

Chair's closing comments

Thank you both.

I think you will all agree that they have articulated number of challenges for their functions which also place focus on them to develop as well.

Next month we will pick up the Risk in Focus 2023 report.

As usual, notes, chat comments and the slides shared today will be placed on our web pages in the next couple of days.

Finally couple of updates for you before we close:

We have four conferences to mention, notwithstanding the variety of other events currently in the schedule:

  • Annual Internal Audit Conference – 18-19 October. We are certain of another record attendance this year and spaces for the physical conference are now limited.

In addition, we have three other conferences:

  • Wales – 9 November
  • Scotland – 1-2 December
  • Ireland – TBC in the next two weeks (likely to be April)

All have previously been a great success and offer the opportunity to reconnect F2F across the profession. If you haven’t signed up already, please put the date in your diary and refer to our web pages for details. Also consider the conferences as an opportunity to reward team members who have excelled this year.

Thank you everyone and see you at the next session.

Please visit our Events section for further details.


Questions/Chat box comments

Q: On flexible/hybrid working are you finding there is a gap developing between tone at the top (the Board) and general workforce? I have seen that the official wording is that organisations are fully supportive of flexible working and WFH, however when I engage with senior management, they wish that more people were in the office however they are potentially afraid to raise this with employees as could be an unpopular position.

A: (Guest 1) We are seeing a bit of a difference at the top in terms of approach to working flexibly. So, it really depends. But it’s so important to get this right and I think that the sort of risk in getting the approach wrong is huge.

Comment: Completely agree. I think it's not necessarily on seniority but I think it's almost generational as well.

Younger people tend to be much happier working from home, and the older hands seem to want to be in the office. I think that's not quite creating conflict yet, because I don't think people want to challenge that yet, because we've gone to hybrid working and it's not seen as the right thing to be challenging people to get them in the office, but there is a desire to do it.

Comment: We're actually a little bit the opposite. We've got to a point where all the staff across the organisation are either an office worker, a home worker or a pick and mix as I call them - a sort of blended option and that's been formalised and annually reviewed. But we're finding that out of graduate placements or apprenticeships, it’s the younger ones who are wanting to be in the office to get to know people. They're also the ones more likely to be in accommodation that isn't quite as nice as those more senior, so actually, being in the office is just a better working environment for them.

Comment: We also have a lot of people still doing a mix and match at home and in the office. We provide a shared service and service several different clients, so we were never all based together in the one office all the time anyway. My teams are used to being out and about in different sites all the time previously and working remotely has helped some of that. I don't have to send people to be in Shetland one day and then somewhere else - they can work remotely which helps a lot. But we're certainly conscious of is the impact of the cost on our staff and how they feel about that. We are interested to see whether people are going to choose to come into the offices which are heated for them and have a warm space to work rather than have their heating on all day. I'm working from home so it would be interesting to see whether it has any impact over the winter.

Comment: I have noticed staff are more productive when they are in the office and it is difficult to performance manage staff remotely - not impossible, just more time consuming. For most of the past two years home working was enforced on us so people started to say it was just the same as being in the office to make it more bearable. The environment has changed now, and I need my auditors back in the workplace building relationships.

Q: I completely recognise the issues being raised - so how / where do we need to start to fix the issues - are we / the Institute doing enough to attract new recruits to the profession in the first place? Are we doing enough with schools, Universities etc.?

A: (Guest 1) We’re really emphasising training and development – e.g., working with the Chartered IIA. When new people start, we work with them to get professional training/qualification and are purposeful about learning pathways. We entice people to try and stay with us and aside from professional qualifications, internal audit gives that view strategically across the business. 

Q: One of my concerns is that organisations are becoming two tier, those in the office and those at home and those in the office have greater opportunities around new projects etc. Does that resonate?

Comment: Very much so and finding the discussions are being very polarized and you are either in one camp or the other - appears less room for compromise

Comment: Agree with perception of two tier in terms in light of Liz’s comments per the Institute’s View.

Comment: We are consulting with management on risks around rising energy and fuel costs and the impacts on operations including agile working policies. Staff are beginning to query allowances for working from home to cover broadband and electricity costs. Some impacts evident on fuel card behaviour also. Costs of empty buildings is an emerging discussion point. For internal audit our agile approach works well on a 60:40 home: office basis. Still meeting auditees may still mean coming to an empty office to take a video call!

Regarding an agile approach following the speakers’ observations:

Comment: We kind of do agile in our approach because we like to have a collaborative approach. The only thing that we do differently is we don't do it to the reporting phase. We agree everything before we leave the location, but we tend not to start drafting the report together. I think we’ve adapted agile as we go along as we find what works and what doesn't work. From when we were doing remote audits it didn't work so well - we had a mixed bag but since we've started travelling again, we found it really very helpful, because you are able to immediately remove blockers and agree actions. So, it's worked but we don't do the full agile methodology because when it comes to reporting we have just found that that just takes a long time for us to agree on the wordings and sometimes there are emotional responses, so it’s best for us to step away from that.

Comment: Agile is something we’ve played around with a little bit and we've tried it on some audits. It’s been successful in some areas and not so in others, and I think it really depends on the availability of the stakeholders and whether they can spend an hour, 2 hours a day every day for a week or two with you. You've got a decent chance of being successful if they can, but if not, you're going into an audit knowing if they're not going to be able to give you that time, you're never going to be successful from day one with it. I think it's probably worth, as part of the sort of initial kick off meeting with stakeholders, having those conversations with them saying, there's multiple different ways we can do this audit, it’s up to you if you want to give up that time to us so you know early on, we can get through the audit quickly or you know if availability is less. Then you know it's going to take longer, and we’ll use more of a traditional audit approach. Ultimately, I think it's very dependent on the on the stakeholders.

Comment: Isn’t 'agile' just being a good auditor? Communicating often, sharing observations early, adapting the testing to the results you see.