Heads of Internal Audit Virtual Forum

7 September 2022

Please note:

• All Institute responses are boxed and highlighted in blue
• Where the chair comments in that capacity, the box is highlighted in yellow
• For confidentiality, the identities of all delegates/attendees are anonymised

Participants

Chair: Derek Jamieson - Director of Regions, Chartered IIA
Institute: Liz Sandwith - Chief Professional Practices Advisor, Chartered IIA

Key takeaways

Guest 1:

• Thank you. Whilst a number of things are currently affecting my organisation, I thought today I would focus on something that will affect all of us – the People aspect.
• Post-Covid, the market has changed. It has become very fast paced and there are a huge number of vacancies – it’s a very different world.
• It remains extremely difficult to compete with London salaries and increments, which have become more accessible to everyone.
• Like many of our peer firms, we are in the midst of a huge digital transformation project. Types of skills I'm looking for are IT, data, cyber, AI and digital. These skills are scarce and expensive, but I need these to audit effectively. They’re also scarce in the first line. It is very hard to attract these skills into internal audit, and probably harder than before.
• Flexibility was previously a USP for us and a key attraction to our staff. We've lost that competitive advantage because everybody now offers it.
• Despite being an advocate for flexible working, I'm currently trying to entice my team back in. I think they are missing things. I think they don't see that big picture, that impact, that can happen to the business.
• When in the office you'd see other people's Kanban boards and targets and what they were trying to achieve. That gave you insight, like those water cooler moments, drinks after work or coffee. I think in terms of being trusted advisers, you need to build those relationships.
• We're only as good as what people will share with us. And I think being in person is a huge element of that - being able to see the whites of people's eyes when discussing things with them.
• How do you explain to a new associate what they’re missing?
• How can they think of bigger picture if they never get to see what’s going on?
• We have mandated that team meetings have to be in person, and I think that’s worked because the team do enjoy seeing each other. What's been important is to make sure that the meetings themselves are purposeful – we prepare them to make sure they’re worthwhile.
• We have developed team norms which were developed by the team themselves and we as senior management work with them so to make sure they got embedded.
• In terms of agile, Nationwide kindly gave training which I really liked so we have worked in a similar way. We undertook an agile approach with a HR audit, which meant we literally moved in with them. We had the Kanban boards and the daily stand-ups and they knew where we were the whole time. It meant we could really go where the risks were and stop immediately where there were blockers and we got to where it really mattered quickly, but that it was the constant communication that that made the biggest difference.
• On the other hand, we tried it elsewhere and it didn’t work So we learned quickly that we were going to have to use agile techniques but not pure ‘Agile’ all the time.

Guest 2:

• I recognised the points you make Kate around skills shortages, talent shortage, I think the social, economic and geopolitical changes combined with Brexit, is impacting UK ability to get people from overseas into the UK.
• Big distinguishing factor is that more companies are saying employees can work completely remotely. Tech companies are also recruiting internationally as well working remotely, so if you have cyber skills, AI skills, ML skills; you’re now competing globally. It’s not so much about where you physically sit now and companies are flying people in once a quarter or year for team building but are able to offer a much bigger salary.
• It is difficult to compete on salaries, particularly in IT. Salaries will impact those in other sectors too, such as government or non-profits as they probably have different budgets available.
• Culture is important – what's your DNA, what type of team are you, what type of organisation company do you want to be and how do you get the right internal audit culture and team to be part of that environment?
• I don’t think we will ever replace human interactions - but I’m seeing less and less people in the office.
• In my team we have a day in the office that we all come in and the rest is up to the individual.
• How do you balance having people into the office? Some people may not want to come in and look elsewhere for roles.
• For those interested in podcasts – on 24^th August there was a NY Times podcast which talked about the rise of workplace surveillance monitoring. One of the examples they gave is that every 15 minutes or so the camera takes a screenshot of the screen. And then if you're not working, there's some type of robot monitoring if there's a person there or not, and if they weren’t there, they weren’t getting paid. It's an interesting topic I think, some of you may want to consider this and have these conversations within the office and the impacts on culture and other things.
• When I joined I was tasked with setting up a new function, so there’s lots to do here with a small team. I can only do this in an agile way. I know different companies are experimenting with this at the moment some are a long way into their journey but we’re just starting. I can see some real benefits but also some risks around the methodology we’re trying to develop.

Questions/Chat box comments

Q: On flexible/hybrid working are you finding there is a gap developing between tone at the top (the Board) and general workforce? I have seen that the official wording is that organisations are fully supportive of flexible working and WFH, however when I engage with senior management, they wish that more people were in the office however they are potentially afraid to raise this with employees as could be an unpopular position.

A: (Guest 1) We are seeing a bit of a difference at the top in terms of approach to working flexibly. So, it really depends. But it’s so important to get this right and I think that the sort of risk in getting the approach wrong is huge.

Comment: Completely agree. I think it's not necessarily on seniority but I think it's almost generational as well.

Younger people tend to be much happier working from home, and the older hands seem to want to be in the office. I think that's not quite creating conflict yet, because I don't think people want to challenge that yet, because we've gone to hybrid working and it's not seen as the right thing to be challenging people to get them in the office, but there is a desire to do it.

Comment: We're actually a little bit the opposite. We've got to a point where all the staff across the organisation are either an office worker, a home worker or a pick and mix as I call them - a sort of blended option and that's been formalised and annually reviewed. But we're finding that out of graduate placements or apprenticeships, it’s the younger ones who are wanting to be in the office to get to know people. They're also the ones more likely to be in accommodation that isn't quite as nice as those more senior, so actually, being in the office is just a better working environment for them.

Comment: We also have a lot of people still doing a mix and match at home and in the office. We provide a shared service and service several different clients, so we were never all based together in the one office all the time anyway. My teams are used to being out and about in different sites all the time previously and working remotely has helped some of that. I don't have to send people to be in Shetland one day and then somewhere else - they can work remotely which helps a lot. But we're certainly conscious of is the impact of the cost on our staff and how they feel about that. We are interested to see whether people are going to choose to come into the offices which are heated for them and have a warm space to work rather than have their heating on all day. I'm working from home so it would be interesting to see whether it has any impact over the winter.

Comment: I have noticed staff are more productive when they are in the office and it is difficult to performance manage staff remotely - not impossible, just more time consuming. For most of the past two years home working was enforced on us so people started to say it was just the same as being in the office to make it more bearable. The environment has changed now, and I need my auditors back in the workplace building relationships.

Q: I completely recognise the issues being raised - so how / where do we need to start to fix the issues - are we / the Institute doing enough to attract new recruits to the profession in the first place? Are we doing enough with schools, Universities etc.?

A: (Guest 1) We’re really emphasising training and development – e.g., working with the Chartered IIA. When new people start, we work with them to get professional training/qualification and are purposeful about learning pathways. We entice people to try and stay with us and aside from professional qualifications, internal audit gives that view strategically across the business. 

Q: One of my concerns is that organisations are becoming two tier, those in the office and those at home and those in the office have greater opportunities around new projects etc. Does that resonate?

Comment: Very much so and finding the discussions are being very polarized and you are either in one camp or the other - appears less room for compromise

Comment: Agree with perception of two tier in terms in light of Liz’s comments per the Institute’s View.

Comment: We are consulting with management on risks around rising energy and fuel costs and the impacts on operations including agile working policies. Staff are beginning to query allowances for working from home to cover broadband and electricity costs. Some impacts evident on fuel card behaviour also. Costs of empty buildings is an emerging discussion point. For internal audit our agile approach works well on a 60:40 home: office basis. Still meeting auditees may still mean coming to an empty office to take a video call!

Regarding an agile approach following the speakers’ observations:

Comment: We kind of do agile in our approach because we like to have a collaborative approach. The only thing that we do differently is we don't do it to the reporting phase. We agree everything before we leave the location, but we tend not to start drafting the report together. I think we’ve adapted agile as we go along as we find what works and what doesn't work. From when we were doing remote audits it didn't work so well - we had a mixed bag but since we've started travelling again, we found it really very helpful, because you are able to immediately remove blockers and agree actions. So, it's worked but we don't do the full agile methodology because when it comes to reporting we have just found that that just takes a long time for us to agree on the wordings and sometimes there are emotional responses, so it’s best for us to step away from that.

Comment: Agile is something we’ve played around with a little bit and we've tried it on some audits. It’s been successful in some areas and not so in others, and I think it really depends on the availability of the stakeholders and whether they can spend an hour, 2 hours a day every day for a week or two with you. You've got a decent chance of being successful if they can, but if not, you're going into an audit knowing if they're not going to be able to give you that time, you're never going to be successful from day one with it. I think it's probably worth, as part of the sort of initial kick off meeting with stakeholders, having those conversations with them saying, there's multiple different ways we can do this audit, it’s up to you if you want to give up that time to us so you know early on, we can get through the audit quickly or you know if availability is less. Then you know it's going to take longer, and we’ll use more of a traditional audit approach. Ultimately, I think it's very dependent on the on the stakeholders.

Comment: Isn’t 'agile' just being a good auditor? Communicating often, sharing observations early, adapting the testing to the results you see.