TeamMate ESG advertising banner 2023

Heads of Internal Audit Virtual Forum

8 June 2022

Please note:

  • All Institute responses are boxed and highlighted in blue
  • Where the chair comments in that capacity, the box is highlighted in yellow
  • For confidentiality, the identities of all delegates/attendees are anonymised

Participants

Chair: Derek Jamieson - Director of Regions, Chartered IIA
Institute: Liz Sandwith - Chief Professional Practices Advisor, Chartered IIA

Chair's opening comments

By now we are all acutely aware that there has been a sequence of events which have created what many believe to be a much less stable and therefore more uncertain world. Many of you will never have experienced a time where inflation was so high and none of us had experienced a truly global and still ongoing pandemic until 2020. None of us would have predicted that we would be experiencing a 100 day plus war within Europe just now. All this brings added uncertainty to a world which was already changing apace.  

Navigating through such times requires resilience of both management and staff and the organisation itself. But is being sufficiently resilient to “get by” enough? How do you deliver your strategy in these times and where is the role for Internal Audit?

Today’s session is going to be a bit different. We have an academic in our presence, Dr Rodrigo Silva Di Souza, Senior Lecturer in Accounting and Risk Management at the University of Roehampton in London. He is also Co-Chair of the IRM Innovation SIG.  

Rodrigo is going to discuss resilience and pose some questions for us.

Key takeaways

Slides attached from the session. Notes below are supplementary.

Dr Rodrigo Silva Di Souza, Senior Lecturer in Accounting and Risk Management at the University of Roehampton in London:

  • Many companies have thought that in a crisis they would ‘bend’ but they have actually ended up ‘breaking’ or closing down.
  • Companies need to be constantly anticipating, resisting, adapting, responding, and reshaping as a result of emerging risks.
  • Organisations need to care about resilience because we are in such a changing world – Covid, the war in Ukraine, Brexit, cyber-attacks, retaining staff, working from home, are all present-day issues that require organisational resilience. Change is constant and we need to be prepared for it.
  • Organisations may bounce back, or they may bounce forward when faced with a crisis.
  • There are 2 types of resilience – operational resilience and strategic resilience.
  • Operational resilience refers to preventative discipline e.g. risk management.
  • Strategic resilience refers to the capability of companies to create value, embed a strong culture and board communication.
  • Internal audit is also a key component in the creation of organisational resilience.
  • Strategic resilience can create a competitive advantage.
  • When dealing with an emerging risk we cannot usually wait for regulations to be put in place before we act.
  • In the IRM study it found that risk management was a key component in the enhancement of resilience.
  • The study also found that in less mature risk management cultures there was too much focus on the operational side of resilience.
  • Risk managers are still prisoners of risk registers and tick box exercises.
  • A recent CIMA report looked at ‘building and enhancing organisational resilience before and after Covid’. It found that the triggers included previous crises and regulatory requirements and that organisational resilience measurements differ.
  • The CIMA report also found that Covid may not enhance organisational resilience and has in fact created a false sense of security in some firms.
  • Internal auditors need to be scanning the horizon for upcoming threats, risks to our organisation’s resilience. They can add value by investigating the fundamentals of organisational resilience, reassurance resistance and frequent adjustments during a crisis.
  • You do not need to experience crisis to thrive, you need to be proactive.
  • Benchmark, learn from others and ultimately bounce back to your previous normal, or bounce forward to a new improved normal.
  • We need to overcome the false assurance provided by Covid and to overcome our resistance to change.
  • The main thing internal auditors need to do is to establish what your board expects and what you are able to deliver, because there is usually a gap here.

 

Institute's comments

There are lots of challenges facing organisations and facing internal audit, but those challenges give us the opportunity to contribute to our organisation’s operational resilience. It will also give us an opportunity to think outside the box so there are opportunities for internal audit to provide real time assurance when organisations are going through significant change and constant change due to the volatility of the environment. It gives us the opportunity to contribute to resilience and sustainability through the identification of inefficiencies and missed opportunities. Sometimes as internal auditors we see risk as something that must be stopped, but in this new world we find ourselves in, in this very challenging environment, there is an opportunity to see risks as opportunity. What opportunities do some of these risks present to our organisations that will sustain us for the future, that senior management haven’t yet understood because they are busy fighting challenges. And sometimes internal audit being able to stand back and look to the future, look at where we are now and the lessons that we’ve learned, we can help our organisation to build a strong resilience framework and be more sustainable - this is a huge opportunity for IA.

It is also interesting that the response to the consultation comments from the BEIS white paper has indicated that organisations viability statement is going to be replaced by a resilience statement and there is an opportunity there for internal audit to contribute to the resilience statement that the organisation is going to submit that will go into annual report and accounts and will be reviewed by external audit colleagues to look to the future of the organisation and to build on all of these risks.

We tend to see risks in silos – some risks exacerbate other risks within our organisations, and we need to look at the interwoven risks.  There is an obligation and a duty to highlight some of this to our organisations.

Chair's closing comments

Thank you for all for your participation in a very productive session.

As usual, notes, chat comments will be placed on our web pages in the next couple of days.

Our next session on 13 July will be on Sanctions and we hope to see you then.

We have a number of events scheduled for the coming months, including our Leaders Summit and our Internal Audit Conference. Please visit our Events section for further details.