Local Authority Internal Audit Virtual Forum
27 October 2021
Please note:
- All Institute responses are boxed and highlighted blue
- Where the chair comments in that capacity this box is highlighted in yellow
- For confidentiality, the identities of all delegates/attendees are anonymised
CEO's welcomeThank you for joining us for our session. Organisations and their internal audit functions face a dizzying pace of change and unprecedented uncertainty. The pandemic has destabilised operations and undermined previously sound business models to an extent few would have thought possible. CEOs are having to develop a clear vision for the future of their organisation and re-embed core values amid the transition to hybrid operating models. Welcome to today’s organisational culture. Boards and senior management are looking for assurance that they have the culture that they need and increasingly, they are looking to their internal audit functions to provide that assurance. High performing internal audit functions see this as an opportunity to take responsibility and establish their role in the assessment of culture. This is not easy, there are challenges, but these internal audit functions are showing the way and tackling them head on. In addition to our guest speaker, we are also joined by Liz Sandwith, our Chief Professional Practices Advisor, and our chair Piyush Fatania, Head of Audit, Risk, Assurance and Insurance Services for Gloucestershire County Council, and member of the Institute’s Council. |
Chair's opening commentsWelcome to our Local Authority Internal Audit Forum. It may be too early for internal audit to conduct formal assessments of how effectively behavioural and cultural risk is being managed, given the fluidity of the present situation. However, the third line can get a “feel” for any weakening of staff morale and motivation and the overall cultural health of the organisation. This can be achieved by engaging with people on the ground and flagging any concerns with the board or audit committee. Our speaker today is Lucy Pledge, Head of Internal Audit and Risk Management for Lincolnshire County Council. |
Key takeaways
Click here to access the presentation slides
What have we done?
- Working with trusted stakeholders, particularly Section 151 Officer & deputy, Monitoring Officer & Head of Legal, and Head of Democratic Services as the Governance Group, to understand the behaviours and informal ways of working across the organisation.
- Benchmarking with a ‘phase one’ health check on structures and processes based on CIPFA’s good governance framework. Reporting to the Audit Committee with assurance opinions and in plain English.
- A ‘phase two’ governance review of the softer aspects of how culture and core values are operating in practice, based on adaptation of the IIA’s Maturity Model. This featured data analytics (e.g. sickness), surveys and workshops.
- The narrative is ongoing with conversation at the top table, staff surveys testing out ‘reality’ and a Culture & Values workstream in the people strategy.
What now and what next?
- Governance risk and resilience framework review (from the Centre for Governance and Scrutiny) – seven characteristics to discuss with stakeholders and feed back to leadership.
- Challenges of retaining core values and a one council culture with remote working. How can internal audit engage proactively with the people strategy, HR and senior leadership to provide comfort that the culture and values of the organisation remain embedded for all?
- Work to be done to reinforce trust in employees and steer away from presenteeism through providing assurance on the performance management framework.
- Remote working has levelled up equality, diversity and inclusion in some places but also presents challenges.
- Communication and leadership skills are even more necessary to bring teams into a cohesive unit.
- Internal audit can look at structures, processes, engagement and feedback channels around culture and values.
CIPFA update: Diana Melville updated on a research project CIPFA is conducting on the support that internal audit provides to its organisations. So far, around 600 responses have been received and Diana asked attendees to complete the survey and share it with their clients, CEO, CFO/Section 151 officers and audit committee members.
Click here to access the survey. Look out for the report next year.
Chair's closing commentsA quote from Gary Vaynerchuk: “Company culture is the backbone of any successful organisation”. It is challenging to develop a culture in a large organisation like a council where people may not know others outside of their department, service teams or floor. Adapting an internal audit review of culture to the needs of the organisation and its stakeholders is brilliant. The outlined benefits of a culture review are interesting – improving mental health, leadership development, and raising the profile of internal audit amongst others – and I can see the need for this kind of review at all councils. |
Institute's closing commentsPlease consider our Risk in Focus 2022 report for further thoughts on workforce fatigue and cultural erosion if you are working in this space. Our next LA forum on 24th November will look at organisational change and digital transformation. Thank you for attending. As always if you have any ideas or suggestions for what we might include in future agendas please contact Liz Sandwith liz.sandwith@iia.org.u |
Q&A
Q: Have you sensed any cultural erosion and weakening of integrity within your organisation? If so, are HR, middle management and senior leadership aware? If not, is there a role for internal audit?
A: There is an awareness through volume of surveys. Our senior leadership team has reprioritised to focus on what matters. The council has created a smarter working policy, brought in external organisational development on resilience and remote working, and trained mental health first aiders. Internal audit has supported with revised policies on performance management and survey questions as part of a working group – more of an agile than traditional assurance approach.
Q: Did internal audit run the surveys or were they supported by HR?
A: For staff, internal audit considered how recently staff surveys had been completed and placed reliance on them where appropriate but internal audit surveyed councillors themselves.
Q: How frequent were surveys and how much change did you see between them?
A: There was a staff survey three months into the pandemic and a follow up six months later. Due to timing, there was a significant change in terms of adaptation to remote working but the impact on wellbeing remained.
Q: Have you found that the use of surveys has generated honest feedback on how staff and others feel culture is embedded/works in practice?
A: Culture must be worked on all the time. It is embedded in pockets. The key is to focus on values and reinforce through regular updates and keeping the conversation going at the top table. The biggest issue is onboarding into organisational culture in the current climate and how you share values and culture remotely.
Q: Is the council making efforts to continually reinforce values to its people?
A: Not actively. It is in the people strategy workplan but focus has been on response and recovery. Work in progress was parked at the start of the pandemic but now the council is looking to refocus and reset values.
Q: Has the council looked to internal audit or other assurance providers for feedback on changes in culture during the pandemic?
A: They have asked for assurance on the control environment and changes in behaviour within that. The control environment has changed but has it strengthened or weakened? Internal audit has been providing this through work and the annual Head of Internal Audit’s opinion.
Q: Does maintaining and reinforcing culture appear in the recovery plan for the Council and if so how is that being taken forward in actions?
A: It does as part of the people strategy transformation workstream.
Q: Is there a general appetite for a review of culture in the current climate, and how has this been sold?
A: A Head of Internal Audit (HIA) has to be politically savvy and use influence. Rather than use the word ‘culture’, it might be about using the Centre for Governance and Scrutiny’s framework or looking at public disclosure reports or decision-making – looking at culture through a different lens. Assess where most value can be added – at the moment, it is lessons learned; next year, it may be a review of culture.
Q: Has the council considered breaking it down in to smaller domains, e.g. risk culture, control culture, cybersecurity culture etc.? Would that be appropriate?
A: It is appropriate. The most important thing is keeping the culture live. All of the work done gives intelligence towards the Head of Internal Audit (HIA) opinion on culture. This can be a challenge when it comes to an EQA where the Reviewers may look for a dedicated culture review – culture is like a jelly that can’t be nailed to the wall.
Q: How do stronger leadership skills bring people together as a cohesive unit?
A: From an internal audit perspective, look to see how the organisation is providing managers with the tools to communicate and keep people together through remote working.
Q: Is the intention of the Council to retain a hybrid working model?
A: They are advocating a hybrid model with two days per week in the office on average but recognise the differential impact across roles and individuals. This is the leadership development that needs to be gone through.
Q: Should equality, diversity and inclusion part of a culture review, or a standalone?
A: It stands alone. The council has been looking at how its EDI group is working to improve.
Comment: Potential opportunity for existing staff surveys to be used - IA could look at implementation of culture-related recommendations arising.
