Heads of Internal Audit Virtual Forum | Key takeaways

1 April

Please note:

• All Institute responses are boxed and highlighted in blue.
• All delegate/attendee comments/statements/replies are un-highlighted and un-boxed.
• For confidentiality, the identities of all delegates/attendees are anonymised.

Chat box and attendee comments, questions and actions

1. If we are delivering reduced plan, can we provide full or qualified opinion?

I am meeting with my audit committee in two weeks’ time. I expect to reduce some of our work over the coming months, so we will be focusing on those areas where they want the assurance from us, and where they will try to get it from the other lines of defence. I am not concerned about a limited opinion as we will hopefully have agreed a revised plan of work.

We are looking at alternative sources of assurance next year. We do not expect to take forward a “normal” plan. At the minute we are providing a range of different types of support, we will refer to this as part of our assurance opinion next year.

We provide outsourced and co-sourced internal audit resource to our clients. Firstly, we revisited the internal audit plan to ensure that we are focusing on the key risks with the clients to achieve the level of assurance required in this environment.

In the current year, our financial year end is 31 March, so COVID-19 hit while we were trying to finalise the 2019/20 plan, so we are only going to be able to deliver a proportion of the plan, approximately 80%. For some key risks I will not be able to provide sufficient assurance coverage, so I won’t be able to provide a full opinion and therefore will provide a qualified opinion in relation to those key risk areas.  For next year’s 2020/21 plan if we are producing say 50% plan using 50% of internal audit resources and I can’t fully cover the organisations significant risks is that another qualified opinion for next year? Some thoughts and insights would be appreciated.

We have a March year end and have a couple of reflections; one audit we had to postpone a visit to one of our offices so will refer to limitation of scope, but we can complete 98% of the work remotely. I also have my annual opinion to provide but again 98% of the work is complete so it is only this last piece of audit work to complete and will refer to the limitation of scope rather than not having an opinion and as long as we’re clear about this, it should work.

In some ways some of it will come down to when our year ends but sooner or later it will affect us all. At the same time when audit functions are being asked to do other things as well that’s going to get very interesting.

We service a number of organisations. About three weeks ago it was evident that we couldn’t complete work. At the start of last year, we separated plans out, so we were clear what we had to do to deliver the annual internal audit opinion. From the beginning of last year, we knew what we had to do to make sure that we did enough assurance work to give an opinion, the rest of the work was supplementary/advisory and not critical to the opinion. Therefore, when our stakeholders said about three weeks ago that they didn’t want to see us until September we had enough work complete or nearly complete that gave us enough to give an annual opinion. We are in the process of closing that work down and giving an annual opinion.

One of the Directors of Finance said that in the current circumstances they wanted to get to a position where it is good enough to get over the line to give a view. We’ve been working with our organisations for a long time and year on year we have provided brought forward assurance. We also have recommendation tracking systems in place so there’s all sorts of things to bring to the table to give the level of assurance needed. The fact that we haven’t completed everything in terms of individual audits and other audit work in the level of depth we have liked to I don’t feel that we’ve compromised our position to be able to give a robust annual opinion.

We’re not pushing auditees for responses; we’re trying to finish off the plan for 2019/20 as best we can. We have been asking if there’s any key risk areas or any areas where we can be deployed. We have been working with the audit committee on high risk areas going forward. The 2020/21 plan is not going to happen in its current format, but we will be looking at the high risks revising the plan to address these risks.

Our year end is July 2020 – we have 70% of the plan complete and sufficient to give an overall opinion – we are a risk-based function and therefore we can change our plan to accommodate this COVID-19 risk. We have currently eased right back on our work.

There are discussions being had all over the place. A lot of it comes down to having certainty in terms of our stakeholders as to how they see what we are putting in front of them – where there are limitations its being clear about those limitations that’s where we should be. We need to be open about any compromises we are making where we are making them.

2. Internal audit in supporting the first line of defence

The challenge faced by a number of internal audit teams is around continue with the internal audit plan or support the organisation in terms of success and sustainability. That might be sharing key skills across the organisation, it might be auditing real time as the organisations puts in place new controls to mitigate risks from new processes.

This is a great opportunity for internal audit to show how they can support and add value to organisations. Our internal audit team is actually helping design processes in response to the organisation’s guidance/announcements.

We are very conscious that our organisation needs to ensure they keep a good audit trail to support some of the very significant decisions that are being made at pace  - we are providing support into several teams to help ensure that the audit trail is retained.

I understand the personal desire to help our businesses on a real time basis, and the importance to provide flexibility with the business, but there is a risk to the profession whereby it would only take one or two examples whereby internal audit were directly involved in poor decision making.

We are putting messages out about the need to ensure that governance, internal controls and risk management remain strong at the moment and offering advice and support to the organisation when they are considering revised governance structures etc.

Agree on supporting the organisation and parking what was the plan to engage the business on robust control and risk management during these times of change.

There is a balance to be struck and we need to maintain objectivity both within the business, and for the profession.

We took the view at this time of crisis that we should not be stepping back but step forward to help support our organisations. We are doing a lot of rapid work and making some significant decisions at rapid pace and have a strong view that we should be up there supporting our organisation. We’ve stopped doing our audit plan and normal work and supporting the organisation looking at resilience and governance structures they are putting in place and helping them to do additional risk assessments, working alongside the organisation so that they understand the key controls in place that they need to keep an eye on to ensure external vectors do not take advantage during this crisis.

We have been involved in a lot of short sharp advisory work where new processes, frameworks and guidelines etc. are being put together where our opinion has been sought before going out to the wider sector. All of this will help for next year’s assurance opinion. We don’t expect to be doing a normal plan next year, we’ll be watching the risk environment as it unfolds. Evolving out of this scenario we will be continually assessing what support we give to our organisation. This is an opportunity to move away from people thinking that internal audit just does a number of routine reviews every year to form an opinion and that we are much more dynamic than that.

Definitely an opportunity for us to add value to the organisation.

Effectively we are doing no Q1 work at all. We, as employees, part of the organisation and emergency response plan, are effectively releasing our internal audit teams to support colleagues in any way they want – some are moving boxes around stores and others helping to prepare meals, one place has trained its finance team in portering and catering.

I have had my first meeting today with a team that I am going to support and I’ve been asked to support the senior procurement team - when the conversation unfolded it was remarkably like what we do as an internal audit team anyway. The Assistant Director was concerned about the new emergency procedures she had put in place, whether they were right, the controls in place and the governance and data quality as there were so few people in her team to double check and sense check the decisions - pretty much what internal audit do.

The work that internal audit would do normally is not real time, so it feels that in these circumstances working with the senior team that we will get internal audit embedded into certain areas of the organisation and provide advice on the good stuff we already do e.g. governance, control, data quality in a real time situation, it’s not in an audit report necessarily that goes to the audit committee. But it is going to be real day to day management and delivery of critical stuff. If we can provide real time help and support to people at the sharp end it will make a difference as a profession and we will do ourselves a world of good. I have used the phrase before we are internal audit the ‘critical friend’ – we are here to help you and, in this instance, can be seen to be the people that really do help.

3. Furloughing internal audit staff, how do we respond and what’s the impact going forward?

As internal audit we are currently running a risk that either all or part of the internal audit team may be furloughed. We need to ask ourselves was our voice heard before the decision was made, does the organisation know or understand the impact of ‘no’ internal audit even in the short term.

The Financial Conduct Authority have specified that risk management, compliance and audit are key critical staff. I cannot see how a firm could say that we would be made redundant or laid off (the two reasons for furlough). However, I do work for a bank.

4. What changes can we do to make remote audit more effective?

For an audit we are undertaking we are working remotely via video linking and sharing screens to perform walkthroughs and see evidence in systems etc.

All of our staff are working remotely, finishing off internal audits from the 2019/20 plan where we can.

In terms of remote auditing, nothing much has changed in the delivery other than not having physical access to sites/people. We are still engaging with clients via Teams and conducting reviews where we have remote access to systems.

We’re a very small team with a co-sourced resource, the staff are split between London and Edinburgh and we started almost straightaway using Microsoft Teams. We have a lot of collaboration software that we use in the business.  As a business we are split all over the world – 30 countries and use this technology a lot. We do a lot of data analytics therefore most of our work we can do electronically anyway using this software. Visits to our sites around the world has stopped, on the whole we found using this software this is a great way to add value. Our audit committee expects me to make some changes but overall, I think I will be able to achieve most of what I want to do. I feel that this is a way of dealing with some of the challenges we currently have.

Similar to what others have mentioned we have the functionality to do remote auditing, we use Microsoft Teams and have access to the systems we need. The biggest challenge for us at the minute is having the people to audit due to the sector we’re in, we don’t have people on site to audit, whilst there is the back office work i.e. finance and other areas that we can audit but for now we are giving them space, understanding the challenges they are facing. We will do another risk assessment about the issues that the business is realising such as furlough and other types of things and look at practicalities  of how we audit, but appreciate there are other priorities working with the business and then we’ll think about how we get back to our business as usual. This is the balance we are trying to get.

Same message across HoIA Scotland – similar challenges – we can do it but is it still the right time to try as push the business as usual agenda or should we be more agile and test our agility as an audit profession.

Internal audit staff are busy working remotely, successfully, they had a week to do some testing to get access to systems and they’re finishing off work they were doing. We need to think about what to do in a couple of weeks’ time and have a view as to how long this will go on for and we’ll then rationalise. At the same time we have an audit committee meeting and prioritising what we will be doing in the last quarter of this year.

Make sure we adapt as much as possible and making sure our stakeholders are aware of what the issues are and how they should be reading what we are giving them.

5. If internal audit is lending a hand to the first line what’s the best strategy for dealing with the question of assumed impairment to independence?

6. Other

I'm encouraging staff to do online courses where possible for CPE.

7. General feedback from the session

• Another great session - thank you. I know my colleagues in other organisations in the sector appreciate seeing the outcomes.
• Thanks for another useful session.
• Thank you that was a great session.
• Thank you.
• Thanks all.

Questions and answers raised by colleagues from local government