Heads of Internal Audit Virtual Forum

10 June 2020


Please note:

  • All Institute responses are boxed and highlighted blue.
  • Where the chair comments in that capacity, the box is highlighted in yellow.
  • Where the President comments in that capacity, the box is highlighted heather.
  • All delegate/attendee comments/statements/replies are un-highlighted and un-boxed.
  • For confidentiality, the identities of all delegates/attendees are anonymised. 

Chat box comments

The profile of internal audit is exceptionally important. I think we've seen this recently in the charity sector with colleagues who would describe their executive/audit committee as not fully understanding the value of internal audit (or the remit of what I can do).

Finding themselves furloughed without any real risk assessment for pausing the internal audit activity, whereas other teams where the leadership is clearer on the value internal audit can provide, have pulled internal audit closer and have been seeking the critical friend view on many of the difficult decisions being made during the pandemic.

  • I agree with the above point on the charity sector. I have found it far easier to agree budget and resource requirements with my current audit committee, who want to see internal audit central to the organisation, compared to previous audit committees who saw internal audit as a peripheral add-on, limited to financial reporting risks.
  • Worth noting that with audit committee roles being unpaid in the charity sector, some charities, especially if not household names, really struggle to attract audit committee members with previous audit committee experience. This can be a big factor in how much audit committees understand their own role as well as the internal audit role and the value of internal audit.
  • On the point above on volunteer audit committee membership within the charity sector, doesn't this represent a perfect opportunity for the Institute to upskill members with audit committee experience? Building the portfolio and perception of the Institute and providing value to the charities and inform/influence those organisations?

Comments following Institute update on audit committee engagement

The guidance being planned for audit committee chairs needs to include organisations backed by private equity. The aims and agendas and understanding can vary from those committees in PLCs or regulated sectors.

  • As an audit committee chair and a chief internal auditor, I am amazed that very few chairs have internal auditing expertise, the focus is very much of accounting skills.
  • Resources are a challenge, so it is all about balance. With all the change ahead of us the assurance provision is needed more and more, so the relationship with the chair of the audit committee is so important to ensure they understand the risks being faced by the organisation.
  • I’m a chair of an audit committee too and the auditors have been furloughed - I was shocked to learn this - assurance is so vital at the moment and going forward.

I have attended two audit committees where the external auditors presented the audited financial statements conducted remotely. Both completed early and under budget!

It is a reminder that we are part of the organisations we work with/for and there to deliver a strategic objective with them, so audit are navigating our role in this. So pure 3rd LOD work is important, but we are having to be flexible. 


Attendee comments, questions, and actions

Chair's comments

In a continuation of our focus on shaping internal audit for the future, today we will focus on the experiences of one head of internal audit during the crisis. We will hear of challenges relating to:

  • assuming new responsibilities
  • managing two audit teams and two audit plans
  • undertaking high profile and highly sensitive audits
  • working with specialists in other discipline
  • dealing with new and influential stakeholders.

We will then move our attention to the key learnings for the future and seek to link them to some of the key challenges facing internal audit in this increasingly uncertain world.

To support what we hope will be a particularly interactive session we are looking forward to you sharing your views on how internal audit can:

  • increase its scope without increasing its budget
  • resource a significantly changed audit plan
  • collaborate with external parties in the execution of audit work
  • increase and successfully manage the profile of the internal audit function
  • manage a significant increase in the expectations of the function. 

The world is changing, it has already changed and is continuing to change, and it is not going to get any easier. What we're talking about from today onwards is about what we have learnt. If we know it already - great; if we don’t - let's help each other learn and develop and rapidly increase the value of internal audit in the organisations we work for. 

We have recently completed a COVID-19 survey. We received over 200 responses, and we will be sharing the results of that in the next few weeks. We are finding a number of audit staff have been furloughed, or audit teams are on furlough and we want to talk about that as a profession. Haven’t we a more significant role in an organisation that should suggest that they don’t want to put internal audit on furlough? In the context of that, I am going to pick up with our guest panellist some themes, some underlying themes and just provoke a discussion around: could/should we be more effective and if so how?


Guest panellist

I have been in internal audit for approximately 20-years and head of internal audit for 7-years within the public sector. Where I work, we have one overall group service for internal audit and then we are outposted to different departments. I am outposted to two separate departments, two quite different and diverse departments with different challenges, cultures, priorities and very different stakeholder expectations, which I have had to face and deal with during COVID-19 in particular. 

I'm going to give you a bit of background on some of my challenges within each of the departments and some of the lessons that I have learnt.

For one of the departments, we found it slow initially to start our audit plan as some of our staff weren’t set up to work remotely from home. However, that has now been put in place and they are now able to get some of our audit work underway where we can undertake them remotely.

There are some audits that we haven't been able to progress because we can't do on-site visits. We have had a number of requests for advice in terms of different processes and systems moving to online, auditing financial information for example where refunds have had to be made, reviewing digital home working strategies and policies and therefore revised our plan accordingly.

I have been fortunate in that I have good support from my accounting officer (CEO in the public sector). The audit committee chair has provided flexibility for me to amend the plan as necessary, as I go along. I don't have to seek prior approval from the audit committee, but just to keep them informed of what's going on. I have found that the pieces of advice and guidance that we are giving must be turned round with quite quick timescales due to the current situation.

In contrast, in the other department I am responsible for, it is completely different. All staff within the department are working in business contingency and business continuity mode. This has followed on from Brexit issues which also impacted the department significantly. Therefore, I haven't been able to progress my audit plan, because I haven't been able to engage with management. They have been working on other priority areas, so we have been primarily involved in special exercises, investigations, and consulting exercises.

We have been involved in one special exercise which was extremely sensitive in our current climate. Our key stakeholder asked us to do a specific piece of work and lead a team of personnel from outside the organisation, including medical professionals. This presented challenges for me because I had never dealt with a situation like this before, I didn't know the personnel and we had to turn it round within a quick timescale. We didn't have any input into the terms of reference, we were given a detailed terms of reference. I was asked to lead that team of different personnel from outside the organisation. That had a lot of challenges, to understand what everyone’s role was and understand the key stakeholder requirements.

We had to do some on-site visits which were difficult, as well as coordinating the different teams with different expertise and trying to find out where to get our information. It was also a challenge to get the information in as quickly as possible in order for us to meet our timescales. I was relying on assurances that some of the team members were providing to me and I didn’t have the medical knowledge or the background to question that. Another challenge in that are area was delivering a report. There was a team of about eight of us, so it was difficult to pull together reports that everyone was happy with and that suited everyone's needs, taking into consideration the quality and accuracy due to the sensitivities involved. The audit was delivered on time and in fact raised the profile of internal audit. We stepped outside of our comfort zone, we got involved in areas we haven't been involved in before.

I have learnt from the experience and learnt more about some of the business areas within the department as well. Following the audit, we were also asked to assist management in how to take the recommendations forward and how to implement them, whilst still maintaining our independence, providing advice in terms of risks and controls and timescales for implementation.  

I have also been involved in a number of new schemes where decisions have been taken quite quickly and the schemes have had to be delivered within a tight timescale due to the current situation. We were asked to provide input to specific risks and controls around those areas. It's doing things a bit differently and management are nervous about doing things differently. Sometimes it is more efficient and sometimes it is difficult for staff on the ground to understand that process.

I've also been involved in investigations as well. For one in particular, there were challenges around sensitivities and also IT skills which I didn't have. However, being a group service, I was able to pull in resources from another team to enable that investigation to be carried out and for it to be turned around quite quickly.

Again, it was a challenge identifying what skills and competencies we needed to get that review done to meet stakeholder requirements. A big challenge for me this year is going to be at the year-end. What am I going to provide my opinion on? What is it going to be based upon? It will be impacted by how the rest of the year pans out.

I'm mindful that the department is going to be a completely different department after COVID-19 and the whole health and social care system faces strategic challenges and direction going forward. If we continue just to give advice and guidance on investigations during the year, what can we place our annual opinion on at year-end? The cumulative assurances that we’ve previously given, on those systems and processes or those that have significantly changed?

To give some lessons learnt from all this work (it has been extremely busy the last few months), it has often been difficult to juggle two departments with such competing priorities. Everyone wants everything done straightaway with tight timescales and different requirements. I am fortunate with my two audit teams in that I can rotate staff between the two and bring in skills were needed; it is important to prioritise and plan carefully. I have had to delegate some work to some of my audit managers, prioritising the areas that I feel that I need to be involved in and lead. It is having the right team, with the right skills and experience. The special exercise that we did, I really did learn a lot from that and learnt more from what happens out on the ground, getting different people’s perspective from outside the department. It is also important that I’m flexible with my plans and keep key stakeholders involved with what is going on, with the view to reviewing plans at mid-year or as we see fit.

A lot of those reviews had to be done within short timeframes, so it is about planning effectively, having the right staff on the team, and get buy-in from management themselves. In order to deliver within agreed timescales, we needed to have the information provided to us in a timely manner, everyone needed to know the tight timescales involved. It is also having the confidence, taking on new challenges and being prepared to do different pieces of work.

I feel that in my role, by doing that, it has raised the profile of internal audit within the department and we have since been asked to take on other pieces of work, which would not normally be within our remit. I think because we did the sensitive exercise I mentioned earlier with external personnel which we lead on, it raised the profile of internal audit. We're now getting more work coming in which is fine, so going forward we need to keep the audit plans under review and continue learning from our experiences and having the confidence to maybe step outside our normal routine and normal audit plans and be flexible. 

Chair's comments

Thank you.

That was a starter for 10, wasn't it! A lot of things to do, tight timeframes set and competing priorities.

You mentioned audit committees when you talked about audit plans and flexing the plan. In the future, with increased profile, increased expectations, increased workloads, decreased budgets possibly: how important do you see the audit committee relationship and how would you like that to be in future?


Guest panellist

The audit committee interaction has been variable, with both audit committees having new members on them. I've had good support from the department accounting officers and plenty of communication with the accounting officers. I have been more or less able to change the plans and be more flexible and just keep the audit committee up to date. More interaction maybe going forward would be good. 

Chair's comments

How would you like to see your relationship develop with the chair of the audit committee by this time next year, for example how collaborative would you wish the relationship to be and how frequently would you expect to speak to them? How would you like to be able to describe the relationship in a years’ time?


Guest panellist

I think it should be more collaborative, maybe on a monthly basis just to touch base to see how things are going and communicate more regularly. We have our meetings on a quarterly basis, and they are quite lengthy meetings. Therefore, shorter more frequent meetings throughout the year would be helpful to get that support and buy-in. 

Chair's comments

Moving backwards a little bit, in terms of having to blend skillsets together to get the audits completed, clearly there is an agility in doing that? Do you see this panning out as being a business as usual type of approach for the future? In other words, do you see the team as having to be more flexible and expand their skills base?


Guest panellist

Yes, I've had to do that. First of all it was Brexit and then COVID-19. I think as head of internal audit I have had to identify what skills are needed and where we can get those from. The expectations of stakeholders are increasingly demanding with regards to timescales, it's not just getting the audit done on time, but ensuring that the quality and the accuracy is right. I think the competency and skills of staff is key. But I do think that expectation are going to increase going forwards. I'm hoping it is going to get easier but, I can’t give any guarantees.

Participant invited to share their thoughts

I work in the charity sector and I think it's been interesting looking at what has happened in the sector over the last few months. We have really seen that the profile point has really impacted on the individual internal audit function. Especially where the head of internal audit feels their relationship with the audit committee isn't as strong or their audit committee don't perhaps understand it as well as they might, or appreciate the value that the internal audit can bring. I think what we've seen it's much more likely that the internal audit team will find themselves furloughed with little discussion about what the impact of that is on the organisation.

I know I'm picking up on the importance of the audit committee. I think that's been so pertinent in terms of getting the right budget, getting those skill sets that you need, all of those great things that are really important as the panellist mentioned to the success of various projects. Especially when you're looking to bring in new skills sets. I've seen colleagues who have had significant turnover. Single internal auditors talking about the length of time it took to get appreciation/buy-in with the audit committee, as one person auditing effectively across the whole organisation.

I don't have IT skills; how can I effectively do a cyber audit without some kind of co-source? Some colleagues of mine in the charity sector have struggled with that. It's been a change in audit committee chair that has led to them eventually getting that resource and getting the buy-in for this. You do need specialist resource to do the internal audit work effectively and to deliver the kind of programme that we would expect for organisations, so I think that understanding at audit committee level is really vital.

Going back to the internal audit profile, I think on the flipside, what I have seen is colleagues who have a strong relationship with their organisation and leadership understand that there is a breadth of roles that internal audit can play. There is a lot of value in their understanding of the organisation as a whole along with their risk and control understanding, especially at a time like this. We've seen internal auditors being brought into the fold a lot more, sitting in on incident management meetings more, giving lots of up to date ‘critical friend’ guidance on plans as they are forming, because their opinion is valued.

It is interesting to see the breadth of responses in terms of leadership and the role they want internal audit to play in their organisation at this time. I do think it comes back very strongly to the internal audit profile in the organisation and the sector to some extent, as well as the understanding from the audit committee and the executive what they want from their internal audit function and value and range of roles that they could provide. 

Chair's comments

Thank you.

Talking about profile and the relationship with the audit committees – a personal view – that is your key connection, your key stakeholder. If they don’t have a clear understanding of who we are they won't necessarily get the best out of us.

Back to our guest panellist, you have had a difficult situation, but you’ve come through it. You are still going through it, and you will continue to go through it. The new challenges, you couldn't possibly have got there with an audit committee that were against you? Potentially in the future you might want an audit committee that is more connected so that they can get more out of you and you can provide added value.

We are currently doing some work in the audit committee space and will take the opportunity now to provide an update on what we are doing.

 

Institute's response

It is interesting to think about the relationship between the head of internal audit and the audit committee. I sometimes question whether the audit committee really understands, not just the role that we play, but the capability and capacity within the internal audit team to deliver the expectations that the audit committee have.

I think that, having appeared before audit committees for over 25-years, you get some very supportive audit committees that really resonate and understand the challenges that internal audit faces.

From an Institute perspective we are really keen to engage a lot more with audit committee members and encourage them to challenge heads of internal audit in terms of what you're doing and how they can support and help you.

We are looking to build that engagement with the audit committee in a framework within the Institute and hopefully will look to all of you to help us engage with your audit committee chairs and members to challenge them, to challenge you, and challenge the Institute in terms of how we move forward.

The new future is going to bear no resemblance to what we've done in the past and we really need to be ready to deliver that new future, whether it's more assurance with less resource, whether it's how we manage without IT support within the internal audit team, when there's no budget to co-source or outsource - how do we provide that level of assurance?

There are more challenges as we come out of COVID-19, whenever that might be, but then rush headlong into an significant economic recession. Then, on top of that, the climate change challenges which are going to have significant financial impact on everyone. There are an awful lot of things coming down the track at us, you might say we are in a perfect storm scenario. The relationship, therefore, between internal audit and the audit committee is now more important than it's ever been.

 

Chair's comments

To summarise on that, the Institute are starting an initiative to focus more on audit committees and audit committee chairs. We do believe that we need to improve our relationship with that population because it will add value to everybody.

We may come back and ask for your help and support on this in the not too distant future.

Guest panellist - can I just ask you to reflect on, what has been quite a difficult period for you. Have you enjoyed it as an individual?


Guest panellist

Yes, I've learned a lot - I didn't at the start, I thought how will I ever get through these few months, I had so much work to do, but actually I did. I learnt a lot and enjoyed the special exercise and working with people outside the organisation and learning more about the organisation, things that I thought I knew and didn't really, I've learnt a lot of new skills for myself as well.

Chair's comments

Could it be the ability to create that type of challenge for your team has been a beneficial thing for them? I don’t mean such an extreme version but challenging them to open up, expand, extend, etc. Would that be something worth doing with them?


Guest panellist

Yes definitely, they have all had to work in a more agile way they fully understand the word agile now, so we've all learnt new experiences and a different way of auditing going forward.  

Chair's comments

Last week we had the phrase ‘bottling’, which for me has stuck. There’ll be things that you have learnt and maybe wishing to ‘bottle’ for the future.

 

President's response

Going back to this idea of ‘we're in a different place’, our organisations are in a different place, I think it's given us an enormous number of opportunities.

If we are able to grab those opportunities, we get into a real virtuous circle. It is a way of building more knowledge of what our organisations are doing, what they need, what they want, how they can develop further and creating more added value from the audit service. This could be a marvellous time for us. I do understand that clearly for a lot of audit functions just getting through it is going to be a major achievement, but I do think just really keeping an eye on what we're learning along the way is really important.  

What has previously been said very clearly does stretch our teams, but if you can make it fun as well and the sense of real teamwork in a lot of functions that I've been engaging with has been incredible. Just trying to make sure that we're all working together, as effectively and efficiently as we can, is proving to be a big facet of how we get through, so I'd really endorse everything that's been said.

 

Chair's comments

In the new world (the current world) we’ll have less money flowing around with less money for training and development. A challenging question in a sense, how do you perceive you are going to keep the team up to date, ensure they have the  skills and competence needed to deliver assurance in an environment where it may be more difficult to fund training requirements?


Guest panellist

We still have our CPE requirements to meet. Maybe more on-line courses which are often cheaper than face-to-face courses, maybe personalised/in-house courses, so we're able to train fifteen people at one time rather than send individuals on courses. Learn skills from other people within the team who may already done courses all these options are helpful for new trainees. I suppose it depends what budget we have going forward, we have to adapt accordingly.

Chair's comments

The reason I'm asking about training is it is a fair assumption that people will have less money for training next year.

The reality is that you have to make do with what you've got. There are still the same expectations of internal audit, which is to deliver an audit plan which requires skills and competencies.

We are building up from a zero base of no budget whatsoever. Our panellist is giving us some of the answers, ignore what you used to do and think about what you can do. There's always going to be an opportunity to source training from the organisation next door, the department next door, a skillset somebody else in the function has but we haven’t actually used in the past.

I think we're heading into a world of sharing resources and knowledge which will be reflected in terms of what we deliver as an Institute which will have to be more flexible, more dynamic training. People are looking for maximum value for minimum cost.


Participant invited to share their thoughts

I agree with the Institute’s comments in terms of challenges ahead in terms of resources, etc. and climate change, of course Brexit and the global issues that are going on.

It is important for the chair of the audit committee to be on that path as well. There may be a need to invest in training and resources now so that in the longer term, as the ability to leverage on new developments in technologies such as video conferencing, cloud based platforms for collaborative working and delivery with remote access infrastructure is possible. Investment in new technology learning can provide increases in internal audit efficiencies as we move forward.

With internal audit functions operating globally tools such as increased online access may be able to better configure audit teams to share the most suitable resources. The adoption of technology and digital tools increases potential electronic file management, data analytics and workflow systems.

There may be opportunities to improve continuous audit activities and enable automation of key risk controls thereby freeing internal audit to focus on more complex risk areas and advisory services.

Currently we are getting involved in applicable regulatory compliance  as more people work from home including Health and Safety, Data Protection and Work Time Act, as well as how the clear desk policy is applied: how partners employed by different companies are working at home together.

Generally I think we're all getting better at the online world. For example, we are using Microsoft Teams which is great, as you can work on the same file at the same time. I would describe it as online agility, so we're getting more agile in the audit space online which we were moving to anyway, this is another layer of it. 

Chair's comments

In some senses I think it's time to sit back and say we’re not just reskilling or upskilling, we’re growing using digital technology and reconfiguring the audit team and the audit service for the future. A three-dimensional change which is significant if we are coming from a low start but less so if we’re coming from a high start.

In many senses we would like to try and help to find what good looks like for a whole range of areas for the future. At the minute we’re trying to see what good looks like for the audit committee so that they can understand what to expect from internal audit. 

Redefining what a good audit function might have in terms of its toolkit - digital capability, IT capability etc. The Institute is seeking to reach a point so we can say good looks like this and by the way, it is better than it was – a challenge for us to take on.

Picking up on a comment in the chat box about guidance for audit committees in relation the private sector, regulated sectors etc. the work we do here will have to reflect every sector. As we go into this initiative, we will not be doing it in isolation i.e. we will be looking for help, assistance, and input. It is possible that at some point we will be back on this Forum to look for your views and input.

To move briefly to another topic to draw out a couple of points; the audit plan will look considerably different next year, guest panellist, could you share the percentage change you might see versus what you might have perceived the plan to be next year to what next year’s plan will be?


Guest panellist

In one of my department’s, I don't foresee the plan changing significantly, although a lot of the audits have been pushed back to year-end they might have to be deferred into the 2021/22 audit plan. In terms of my other department’s original plan, I can see it changing, probably 100%. I'm not even sure if some of those processes or systems will still be in place from previous audits that we've done. We haven't been able to progress any of that audit plan at all. We’re nearly at the end of quarter one, significant changes on this department but not on the other department. 

Chair's comments

Do you do a risk universe to support your planning process or a risk assessment? 

Guest panellist confirmed that they have a risk universe.

I would imagine that the time it takes to prepare this has had to reduce, or will have to reduce going forward, to be more dynamic and that would be the case for many organisations.

Whilst there are examples where it takes several months to do the risk assessment which leads to the audit plan, that needs to be condensed right down to a couple of weeks and we have examples, not on the call today where it has been done in a week from start to finish compared to a six-week period in the past.

Risk assessment is a key activity we have to undertake to produce the plan but quite often, once the audit plan has been approved it goes on the shelf. It’s going to have to be far more dynamic in the ‘new normal'.

Just before we finish, I have a question I would like to ask. We would like to quote your name as having attended this Forum in some of our publications/social media. If you would prefer for your name not to be mentioned can you add a note in the chat box today or alternatively email me.

This conversation is going to continue, it is a big agenda, we explored a couple of topics today and we will keep adding topics to the list. The theory is, you pick a topic, we discuss it and get a clear view on it and then the Institute will do something about it, we will seek to collaborate  because we’re all part of the same profession.

Finally, as today’s session draws to a close, I would like to thank you all for attending and for contributing to our discussion and a special thanks to our guest panellist.

We are very keen to get your feedback about this Forum, in terms of both format and content. This will be invaluable for shaping future meetings and making sure they meet your needs. So please do share any thoughts with Liz Sandwith (liz.sandwith@iia.org.uk) or Derek Jamieson (derek.jamieson@iia.org.uk).

And of course, we will happily take further questions outside this forum as part of our ongoing approach to the COVID-19 crisis – so please do get in touch if there is anything else, we should be looking at!