Heads of Internal Audit Virtual Forum

10 June 2020

Please note:

• All Institute responses are boxed and highlighted blue.
• Where the chair comments in that capacity, the box is highlighted in yellow.
• Where the President comments in that capacity, the box is highlighted heather.
• All delegate/attendee comments/statements/replies are un-highlighted and un-boxed.
• For confidentiality, the identities of all delegates/attendees are anonymised. 

Chat box comments

The profile of internal audit is exceptionally important. I think we've seen this recently in the charity sector with colleagues who would describe their executive/audit committee as not fully understanding the value of internal audit (or the remit of what I can do).

Finding themselves furloughed without any real risk assessment for pausing the internal audit activity, whereas other teams where the leadership is clearer on the value internal audit can provide, have pulled internal audit closer and have been seeking the critical friend view on many of the difficult decisions being made during the pandemic.

• I agree with the above point on the charity sector. I have found it far easier to agree budget and resource requirements with my current audit committee, who want to see internal audit central to the organisation, compared to previous audit committees who saw internal audit as a peripheral add-on, limited to financial reporting risks.
• Worth noting that with audit committee roles being unpaid in the charity sector, some charities, especially if not household names, really struggle to attract audit committee members with previous audit committee experience. This can be a big factor in how much audit committees understand their own role as well as the internal audit role and the value of internal audit.
• On the point above on volunteer audit committee membership within the charity sector, doesn't this represent a perfect opportunity for the Institute to upskill members with audit committee experience? Building the portfolio and perception of the Institute and providing value to the charities and inform/influence those organisations?
  
  

Comments following Institute update on audit committee engagement

The guidance being planned for audit committee chairs needs to include organisations backed by private equity. The aims and agendas and understanding can vary from those committees in PLCs or regulated sectors.

• As an audit committee chair and a chief internal auditor, I am amazed that very few chairs have internal auditing expertise, the focus is very much of accounting skills.
• Resources are a challenge, so it is all about balance. With all the change ahead of us the assurance provision is needed more and more, so the relationship with the chair of the audit committee is so important to ensure they understand the risks being faced by the organisation.
• I’m a chair of an audit committee too and the auditors have been furloughed - I was shocked to learn this - assurance is so vital at the moment and going forward.

I have attended two audit committees where the external auditors presented the audited financial statements conducted remotely. Both completed early and under budget!

It is a reminder that we are part of the organisations we work with/for and there to deliver a strategic objective with them, so audit are navigating our role in this. So pure 3rd LOD work is important, but we are having to be flexible. 

Attendee comments, questions, and actions

Guest panellist

I have been in internal audit for approximately 20-years and head of internal audit for 7-years within the public sector. Where I work, we have one overall group service for internal audit and then we are outposted to different departments. I am outposted to two separate departments, two quite different and diverse departments with different challenges, cultures, priorities and very different stakeholder expectations, which I have had to face and deal with during COVID-19 in particular. 

I'm going to give you a bit of background on some of my challenges within each of the departments and some of the lessons that I have learnt.

For one of the departments, we found it slow initially to start our audit plan as some of our staff weren’t set up to work remotely from home. However, that has now been put in place and they are now able to get some of our audit work underway where we can undertake them remotely.

There are some audits that we haven't been able to progress because we can't do on-site visits. We have had a number of requests for advice in terms of different processes and systems moving to online, auditing financial information for example where refunds have had to be made, reviewing digital home working strategies and policies and therefore revised our plan accordingly.

I have been fortunate in that I have good support from my accounting officer (CEO in the public sector). The audit committee chair has provided flexibility for me to amend the plan as necessary, as I go along. I don't have to seek prior approval from the audit committee, but just to keep them informed of what's going on. I have found that the pieces of advice and guidance that we are giving must be turned round with quite quick timescales due to the current situation.

In contrast, in the other department I am responsible for, it is completely different. All staff within the department are working in business contingency and business continuity mode. This has followed on from Brexit issues which also impacted the department significantly. Therefore, I haven't been able to progress my audit plan, because I haven't been able to engage with management. They have been working on other priority areas, so we have been primarily involved in special exercises, investigations, and consulting exercises.

We have been involved in one special exercise which was extremely sensitive in our current climate. Our key stakeholder asked us to do a specific piece of work and lead a team of personnel from outside the organisation, including medical professionals. This presented challenges for me because I had never dealt with a situation like this before, I didn't know the personnel and we had to turn it round within a quick timescale. We didn't have any input into the terms of reference, we were given a detailed terms of reference. I was asked to lead that team of different personnel from outside the organisation. That had a lot of challenges, to understand what everyone’s role was and understand the key stakeholder requirements.

We had to do some on-site visits which were difficult, as well as coordinating the different teams with different expertise and trying to find out where to get our information. It was also a challenge to get the information in as quickly as possible in order for us to meet our timescales. I was relying on assurances that some of the team members were providing to me and I didn’t have the medical knowledge or the background to question that. Another challenge in that are area was delivering a report. There was a team of about eight of us, so it was difficult to pull together reports that everyone was happy with and that suited everyone's needs, taking into consideration the quality and accuracy due to the sensitivities involved. The audit was delivered on time and in fact raised the profile of internal audit. We stepped outside of our comfort zone, we got involved in areas we haven't been involved in before.

I have learnt from the experience and learnt more about some of the business areas within the department as well. Following the audit, we were also asked to assist management in how to take the recommendations forward and how to implement them, whilst still maintaining our independence, providing advice in terms of risks and controls and timescales for implementation.  

I have also been involved in a number of new schemes where decisions have been taken quite quickly and the schemes have had to be delivered within a tight timescale due to the current situation. We were asked to provide input to specific risks and controls around those areas. It's doing things a bit differently and management are nervous about doing things differently. Sometimes it is more efficient and sometimes it is difficult for staff on the ground to understand that process.

I've also been involved in investigations as well. For one in particular, there were challenges around sensitivities and also IT skills which I didn't have. However, being a group service, I was able to pull in resources from another team to enable that investigation to be carried out and for it to be turned around quite quickly.

Again, it was a challenge identifying what skills and competencies we needed to get that review done to meet stakeholder requirements. A big challenge for me this year is going to be at the year-end. What am I going to provide my opinion on? What is it going to be based upon? It will be impacted by how the rest of the year pans out.

I'm mindful that the department is going to be a completely different department after COVID-19 and the whole health and social care system faces strategic challenges and direction going forward. If we continue just to give advice and guidance on investigations during the year, what can we place our annual opinion on at year-end? The cumulative assurances that we’ve previously given, on those systems and processes or those that have significantly changed?

To give some lessons learnt from all this work (it has been extremely busy the last few months), it has often been difficult to juggle two departments with such competing priorities. Everyone wants everything done straightaway with tight timescales and different requirements. I am fortunate with my two audit teams in that I can rotate staff between the two and bring in skills were needed; it is important to prioritise and plan carefully. I have had to delegate some work to some of my audit managers, prioritising the areas that I feel that I need to be involved in and lead. It is having the right team, with the right skills and experience. The special exercise that we did, I really did learn a lot from that and learnt more from what happens out on the ground, getting different people’s perspective from outside the department. It is also important that I’m flexible with my plans and keep key stakeholders involved with what is going on, with the view to reviewing plans at mid-year or as we see fit.

A lot of those reviews had to be done within short timeframes, so it is about planning effectively, having the right staff on the team, and get buy-in from management themselves. In order to deliver within agreed timescales, we needed to have the information provided to us in a timely manner, everyone needed to know the tight timescales involved. It is also having the confidence, taking on new challenges and being prepared to do different pieces of work.

I feel that in my role, by doing that, it has raised the profile of internal audit within the department and we have since been asked to take on other pieces of work, which would not normally be within our remit. I think because we did the sensitive exercise I mentioned earlier with external personnel which we lead on, it raised the profile of internal audit. We're now getting more work coming in which is fine, so going forward we need to keep the audit plans under review and continue learning from our experiences and having the confidence to maybe step outside our normal routine and normal audit plans and be flexible. 

Guest panellist

The audit committee interaction has been variable, with both audit committees having new members on them. I've had good support from the department accounting officers and plenty of communication with the accounting officers. I have been more or less able to change the plans and be more flexible and just keep the audit committee up to date. More interaction maybe going forward would be good. 

Guest panellist

I think it should be more collaborative, maybe on a monthly basis just to touch base to see how things are going and communicate more regularly. We have our meetings on a quarterly basis, and they are quite lengthy meetings. Therefore, shorter more frequent meetings throughout the year would be helpful to get that support and buy-in. 

Guest panellist

Yes, I've had to do that. First of all it was Brexit and then COVID-19. I think as head of internal audit I have had to identify what skills are needed and where we can get those from. The expectations of stakeholders are increasingly demanding with regards to timescales, it's not just getting the audit done on time, but ensuring that the quality and the accuracy is right. I think the competency and skills of staff is key. But I do think that expectation are going to increase going forwards. I'm hoping it is going to get easier but, I can’t give any guarantees.

Participant invited to share their thoughts

I work in the charity sector and I think it's been interesting looking at what has happened in the sector over the last few months. We have really seen that the profile point has really impacted on the individual internal audit function. Especially where the head of internal audit feels their relationship with the audit committee isn't as strong or their audit committee don't perhaps understand it as well as they might, or appreciate the value that the internal audit can bring. I think what we've seen it's much more likely that the internal audit team will find themselves furloughed with little discussion about what the impact of that is on the organisation.

I know I'm picking up on the importance of the audit committee. I think that's been so pertinent in terms of getting the right budget, getting those skill sets that you need, all of those great things that are really important as the panellist mentioned to the success of various projects. Especially when you're looking to bring in new skills sets. I've seen colleagues who have had significant turnover. Single internal auditors talking about the length of time it took to get appreciation/buy-in with the audit committee, as one person auditing effectively across the whole organisation.

I don't have IT skills; how can I effectively do a cyber audit without some kind of co-source? Some colleagues of mine in the charity sector have struggled with that. It's been a change in audit committee chair that has led to them eventually getting that resource and getting the buy-in for this. You do need specialist resource to do the internal audit work effectively and to deliver the kind of programme that we would expect for organisations, so I think that understanding at audit committee level is really vital.

Going back to the internal audit profile, I think on the flipside, what I have seen is colleagues who have a strong relationship with their organisation and leadership understand that there is a breadth of roles that internal audit can play. There is a lot of value in their understanding of the organisation as a whole along with their risk and control understanding, especially at a time like this. We've seen internal auditors being brought into the fold a lot more, sitting in on incident management meetings more, giving lots of up to date ‘critical friend’ guidance on plans as they are forming, because their opinion is valued.

It is interesting to see the breadth of responses in terms of leadership and the role they want internal audit to play in their organisation at this time. I do think it comes back very strongly to the internal audit profile in the organisation and the sector to some extent, as well as the understanding from the audit committee and the executive what they want from their internal audit function and value and range of roles that they could provide. 

Guest panellist

Yes, I've learned a lot - I didn't at the start, I thought how will I ever get through these few months, I had so much work to do, but actually I did. I learnt a lot and enjoyed the special exercise and working with people outside the organisation and learning more about the organisation, things that I thought I knew and didn't really, I've learnt a lot of new skills for myself as well.

Guest panellist

Yes definitely, they have all had to work in a more agile way they fully understand the word agile now, so we've all learnt new experiences and a different way of auditing going forward.  

Guest panellist

We still have our CPE requirements to meet. Maybe more on-line courses which are often cheaper than face-to-face courses, maybe personalised/in-house courses, so we're able to train fifteen people at one time rather than send individuals on courses. Learn skills from other people within the team who may already done courses all these options are helpful for new trainees. I suppose it depends what budget we have going forward, we have to adapt accordingly.

Participant invited to share their thoughts

I agree with the Institute’s comments in terms of challenges ahead in terms of resources, etc. and climate change, of course Brexit and the global issues that are going on.

It is important for the chair of the audit committee to be on that path as well. There may be a need to invest in training and resources now so that in the longer term, as the ability to leverage on new developments in technologies such as video conferencing, cloud based platforms for collaborative working and delivery with remote access infrastructure is possible. Investment in new technology learning can provide increases in internal audit efficiencies as we move forward.

With internal audit functions operating globally tools such as increased online access may be able to better configure audit teams to share the most suitable resources. The adoption of technology and digital tools increases potential electronic file management, data analytics and workflow systems.

There may be opportunities to improve continuous audit activities and enable automation of key risk controls thereby freeing internal audit to focus on more complex risk areas and advisory services.

Currently we are getting involved in applicable regulatory compliance  as more people work from home including Health and Safety, Data Protection and Work Time Act, as well as how the clear desk policy is applied: how partners employed by different companies are working at home together.

Generally I think we're all getting better at the online world. For example, we are using Microsoft Teams which is great, as you can work on the same file at the same time. I would describe it as online agility, so we're getting more agile in the audit space online which we were moving to anyway, this is another layer of it. 

Guest panellist

In one of my department’s, I don't foresee the plan changing significantly, although a lot of the audits have been pushed back to year-end they might have to be deferred into the 2021/22 audit plan. In terms of my other department’s original plan, I can see it changing, probably 100%. I'm not even sure if some of those processes or systems will still be in place from previous audits that we've done. We haven't been able to progress any of that audit plan at all. We’re nearly at the end of quarter one, significant changes on this department but not on the other department.