Heads of Internal Audit Virtual Forum

Institute's comments

The Institute is running a disruption project led by Liz Sandwith, Chief Professional Practices Adviser. The project will look at disruption from a number of different perspectives: not just in terms of COVID-19, but what disrupts organisations. 

Is your organisation a disruptor or are they being disrupted? For example, Starling Bank - a digital, mobile-only bank - is probably a disrupter in the sector by comparison to well-established legacy banks.

What can internal audit do to help their organisation in terms of whether they are disrupting? Are internal auditors coming up with new innovative new ways of doing things and/or are they being disrupted? Have they missed the boat? Could they have done something different? How could internal audit have helped to mitigate the risks associated with disruption. For example:

• Netflix did not kill Blockbuster. Ridiculous late fees did.
• Uber did not kill the taxi business. Limited access and fare control did.
• Apple did not kill the music industry. Being forced to buy full-length albums did.
• Amazon did not kill other retailers. Poor customer service and experience did.
• Airbnb isn’t killing the hotel industry. Limited availability and pricing options are.

Technology by itself is not the disruptor. Not being customer-centric is the biggest threat to any business.

How could internal audit contribute to disruption/innovation in relation to what our organisations are doing, disrupting or being disrupted.

The Institute wants to look at disruption not simply from an internal audit perspective, but also from a risk perspective, what are the risks facing our organisation? We all need to broaden our horizons and think beyond COVID-19, what is coming down the track? What does the new normal look like?

The disruption project is an opportunity for us, as internal auditors to look at ourselves. What can we do differently? What do we need to be doing to move forward and help our organisations be sustainable in a world that is heading towards a risk scenario worse than COVID-19 i.e. climate change and a sustained recession? What can internal audit do, to help our organisation mitigate some of these phenomenal risks that are coming down the track? How can we disrupt and challenge ourselves to be the internal auditors for the next decade as we move forward?

How are we going to do this?

• Through a series of round tables, talking to heads of internal audit.
• Keynote panel discussion at the Chartered IIA conference taking place on 30 September – 1 October 2020.
• Production of technical guidance and webinars.
• Production of a report of findings, lessons learnt.
• Looking at working with our colleagues in AIRMIC and the Institute of Risk Management in terms of helping manage these disruption type risks.
• Following on from the article on disruption in the July/August edition of the Audit & Risk magazine to produce more content on the subject.
• Talk to the press about what we are doing as an Institute, raising the profile of the Institute and the profession and what the profession can do for organisations.

If anyone wants to get involved with this project, please get in touch with Liz Sandwith (liz.sandwith@iia.org.uk).

Chair's comments

Following a recent conversation with an organisation that sees itself as a disrupter, internal audit has been asked to do a review, once the organisation has revised its strategy and initiatives etc, to give a view on the pace of change against the new agreed trajectory of the organisation. This is quite a change for the audit team. The board is now saying we have to up our game dramatically and they want assurance from the internal audit function. The COVID-19 crisis has made them realise that what they were doing, everyone else is immediately copying, as everyone has had to adapt very rapidly. They are finding that instead of being ten steps ahead in their own view, in fact they may only be one or two steps ahead of competitors, which is a concern.

Moving to chat box comments on strategy re “not everyone dares to do an audit of the strategy”.

Approximately 15-years ago, I undertook an audit of the strategy development process. We had to cease after about a week as we could not find a documented approach to building the strategy. To the internal audit team, it was the easiest finding to identify but it was a difficult finding to raise, because we were raising it on the CEO and the board were going to find out about that.

Institute's comments

Sometimes organisations are less clear about their real purpose. If they are not clear about their purpose, then their strategy struggles in terms of what it is seeking to deliver. I've seen organisations where their strategy doesn't match their purpose. I've seen organisations where the strategy was built certainly on shifting sand, because the information on which the board and the senior management team based their strategy was flawed because it was never challenged or questioned.

Internal audit has a real role to contribute to the thinking that goes on at the top table and now, through our Internal Audit Codes of Practice and the work of the Institute we are saying that heads of internal audit should have a seat at the top table. Internal audit needs to understand the organisation, its purpose, its direction, its market, its geographical location. All those things are auditable and through reviewing all of these topics we can contribute to the future success and sustainability of the organisation.

Interim CEO comment

A very interesting comment, particularly given social distancing on building sites, having your building materials assembled in a factory offline and then assembled at the site. This is an example of a trend that already existed, but has been accelerated because of COVID-19 and the social and health responses required.

Institute's comments

Some of the challenges are going to link into the next subject we have on the agenda today with climate change and building properties that are fit for the next 50-years in terms of meeting the climate change targets. A social housing organisation where I am on the board, will be looking at how to eradicate fuel poverty, how to meet targets, etc. The cost of doing that is quite high. The targets must be met so that might be a disruptor in the construction sector – the need to meet new and different targets that haven't been thought about before is a challenge.

President's comments

These are areas where internal audit has got tremendous opportunity to move outside their comfort zone. There are a lot of these things that we are already deeply immersed in, if we are not, then there's definitely an opportunity to do so.

I do think, going back to all the conversations we've had over the last few months, during this COVID-19 experience, that it is opening up some really interesting discussions with management. I think internal audit are going to be judged on how successful we are taking some of those discussions to the next stage. Since I became involved in internal audit, the world has changed totally, in terms of what we can now look at. Making sure that we are well positioned to grasp those opportunities going forward is going to be key.  

Chair's comments

I am going to ask four questions that I hear frequently and then answer them:

1. Why should the organisation get involved?

If it's not for the sake of the world and everything that lives in it or lives on it maybe, it's about having a competitive opportunity. Recognising that the opportunity to be better than other organisations, taking advantage of the situation, finding a new product to disrupt and innovate. If it is neither of these, is it pressure on us that we must do something?

On the internet, every single day you can go find climate change news, with increasing pressure being turned up on this subject:

• increasing pressure on banks which translates to the customer base as the banks look to give credit to creditworthy people under the climate agenda
• increasing pressure on companies to disclose status and progress against the climate agenda requirements will drive change in companies’ boardrooms.

If you should be reporting and not doing so, you have a challenge, with questions being raised. There will be a reporting disclosure requirement for some in 2020, not for everybody, but the journey is towards everybody. Rather than wait for it to become compulsory do something beforehand.

2. Why should the Institute and internal audit get involved – is it a risk?

Is that not what we do? Look at risk - how a risk is identified, how it is mitigated, etc.

3. Will we be welcomed if we try and put climate change on the internal audit plan for next year?

I attended a session recently, run by Chapter Zero, a climate focused organisation, Mark Carney, the former Governor of the Bank of England spoke. Mr Carney is now a special envoy on climate change at NATO and a government adviser to Boris Johnson, UK Prime Minster. 

Mr Carney made it clear that:

• boards need to improve their understanding of this risk - there are processes being shared to help with this such as scenario analysis
• boards need to understand the opportunities, not just the risk. An attendee pointed out that as a minimum, in the UK there is one trillion pounds of investment money waiting for climate agenda initiatives
• there is a need for organisations to have a strategy, a plan and clarity on responsibilities as they will be asked to report in 2021
• organisations that are prominent now, making the most difference have a very clear senior executive sponsor and potentially a board sponsor as well, demonstrating commitment.

Basically, if it is a risk, have organisations identified climate change as a risk and are the audit committees aware of it and participating in some discussion? We need to understand, have they got an action plan to deal with it – is it in sufficient detail and is progress being made? Who has been allocated what responsibility? What's the measurement process – basically a process that can be audited.

4. What value can internal audit add?

Internal audit can help with the climate change agenda by saying, have you thought about it, what are you doing about it, what is the approach?

The Institute can add context and help in terms of technical guidance, some of which is already on the website. There have been articles in the Audit & Risk magazine, and we will continue to publish further articles. In addition, for those participating in this forum and other heads of internal audit one of the ways we can do this is to speak more as a group. 

Chair's comments

Most local authorities now have targets in place that affect every one of us in some respects and certainly affect the organisations we work for. I am aware of some organisations, that are not aware of the local targets and the contribution they are expected to make to achieve it.

Chair's comments

Climate change has to be a cultural approach. A top down initiative sponsored by senior executives setting a standard and a strategy. I think that climate is a subject that needs to be tackled in this way in every organisation.

Institute's comments

Provided an example in the farming industry of initiatives to reduce methane gas emission as well as things we can do on our own worlds such as switching lights off. Each and every one of us can make a small difference. We all have a duty and a responsibility to do our bit to make a difference to climate change as well as auditing it in our organisations.

Chair's comments

We will be coming back to disruption and are keen to get volunteers from this group and from elsewhere. If you are interested in helping the disruption agenda, please get involved.

On the climate agenda we have only briefly touched on it today, but we will return to this subject.

Next week will be a question time session where we will answer any question you or one of your team have in relation to the Institute and its activities. If you wish, you can submit your questions in advance to Liz Sandwith (liz.sandwith@iia.org.uk) or Derek Jamieson (derek.jamieson@iia.org.uk).

All attendees from this and previous forums will receive an invitation for next week’s session. If you wish to delegate attendance to a member of your team or add them to the invitation in order to allow them to ask a question, please do so.

The Institute wants to provide as many opportunities as possible to share, as it is only through doing so that we really engage and help shape the future of internal audit.

29th July 2020 sees the inaugural meeting of a new local government forum. This has arisen as a result of this forum and a demand for a more specific forum. If you have more ideas and suggestions for forums and ways of communicating let us know.

5^th August 2020 sees the start our new season of forums. Last week we undertook a poll on topics that are most important to you for the Institute’s agenda. The one with the highest number of votes was ‘build back better’ i.e. effectively how do we build audit for the future. For the Institute it is about how we help shape the future of internal audit.

Finally, as today’s session draws to a close, I would like to thank you all for attending and for contributing to our discussion.