Heads of Internal Audit Virtual Forum

15 July 2020

Please note:

  • All Institute responses are boxed and highlighted blue.
  • Where the chair comments in that capacity, the box is highlighted yellow.
  • Where the interim CEO comments in that capacity, the box is blank but outlined. 
  • Where the President comments in that capacity, the box is highlighted heather.
  • For confidentiality, the identities of all delegates/attendees are anonymised. 
     

Support our climate change survey

While you're here, be sure to take part in our climate change survey, available to heads of internal audit, which runs until August 7 and only takes a couple of minutes to complete. Click here to complete the survey.


The session covered two topics, disruption and climate. Both topics are increasingly relevant to us all and will be discussed during these meetings over the coming months.

Disruption 

Institute's comments

The Institute is running a disruption project led by Liz Sandwith, Chief Professional Practices Adviser. The project will look at disruption from a number of different perspectives: not just in terms of COVID-19, but what disrupts organisations. 

Is your organisation a disruptor or are they being disrupted? For example, Starling Bank - a digital, mobile-only bank - is probably a disrupter in the sector by comparison to well-established legacy banks.

What can internal audit do to help their organisation in terms of whether they are disrupting? Are internal auditors coming up with new innovative new ways of doing things and/or are they being disrupted? Have they missed the boat? Could they have done something different? How could internal audit have helped to mitigate the risks associated with disruption. For example:

  • Netflix did not kill Blockbuster. Ridiculous late fees did.
  • Uber did not kill the taxi business. Limited access and fare control did.
  • Apple did not kill the music industry. Being forced to buy full-length albums did.
  • Amazon did not kill other retailers. Poor customer service and experience did.
  • Airbnb isn’t killing the hotel industry. Limited availability and pricing options are.

Technology by itself is not the disruptor. Not being customer-centric is the biggest threat to any business.

How could internal audit contribute to disruption/innovation in relation to what our organisations are doing, disrupting or being disrupted.

The Institute wants to look at disruption not simply from an internal audit perspective, but also from a risk perspective, what are the risks facing our organisation? We all need to broaden our horizons and think beyond COVID-19, what is coming down the track? What does the new normal look like?

The disruption project is an opportunity for us, as internal auditors to look at ourselves. What can we do differently? What do we need to be doing to move forward and help our organisations be sustainable in a world that is heading towards a risk scenario worse than COVID-19 i.e. climate change and a sustained recession? What can internal audit do, to help our organisation mitigate some of these phenomenal risks that are coming down the track? How can we disrupt and challenge ourselves to be the internal auditors for the next decade as we move forward?

How are we going to do this?

  • Through a series of round tables, talking to heads of internal audit.
  • Keynote panel discussion at the Chartered IIA conference taking place on 30 September – 1 October 2020.
  • Production of technical guidance and webinars.
  • Production of a report of findings, lessons learnt.
  • Looking at working with our colleagues in AIRMIC and the Institute of Risk Management in terms of helping manage these disruption type risks.
  • Following on from the article on disruption in the July/August edition of the Audit & Risk magazine to produce more content on the subject.
  • Talk to the press about what we are doing as an Institute, raising the profile of the Institute and the profession and what the profession can do for organisations.

If anyone wants to get involved with this project, please get in touch with Liz Sandwith (liz.sandwith@iia.org.uk).

 

Chair's comments

Following a recent conversation with an organisation that sees itself as a disrupter, internal audit has been asked to do a review, once the organisation has revised its strategy and initiatives etc, to give a view on the pace of change against the new agreed trajectory of the organisation. This is quite a change for the audit team. The board is now saying we have to up our game dramatically and they want assurance from the internal audit function. The COVID-19 crisis has made them realise that what they were doing, everyone else is immediately copying, as everyone has had to adapt very rapidly. They are finding that instead of being ten steps ahead in their own view, in fact they may only be one or two steps ahead of competitors, which is a concern.

Moving to chat box comments on strategy re “not everyone dares to do an audit of the strategy”.

Approximately 15-years ago, I undertook an audit of the strategy development process. We had to cease after about a week as we could not find a documented approach to building the strategy. To the internal audit team, it was the easiest finding to identify but it was a difficult finding to raise, because we were raising it on the CEO and the board were going to find out about that.


Participant invited to share their thoughts

Strategy

The strategy is a very difficult animal politically to approach because the senior management and the CEO would normally guard their ability to make the executive decisions about the strategy and strategic direction. The strategy can be auditable, ensuring that the CEO is making decisions based on the best and correct information about potential strategic choices and advantages/disadvantages of each. The decision is another question. Internal audit need to make sure that strategy processes are mapped, controls exist and everything, ideally, should be auditable.

Institute's comments

Sometimes organisations are less clear about their real purpose. If they are not clear about their purpose, then their strategy struggles in terms of what it is seeking to deliver. I've seen organisations where their strategy doesn't match their purpose. I've seen organisations where the strategy was built certainly on shifting sand, because the information on which the board and the senior management team based their strategy was flawed because it was never challenged or questioned.

Internal audit has a real role to contribute to the thinking that goes on at the top table and now, through our Internal Audit Codes of Practice and the work of the Institute we are saying that heads of internal audit should have a seat at the top table. Internal audit needs to understand the organisation, its purpose, its direction, its market, its geographical location. All those things are auditable and through reviewing all of these topics we can contribute to the future success and sustainability of the organisation.

 
Participant invited to share their thoughts

Disruption

I suppose everyone thinks they are immune to disruption until it happens. One thing that stands out at the minute is modular construction i.e. factory-built houses. With new entrants into the sector who are building in effect factory-built houses that are delivered and erected in a couple of days, rather than the normal 14-15 weeks. It is in its early stages, but I think it's only going to ramp up. Climate change generally is going to be a disrupter for a lot of sectors. In construction it is obvious, we all want to live in nicely insulated houses but at the moment there is a very high cost in doing that.

Interim CEO comment

A very interesting comment, particularly given social distancing on building sites, having your building materials assembled in a factory offline and then assembled at the site. This is an example of a trend that already existed, but has been accelerated because of COVID-19 and the social and health responses required.

 

Institute's comments

Some of the challenges are going to link into the next subject we have on the agenda today with climate change and building properties that are fit for the next 50-years in terms of meeting the climate change targets. A social housing organisation where I am on the board, will be looking at how to eradicate fuel poverty, how to meet targets, etc. The cost of doing that is quite high. The targets must be met so that might be a disruptor in the construction sector – the need to meet new and different targets that haven't been thought about before is a challenge.

 

President's comments

These are areas where internal audit has got tremendous opportunity to move outside their comfort zone. There are a lot of these things that we are already deeply immersed in, if we are not, then there's definitely an opportunity to do so.

I do think, going back to all the conversations we've had over the last few months, during this COVID-19 experience, that it is opening up some really interesting discussions with management. I think internal audit are going to be judged on how successful we are taking some of those discussions to the next stage. Since I became involved in internal audit, the world has changed totally, in terms of what we can now look at. Making sure that we are well positioned to grasp those opportunities going forward is going to be key.  

 


Climate change

Chair's comments

I am going to ask four questions that I hear frequently and then answer them:

1. Why should the organisation get involved?

If it's not for the sake of the world and everything that lives in it or lives on it maybe, it's about having a competitive opportunity. Recognising that the opportunity to be better than other organisations, taking advantage of the situation, finding a new product to disrupt and innovate. If it is neither of these, is it pressure on us that we must do something?

On the internet, every single day you can go find climate change news, with increasing pressure being turned up on this subject:

  • increasing pressure on banks which translates to the customer base as the banks look to give credit to creditworthy people under the climate agenda
  • increasing pressure on companies to disclose status and progress against the climate agenda requirements will drive change in companies’ boardrooms.

If you should be reporting and not doing so, you have a challenge, with questions being raised. There will be a reporting disclosure requirement for some in 2020, not for everybody, but the journey is towards everybody. Rather than wait for it to become compulsory do something beforehand.

2. Why should the Institute and internal audit get involved – is it a risk?

Is that not what we do? Look at risk - how a risk is identified, how it is mitigated, etc.

3. Will we be welcomed if we try and put climate change on the internal audit plan for next year?

I attended a session recently, run by Chapter Zero, a climate focused organisation, Mark Carney, the former Governor of the Bank of England spoke. Mr Carney is now a special envoy on climate change at NATO and a government adviser to Boris Johnson, UK Prime Minster. 

Mr Carney made it clear that:

  • boards need to improve their understanding of this risk - there are processes being shared to help with this such as scenario analysis
  • boards need to understand the opportunities, not just the risk. An attendee pointed out that as a minimum, in the UK there is one trillion pounds of investment money waiting for climate agenda initiatives
  • there is a need for organisations to have a strategy, a plan and clarity on responsibilities as they will be asked to report in 2021
  • organisations that are prominent now, making the most difference have a very clear senior executive sponsor and potentially a board sponsor as well, demonstrating commitment.

Basically, if it is a risk, have organisations identified climate change as a risk and are the audit committees aware of it and participating in some discussion? We need to understand, have they got an action plan to deal with it – is it in sufficient detail and is progress being made? Who has been allocated what responsibility? What's the measurement process – basically a process that can be audited.

4. What value can internal audit add?

Internal audit can help with the climate change agenda by saying, have you thought about it, what are you doing about it, what is the approach?

The Institute can add context and help in terms of technical guidance, some of which is already on the website. There have been articles in the Audit & Risk magazine, and we will continue to publish further articles. In addition, for those participating in this forum and other heads of internal audit one of the ways we can do this is to speak more as a group. 


Participant invited to share their thoughts

We have a climate change strategy, but I don't have a feel on how much detail is in the strategy, i.e. how well defined are the targets, the actions around all of this. A concern now is that with the funding challenges due to COVID-19, especially in the public sector, some of the ambitions that the organisation has around climate initiatives are going to be thwarted. Will it be seen as a nice to do rather than an absolute must do? 

Chair's comments

Most local authorities now have targets in place that affect every one of us in some respects and certainly affect the organisations we work for. I am aware of some organisations, that are not aware of the local targets and the contribution they are expected to make to achieve it.


Participant invited to share their thoughts

We declared a climate change emergency in January 2020. There is a plan in place under key themes, such as protecting parks and green spaces, emissions from the fleet of council vehicles, reducing energy and water use, reducing emissions from waste, and changing people's behaviour.

It also involves working with partners on a regional, and national level and sometimes an international level. I would imagine it is going to have an impact on people who want to do business with the council in the future from a procurement decisions perspective. I can see there being some criteria built into our procurement decisions around the climate change agenda, like what happened a few years ago when we introduced the social value concept within our contracts. I think that for private sector businesses trying to trade with councils, it will need to be something that is thought about in any procurement decisions. 

Chair's comments

Climate change has to be a cultural approach. A top down initiative sponsored by senior executives setting a standard and a strategy. I think that climate is a subject that needs to be tackled in this way in every organisation.

 

Institute's comments

Provided an example in the farming industry of initiatives to reduce methane gas emission as well as things we can do on our own worlds such as switching lights off. Each and every one of us can make a small difference. We all have a duty and a responsibility to do our bit to make a difference to climate change as well as auditing it in our organisations.

 

Chair's comments

We will be coming back to disruption and are keen to get volunteers from this group and from elsewhere. If you are interested in helping the disruption agenda, please get involved.

On the climate agenda we have only briefly touched on it today, but we will return to this subject.

Next week will be a question time session where we will answer any question you or one of your team have in relation to the Institute and its activities. If you wish, you can submit your questions in advance to Liz Sandwith (liz.sandwith@iia.org.uk) or Derek Jamieson (derek.jamieson@iia.org.uk).

All attendees from this and previous forums will receive an invitation for next week’s session. If you wish to delegate attendance to a member of your team or add them to the invitation in order to allow them to ask a question, please do so.

The Institute wants to provide as many opportunities as possible to share, as it is only through doing so that we really engage and help shape the future of internal audit.

29th July 2020 sees the inaugural meeting of a new local government forum. This has arisen as a result of this forum and a demand for a more specific forum. If you have more ideas and suggestions for forums and ways of communicating let us know.

5th August 2020 sees the start our new season of forums. Last week we undertook a poll on topics that are most important to you for the Institute’s agenda. The one with the highest number of votes was ‘build back better’ i.e. effectively how do we build audit for the future. For the Institute it is about how we help shape the future of internal audit.

Finally, as today’s session draws to a close, I would like to thank you all for attending and for contributing to our discussion.


Chat box comments from attendees

It all starts with strategy - the organisation should be able to recognise and catalogue its strengths. Being able to logically map the markets these strengths can be a valid advantage. Both processes are auditable.

  • Absolutely agree. Do we all audit strategy development and the grounding of the strategy in the operational business?
  • We should – not everyone dares.
    Agree with this.
  • Agree with the above. The strategy must be externally focused though and see the customer mega trends rather than be additive and incremental to prior strategies.
  • There are two types indeed - purpose driven and opportunistic - both types are valid.

It is possible (and we did it) to audit climate change within the overall company CSR context.

  • We are starting with an audit of climate change strategy this year - or lack of?
  • It will be become more frequent that companies will find themselves needing to take a position on non-business-related issues (climate change, freedom of speech, racism, etc.). All of these positions and external commitments need to come into the internal audit plan to make sure that management have developed processes to actually do what they said they would do.
  • Very positive and I was asked by the audit committee chair when we would be looking at climate change.
  • Organisations’ progress on climate change risk does increasingly seem to be a differentiator.
  • I believe it would be positively received - climate change is a strategic risk since earlier this year.
  • The key driver will be shareholder investment strategies in seeking companies with a wider societal purpose - profit with a purpose. There is also regulatory pressure on market disclosure ...
  • It needs a senior leader to sponsor and own the organisation wide response.
  • A number of local authorities have declared a climate change emergency and have put plans in place.

Is there an argument for environment/climate change being considered as a part of audits in other areas - in the same way as for example with culture? Some organisations will do an explicit audit specifically on culture and others will have a culture strand/scope area in every audit they do over the course of the audit plan.

  • Agree, something we will pick up on in future sessions.
  • Yes, it is quite interesting where climate change can surface - I see it playing more and more prominence in sales/tendering audits and procurement audits... so it will be a fallacy to consider climate change as a separate area.

We plan to audit the corporate risk mitigation plan. This has the support of our senior executive for resilience.