Diligent One Platform World tour ad April 2024

Forgotten password?

Heads of Internal Audit Virtual Forum

3 June 2020

Please note:

All Institute responses are boxed and highlighted blue.
Where the Chair comments in that capacity the box is highlighted yellow.
Where the President comments in that capacity the box is highlighted heather.
All delegate/attendee comments/statements/replies are un-highlighted and un-boxed.
For confidentiality, the identities of all delegates/attendees are anonymised.

Chat box comments

Love the "how do we bottle this" sentiment!

I actually wrote that down!

A good point around internal audit having a role to flag lack of second line - I think data analytics is interesting in that respect as sometimes there is a view that internal audit should be the ones doing a range of data analytics on procurements, expenses, etc. We are trying to get to a message of "we have done these analytics as part of this review, but this should be ongoing analytics as part of second line going forward rather than an infrequent audit activity".

I agree with you completely. I wonder whether some of us may try to hold on to the "analytics" stuff because of the old "knowledge is power" thinking? We can use it for sure, but so should the second line.

I think both guest panellists make the point perfectly that we add (and create) value by understanding our organisations and their business!

There are so many opportunities out there - and it should be much more fun too.

I agree with you.

It's difficult in many organisations to consider the delivery of strategy in line with the purpose of the audit where many organisations are hampered by a "maximising shareholder wealth" approach to purpose.

On the training point, for charities very aware that some internal audit functions already have zero training budget. The Charities Internal Audit Network (CIAN) do provide a small number of heavily subsidised training courses (including a couple of free places per course), along with free quarterly network meetings with professional development sessions for this reason - www.cian.org.uk for any charities interested.

Attendee comments, questions, and actions

Chair's comments

We continue to look to the future and the role internal audit should play as we move forward.

Today, our guest panellists will be sharing some of their recent experiences, how they are responding and how this is influencing their thinking for the future. They will be reflecting on the following questions and drawing out experiences which they feel are the most relevant to share today:

The skills and attributes which help internal auditors stand out now, are potentially a minimum expectation going forward. Would you agree, and if so, what would you define as the future minimum?
Many audit teams have revised elements of the audit process in order to make them work effectively during a time of crisis. While some of these changes may prove to be short term, what have you changed that you think will remain as business as usual (BAU) going forward?
For most, if not all organisations, cost will be a significant area of focus going forward. While internal audit has often audited processes or initiatives which are designed to reduce or eliminate costs, to what extent do you think internal audit needs to enhance its commercial awareness and focus on strategic and BAU management of costs beyond budgeting or cost reduction initiatives?
Do you see the focus of the internal audit plan changing going forward, and to what extent is this likely to take you into a different engagement model with the organisation e.g. higher level audits, greater focus on governance, increased participation in key committees?
Given the probability that training budgets will be tighter in future, how do you envisage the training and development of your team will change?
To what extent has the engagement with and expectations of the audit committee changed during the crisis and how do you see this evolving going forward?

In sharing their thoughts, the two panellists may well answer most of these questions. If not, we can carry forward the unanswered questions to future meetings.

Guest panellist 1

I think it is fair to say that three months into what is a very strange period of time, we've been doing a bit of reflecting and it's clear that if you look at what we, within the internal audit function are doing, there have been changes in working patterns, in our operating rhythm, and actually when you look at what we've done, it has had substantially positive outcomes in terms of both our staff and stakeholders.

Some of those things we have gone through are as follows:

If at the end of last year we were in the position that we are now, then I think we would have been struck by the productivity of it all. To think that in recent months we've embraced flexibility, embedded agile fully, and dialled up our communications with our staff, is a positive thought.
Not only have we done that, but we have now revised our quarter two plan in a matter of weeks, replacing everything that we thought we were going to do with things that were far more important to the issue of the day.

We've now moved to providing consolidated reports for all of our stakeholders that go to them at their weekly executive committee meetings outlining our concerns, that are yet to be verified, in order to ensure that the most senior people get sight of the report and then can begin to determine what action is necessary.

When providing real time identification of issues, management are immediately fixing them prior to audit finalisation, which is something that we had not seen before. So, for me the strategic question as I sit here having seen all this is, is: how do we ‘bottle’ all this positive intent and make it part of our future ‘business as usual’ (BAU)?

In going through this in quite a thoughtful manner, we’re undertaking a very specific exercise to try and determine what it is we would need to do to actually undertake that ‘bottling’ and retaining some of those positive practices. We're going out interviewing fifty of our staff and fifty stakeholders to determine what they believe the key things and root causes have been that have really made the difference during the last three months. Then we will seek to determine what it is we need to do to effectively to embed the positive practices into our new BAU.

We believe that as a result, we may well have to change our methodology and expect very different working patterns. I think we're also going to think quite carefully about what we do with our graduate intake. Overall, we are saying there are no sacred cows. You know, if you think about the context in which we are operating, I think it is imperative that we do this because the world has changed. There are more risks around which increases the demand for our audit work.

The economic environment is definitely creating additional pressure on the enterprise and therefore on costs, so the audit function in 2021 will need to be one which is more relevant, more timely, more efficient in its delivery and we believe that ‘bottling it’ should give us a head start in that process.

Before I end, there is one thing that struck me as I thought about this: the last financial crisis saw the internal audit profession undergo a step change in it is standing and expectations. I believe it is possible, we can use the experience of COVID-19 to advance the profession even further.

Chair's comments

Just picking up on one of the questions - you are talking very much about flash reporting, and getting the messages out as soon as possible to your clients. How has that been received? I would imagine that it would have been positive, but have you had some challenges with the acceptance of flash reporting?

Guest panellist 1

Very specifically in all of the financial institutions there are quite significant changes both in terms of products and processes. All of that work is being reported back to the individual executive committee meetings, (commercial or retail) overall it is being well received. What is interesting is that the guys at the very top i.e. the CEOs of the business actually see real value in it. They actually told somebody who was beginning to have an argument, that this wasn’t the time or the place, this was just airing potential things that need to be looked at in order that we can mitigate the very real problem. It’s fair to say that in all of the work we're doing, we’re finding things that management are going to have to deal with. It's partly down to the speed at which the organisation has had to move, so it's not really that surprising.

Chair comments

Just reflecting - when you try and speed up the reporting process you tend to get a bit of a reaction from middle management which resonates quite often with most of us. You often spend a lot of time trying to get draft reports through the chain of command, so a personal view is: the more we can do in that space the better. I think from the institute's perspective, we would be very encouraging of any audit function who could find a quicker way of getting messages out - gone are the days when there is a six-month delay between first draft and final issue.

Institute's response

I absolutely agree and I love guest panellist 1’s "bottling" metaphor, I thought that was really good and something that I think that we should share with our members and something to take on board. For me bottling is about preserving what we've learnt, and what we've gathered over a period of time, and building on it for the future - that's very much what the Institute is talking about at the moment.

I'm becoming quite nervous, however, because I'm hearing some heads of audit saying, ‘can't wait to get back to where we were in February and get on with things’. That's not the message we should be promoting because as guest panellist 1 has said, in 2021 we need to be more relevant, more timely, and more efficient. We will have our "bottled" products which we will build upon. Great message, thank you.

Chair's comments

I’m going to pick on the second question for now, where you talked about the focus of the plan, etc. Do you have a view to share on budgets for training and the ability to actually train people to the extent that you have over the previous years?

Guest panellist 1

We’re going through the quite difficult process of trying to work out requirements. We are also completely redoing quarter two. Somehow I feel as though, as I said, there’s going to be a need for us to do more work.

I also have responsibility for the credit quality assurance and it's clear that the amount of reviews that we will have to do in that space will probably double, if not triple so that is going to be a lot of difficult conversations. In my view the amount we spend on training is more of a rounding compared to some of the other challenges that I think we will have.

For me, as we go through this whole process, we have seen a greater use of digitised products. The ability for our auditors to move from more manual processes to more digital processes is something that's going to be with us forever and we've got to help our people go down that path. My view is that there is a bit around re-skilling. If institutions get the digitalisation bit right, over time as more things are automated, then audit should actually cost less. Then you're dealing with effectively looking at what computers do rather than what humans do and they tend to get it right repeatedly as opposed to humans who don’t.

Chair's comments

I’m going to come back to that subject over future weeks. I think as a profession we have a challenge.

You'll see a poll just appeared on your screen, we are interested in capturing a quick answer. If you are happy to do so, just to get a feel for the impact the organisations budgeting processes has on internal audit training budgets. We will come back to the answer later-on.

It is helpful to us and I think it is helpful that we can all reflect what we are seeing across the board.

Guest panellist 2 - could you just reflect on life, the universe, and the lack of any change you’ve had at all over the last few months? Nothing’s happened for you has it?

Guest panellist 2

I'm afraid I have a starter for 12, so you might actually need to use your guillotine powers to shut me up. So, thank you for the opportunity. I think most learning for me will come from the questions in the comments that follows, so please do ask difficult questions.

In terms of the overall change in the sector, and before I get into some of those topics, let me offer you some context on us as a business. We are international NGO (Non-Governmental Organisation), and hopefully a household name, but if not, I will very happily have a virtual coffee with anyone of you to talk about our fantastic work. We are in about 120 countries and this is a combination of actual presence on site and in the remainder, we’re working with partners.

Last year, we responded to 108 emergencies globally. I suppose it's safe to say that when a global pandemic hit us a lot of the stuff that we were thinking about in terms of risks last year materialised. Such as the rise of nationalism, the impact that it has on global aid, civil unrest that really has been going on in many parts of the world over the last several years, the pressure on ODA (overseas development assistance), and slowdown in economic growth - all of which have exponentially exacerbated for us now. This really is a radically transformed world; your comment about nothing really having changed for us really does hit us right in the heart.

But in terms of the changes to the plan, it's really interesting. This is hot off the press - we had another audit and risk committee and board meeting yesterday and we gained approval for our revised plan. We gave some of our views on some of the other lines of defence. There was one of those really charged discussions that you normally have between management and internal audit. To the organisation's credit, the crisis has sort of brought to the fore the importance internal audit and control work.

I actually have to applaud both our audit and risk committee and our board for asking the management teams to think about this in more well-rounded terms. The outcome of that is that COVID-19 has turbo-charged our focus on questions of strategy and governance. Just to give you a quick overview, in 2015 when I first started at this organisation, our work was very compliance focused. It was largely limited to our country office programmes etc. over the last three or four years we had been building the mood music if you will, to walk away from some of these sort of operational areas of audit, we have been bolstering discussion around the three lines of defence.

We had put a lot of articulated focus on triangulation of management information and the quality of management oversight and through our root cause analysis demonstrating that we can't just be doing country office programmes of work ad nauseam. We actually need to be looking at some of the root causes in headquarters or in some of our global systems and processes, we have been sort of shifting that mood music and I guess that appealed to the board.

Last year, we walked away with some fairly phenomenal successes, i.e. that we move the scope away to quite deep cross organisational reviews and by cross organisational, I mean looking at these reviews all the way from our field office operation somewhere out in western Africa all the way up to headquarters in London. These cross organisational reviews were inextricably interlinked to our strategy.

We have a strategy house - which is like a fancy diagram - on which you outline what you're trying to achieve to 2021. Let's actually figure out two deep dives on a couple of these critical questions. The two top topics we picked - and this is the second success - is that in the cross organisational reviews, we were looking at programme quality and impact, where most humanitarian and development professionals go, what does audit know about programme delivery of an education programme in Nigeria. The second audit was on leadership and culture, which in many ways is now giving us real insight into our risk and safeguarding culture and the agency in a really heightened time of risk.

The third success was moving our focus. We were looking at humanitarian responses rather than looking at a programme for an operational area on how a humanitarian response spends its money. Traditional areas like financial control and talent management and we really changed the focus to say how does the agency set up the right governance structures to actually mount a sensible good quality programme for one million refugees. So, really changing this focus to strategy and governance has helped us because now as we go into COVID-19 it's almost as if these questions of strategy, culture and governance are not deemed to be ‘not kosher’ and that is helping us.

I'm happy to press pause there. I have a couple of examples of how this is working in practice for us with the COVID-19 crisis but I'm happy to pick them up as part of responses to questions or will continue to run with them.

Chair's comments

You’ve given an example there which I think is absolutely vital just now.

It’s changing the focus to the strategy of the organisation, really locking on to that and understanding where we’re going and what we’re trying to achieve within that. It may be 180 degrees different to what it was six months ago because the world has changed, but it still has to be locked onto and you also talked about governance because without the governance you don't necessarily achieve the strategy.

So again, a separate topic (the strategy of the organisation), but one as an Institute we will continue to push quite hard over the coming months. To me it is absolutely fundamental that we get this right.

You gave an example when we spoke last week, you talked about refugee camps if you remember and I was wondering if you could give that as a real life example of what's been happening recently?

Guest panellist 2

I will give two very quick ones: one on strategy, and other about governance around these critical questions. On strategy, it's crystal clear that all of the sustainable development goals that we were thinking we're going to achieve by 2030 COVID-19 has set the clock back on a majority of these by at least seven or ten years. This is just the first wave so from a strategic perspective thinking about the needs in the communities, these are now going to be trebled, quadrupled so doing this sort of standard programming work, that we have done for decades is not going to fly.

In strategic terms, where is the focus on our advocacy efforts to be able to get governments to think about some of these questions in partnership, rather than agencies like ours simply responding to the crisis? It is a very salient question of strategy and I think a perfectly kosher question to ask. I mean on refugee camps I think interplay, and this is in one of your questions, was the interplay with other business units.

Further description was provided here around second lines of defence, risk appetite and decision making.

Chair's comments

To me, that relates back to the sixth question: to what extent has the engagement with and the expectations of the audit committee changed at the present time enabling challenging conversations with the audit committee?

The topic of second lines of defence and internal audit’s engagement with the second line, both to assess it, comment on the effectiveness, and where appropriate to help the overall three lines of defence model work effectively is key.

For the audience here, and this might resonate with most of you, sometimes internal audit doesn’t necessarily say the second line is not effectively doing the job. Sometimes the second line of defence will step back and allow internal audit to do that work for them. We need to help the three lines of defence model to work the way it is articulated in that organisation.

Guest panellist 1 - there is a tie back here to the banking system. We’ve had the FS Code for a number of years now and the benefit of the FS Code. You talked about a step forward following the last crisis, can you reflect just on the three lines of defence model and the effect the FS Code actually had on enhancing the workings of the model?

Guest panellist 1

I think the biggest thing that the FS Code did around how we operate was simply too ensure that the audit function had a seat at the top table and that effectively then led to a whole series of other changes. Because if you're sitting at the bank's executive management meeting, you're going to be having conversations with the CEO and it changes the whole dynamic and expectation. I think that was probably the biggest change and it didn't necessarily happen overnight. In my case it was about two years later when there was a change of CEO, that's when effectively the change was implemented, but I think that singularly was the catalyst for a lot of the other change.

Chair's comments

Guest panellist 2 – did you have a second example that you wanted to share?

Guest panellist 2

I did - I think the other one was on this question of strategy and what we might do with our advocacy effort as opposed to just programmes.

Countries are under lockdown. There are different phases of lockdown, but how do we deliver our programmes? That is a fair question because spending money in our programmes is a way in which we will get more institutional money in to be able to service the needs.

It is crystal clear today we don't have to spend three years of this crisis to know that actually we're never going to be able to meet the needs.

We could join forces with really big agencies and still not meet the needs. Actually, as an organisation, if it is the case that we have under invested and I don't have an exam answer to that, but it is a question to ask, if we have under invested in our advocacy effort, which is the way in which you get governments to pledge the change, as opposed to just making the transition yourself, that is a strategy question we must absolutely ask.

As opposed to organisations asking it, I think they're just surprised that internal audit is asking the same question. I do think that moves the story along the picture because our advocacy colleagues have been absolutely wildly enthused about the idea that actually this is an area internal audit even remotely has an interest in.

The last time I spoke to our advocacy lead, which was in July 2019, we didn't have to come to this conversation cold, she thought that we looked at supply chain and warehouses. That is just part of the reflection of how many of the business units do we really reach out to in these unconventional ways and can we still have a candid inclusive dialogue with them. Once you have that. I think it does engender a different class of conversation which I just absolutely learnt from. I have learnt more in the last six months of just having these quirky sets of conversations on programme quality and what we do on humanitarian delivery and advocacy than I have in several years of my internal audit career.

Institute's response

What I'm hearing resonates. From an internal perspective, looking at the strategy is something that a lot of internal audit functions don't believe is a topic that they can consider. The strategy is the remit of the board, therefore the view often is that as internal audit we just accept it.

I’m enjoying what guest panellist 2 is saying around challenging some of the things that the organisation is doing in terms of - is the strategy delivering the purpose? I don't think, as internal audit, we consider the purpose of the organisation enough. We need to be very clear what the purpose of the organisation is and make sure that the strategy delivers the purpose of the organisation.

It's important, and I know it's a cliché but internal audit needs to speak truth to power, which is exactly what guest panellist 2 sounds as though he has been doing in terms of his audit committee and his board but you can't do that until and unless as guest panellist 1 says, you get a seat at the top table.

We have to make sure as we move forward that the examples that have been shared today from our panellists, are communicated to our members to give them the courage to speak ‘truth’ to ask questions as to whether the strategy, the business model and the purpose of the organisation are truly aligned and whether internal audit are doing what we purport to do rather than wandering about in the dark thinking we're doing all the right things.

It is great to hear these things today.

President's response

I also think that not only is this a much more interesting way of doing internal auditing than what we were doing before, but actually it's a lot more fun. We can really get into how our organisations are functioning and hopefully in terms of attracting good new people into the team this should present a lot of advantages and opportunities for us.

I certainly say again - this is definitely exactly the direction in which we want to go in and I think it's a sign of a dynamic profession which is great from our perspective as the Institute as well.

Results from the earlier poll

Has your training and development budget for 2020/21 been impacted as a result of the impact of COVID-19 on the organisation?	%
No review has been undertaken	38
Review undertaken and current planned budget remains	31
Budget cut of 1 – 20%	17
Budget cut of 21 – 50%	7
Budget cut of 51 – 75%	0
Budget cut of 76 – 100%	7

Chair's comments

You’ll see the results above, that it is interesting to see that a majority of people haven't had their budget touched as yet but we do have some significant changes.

You may know that there was an event last week involving Galvanise and ourselves, we collated data from that event and we’re collating data from elsewhere.

We intend to give you all a summary of what we have picked up over the last couple weeks and give you a much better perspective of the impact.

Just a reminder, for those of you who haven't seen it or have seen it but haven't responded yet, there is an Institute COVID-19 survey currently out. If you have received a request to complete the survey and haven't responded yet, please do, the survey closes on Friday, 5^th June. We have had a couple of hundred responses already, but we would like a few more and the more responses the heavier the message.

I would just like to start summarising as I do want to tell you about what’s coming. I said at the beginning we want to start and focus more on the future and not quite so much about how COVID-19 has impacted internal audit, it is more about what are we going to do about it.

When guest panellist 1 used the phrase ‘bottling it’, last week when I spoke to him I said it’s a great phrase please use it today, so it's interesting to see that it has resonated with a few of you as well.

I think we need to find some ‘strapline’ phrases to hang onto as we go forward because there are some key initiatives, that we, as a profession, have to take forward.

Particularly, how do we make reporting dynamic and exceptionally valuable to management and something they constantly seek out? How do we make our assessment of governance more relevant not just ticking to say ‘yes’ it’s got a committee and ‘yes’ it sees papers, but this is the quality of what's going on?

How do we have the difficult discussions, the confidence and competence to have the difficult discussions with key players? Guest panellist 2 - you are clearly in a space where you are having to, can I say, be a bit cheeky with people, saying are you sure you know what you're doing? But that applies to us all at some point having the confidence and the competence to say to somebody: "Are you really sure, I would actually like to challenge you against what you have said in your strategy, your purpose, etc."

I think we've also got something to talk about going forward regarding training. You got that poll, but I have a bit of a bubbling concern on behalf of the profession that we have a commitment to all our team to train them as best we can. If the budget does go down and the workload does go up, how do we deliver that commitment? Does it have to become a different sort of discussion within teams regarding how we fund it and where we get the training from? So, I think we will come back to that, because that potentially is a bubbling concern for us going forward.

I am now going to start talking about the future. We said that we would try and get an audit committee chair onto the floor with us in the future. We have one coming in the next couple of weeks. I also suggested trying get a CRO (Chief Risk Officer) to come along, we have a CRO coming along in the next few weeks as well. In addition, we will also have a firm joining us to talk about what ‘does the audit committee want’.

Again, the focus will be very much on the future rather than the past because I think we want to start getting some pace into this, but if it's not what you want please let us know.

Like anything else to do with this forum it evolves based on what people want not just what we want to talk about.

Participant invited to share their thoughts

I'm attending on behalf of the Midlands committee. It’s the first time I've been to one of these so it's really useful to be able to come along. I think I'm fairly new to this but not new to audit itself, but a new CIA, I qualified last year, and I suppose it it's probably a question for the Institute and perhaps even more globally really. I felt a little bit like I had to unlearn some of the things that I've done in order to pass the CIA so talking about what guest panellist 2 was saying earlier around doing ‘quirky sets of audits’. A lot of that probably is how we operate now in a BAU environment. I'd be interested to know what our approach is, to make sure that our training catches up for our new entrants, because I think as everyone has said on here, this has the potential to be really exciting for us. I think we should figure out how to capture that through some of the training that we do as well. I would be interested to get your thoughts, especially as I think you were alluding to something similar.

Chair's comments

Our training is predominantly focused on how to get the nuts and bolts done - you have to understand the nuts and bolts. Our Standards aren’t changing. The IPPF is not changing. It is more about how we approach executing the work that we do and I do think there is opportunity and a need to get into a better discussion about how to be more agile in the execution of our work I’m not just talking about the agile methodology, I’m talking about the mentality and the understanding of the business and how you actually get to the end product quicker.

Institute's response

I would say that the CIA exams are very much about building the foundations. I look at them like the Highway Code: when you are learning to drive, you need to know and understand the general principles that you will then build on, but the way you drive once you passed your test will not be. I’m certain the same as it says in the Highway Code, I think that's true of internal audit, we pass our exams, they are the foundation on which we build and it's important that we know and understand what those foundations are, so we know if we're deviating from them and we then can understand and think why.

What the Institute is doing in relation to its training is trying, with new training courses, and we've got some great new training courses coming down the track, is to then build on the practical side of things that you need to know and understand exactly as previously said, how you can audit using a lean methodology, all of the things that equip you with the practical knowledge you need to deliver the high quality audits that our guest panellists have just been talking about.

Participant invited to share their thoughts

Thanks, that does help. It's just that the training question prompted me to think about where I put my resources. Do I put my resources in training individuals in the courses that has just been described to things like how we can be leaner, more agile? Or how we can deliver difficult messages or do I put them into professionalising the individuals that I'm working with? It's just at times like this, when budgets are pressed, I'm trying to make the right decision for the people who I'm working with. My head says to me that actually what will help them longer term is CIA but the heart suggests that actually all the courses the Chartered IIA are going to run are going to be far more valuable for them. I think if there's anything we can do to help bridge that gap then then that's a good thing really. It does really help and of course I have spoken to the Institute on a number of occasions. I really appreciate the work the Institute does on this to bring it to life.

Chair's comments

We are always happy to speak outside this forum as well, so happy to pick up with you again.

Just to advise you of one thing - over the last three or four working days I have spoken with a number of heads of internal audit and four times in that period the persons I have spoken to have volunteered the view that they are passionate about internal audit, something I love to hear, I have the same view on things.

I would like to go forward and try and see if we can get that passion across the group here because I genuinely believe, going back to guest panellist 1’s point at the beginning, this is another moment in time for the profession to step up and we have to do it and do it with a level of commitment and passion.

Finally, as today’s session draws to a close, I would like to thank you all for attending and for contributing to our discussion and a special thanks to our two guest panellists.

We are very keen to get your feedback about this forum, in terms of both format and content. This will be invaluable for shaping future meetings and making sure they meet your needs. So please do share any thoughts with Liz Sandwith (liz.sandwith@iia.org.uk) or Derek Jamieson (derek.jamieson@iia.org.uk).

And of course, we will happily take further questions outside this forum as part of our ongoing approach to the COVID-19 crisis – so please do get in touch if there is anything else, we should be looking at!