Heads of Internal Audit Virtual Forum

8 July 2020

Please note:

• All Institute responses are boxed and highlighted blue
• Where the chair comments in that capacity this box is highlighted in yellow
• For confidentiality, the identities of all delegates/attendees are anonymised 

This week we wrapped up on the last 15 weeks sessions, gathering some key thoughts to begin to shape the future for internal audit in key areas. As part of this process a poll was undertaken to obtain views on the agenda going forward, the results of the poll are below.

Next week will be a special session on climate change. This will be followed on 22nd July 2020 with an open house session for participants to ask questions. An email will be circulated about this. The 29th July 2020 sees the inaugural meeting of a new local government forum. We have received tremendous interest in the forum already and invitations will be issued in due course.

Today we reflect on key lessons learnt from the forum’s in previous weeks, capturing some key points. In the first week we captured what we believed were the ten guiding principles for how to deal with the crisis as an internal audit function, these were:

1. Remember your role
2. Take the audit committee chair with you
3. Prioritise
4. Keep your head up
5. Be agile
6. Be a trusted adviser
7. Communicate
8. Keep a diary
9. Lead others
10. Use the IPPF as a reference point

Further information on these key messages can be found on the COVID-19 Hub here is the COVID-19 hub.

Key messages 

Poll results on future subjects

Reflections from participants

Velocity and alignment of agility: the mindset of the auditors should consider, is there anything more important compared to what I am doing now and do that. There should be 100% visibility of what the business does, and the alignment should follow.

Agility is clearly up there, not just agility of the plan but also the agility of how we execute audits. The leveraging data more and different audit offerings, such as advisory and design adequacy as opposed to operating effectiveness and having that lens has been helpful. The ability of what to focus on, what is important look back to the strategy and inherent risk profile. That ability to re-prioritise comes into the agile mindset but the learning is to continually focus on what is important otherwise our scarce resources are not used to their best effect.

One of the journeys is trying to educate the audit committee that have been used to an annual audit plan and traditional targets about actual delivery, that there is a need to change  mindset from traditional waterfall auditing to agile auditing that is key. Short but sharper focused audits, getting that message out quicker about the key risks and how we are managing them.

Root cause, I don’t think we see enough root cause, the recommendations are at too low a level. Guidance from the Chartered IIA for the audit committee saying that the agile approach is acceptable, something on that would be quite helpful.

The first is to recognise that the first line of defence is the most important line of defence not the third line of defence, particularly where everything is virtual, and you are working from home. Team ethics in a global organisation is also making sure that we are paying attention to the people – team leaders speaking to their team, checking how they are and supporting them. This has been seen across the company as helping operational performance, a real attention to people in managing risks. The third thing is creating the space to recognise that we are not going to be perfect and actually one of the secrets of being agile is to accept that it is ok to fail but to do that failing safely and move forward.

What I have really appreciated over the last sixteen weeks is exactly this type of interaction. It has been absolutely fantastic and I think the Institute has brought everyone together and made it a really good sounding board for everyone to be able to talk and discuss things - exactly the response that was needed. It is not so much what do you do, but how do you do it, and to what extent. A lot of the guidance gives you the basis but, it is the extent to which you go to, how do you influence your audit committee chair? So more guidance on the extent to which you do things, how good is good, how do we influence our stakeholders, how do we persuade our audit committee chairs to engage with us more, that sort of practical help and guidance.

Root cause - It is interesting, especially in reporting, how often auditees, as much as anything else, wish to focus on specific instances rather than drilling down into why something happened, putting a sticking plaster over it, the issue remains which then causes other issues. Over the last 2 years we have spent an awful lot of time trying to focus our reporting more on themes and root causes. The impact has been huge, really getting into some very meaty issues. These have not always been easy to solve and it means that we sometimes end up with actions that are very long tailed, but it stops you ending up with recurring problems. It comes back to internal audits role not being a tick box approach but much deeper than that. We want to get to the root cause of problems and help the organisation as a whole. 

Chat box comments from attendees

In response to the key messages taken from previous weeks by the Institute

Wise words 

Fantastic and very much agree 

With change comes opportunity. Our working ways and business interactions will inevitably be more flexible for the foreseeable future. 

I agree, that's why it is tragic to hear that some of the heads of internal audit want to go back to old ways. 

• Agree with the comment above - very well said. 

In response to the Chair’s comments on engagement

I agree with the need for more engagement with members, I would add that we all have a responsibility to help raise the profession and profile of internal audit with the Institute and not to expect a silver bullet to come our way.

In response to the Institutes initiative on audit committees

We are adopting agile but what would be really good is some formal guidance for the audit committee about agile and how our professional body supports such an approach. Sometimes audit committees are so used to the traditional waterfall approach that it is what they expect. I know that as head of internal audit we have to deliver some training to get them onside, but any help would be great.

In response to polling for future meetings

Just putting in my 'actual' formal vote for leadership and culture as top priority.

Not as exciting, is/will UK SOX be on the agenda at some point?

Apologies to press this a bit, you mentioned 'culture' as one of the top risks in your list, and that it was inadvertently missed from the survey. Is there an intention to circle back to that at some point? Not least because the literature on "culture eats strategy for breakfast" is vast, it is evidence-based, and it makes for unnerving reading.

Would be really interested in some focus on culture too please. 

In response to reflections from participants

Agree we should be able to adopt more flexibility to audit planning but agree audit committees are wedded to a 12-month plan - this is really not appropriate in an ever changing environment - how can we bring audit committees on the journey?

• It is not just the audit committees that we need to persuade to let us be agile/flexible, but also regulators and 'interested bodies'. Perhaps the Institute could have a role in educating them?
• As a committee chair myself, I pleaded to move away from the annual plan with immediate effect.
• Flexibility of audit plans should be achievable at least via regular formal refresh. Regular communication with stakeholders and audit committees should be the key process to ensure refreshes are relevant and as frequent as required.

Can we make it fail forward better?

Very good point that root cause needs to be central to internal audit. It has been said before in this forum I think, but it is important to distinguish between agile and agility. I think there is sometimes a bit too much focus on the buzzwords and specific practices associated with the agile methodology without enough focus on the principle of being flexible and adapting approach. The focus on agile as a methodology and people using this as a synonym for agility in internal audit can be off-putting for small audit teams where the methodology itself is difficult to implement meaningfully.

• I agree with your point about distinguishing between agility and agile.

Has anyone used causal reasoning versus defensive reasoning in their root cause analysis?

These sessions have been fantastic. The Chartered IIA’s response to our new ways of working have been of great support to myself, team, and the wider organisation that I share the information with.

In response to the Institute’s work on building a picture of what internal audit is going to look like in 2025

Would be interesting to see how that picture is aligned with our audit strategies - sounds very interesting.

Further reading

The following guidance is only available if you are a member of the Chartered IIA:

Guidance - Root cause analysis

Articles and reports on agile internal auditing

Global Insights

Agile internal audit - Leading practices on the journey to becoming agile

Agility and innovation