Heads of Internal Audit Virtual Forum

8 July 2020

Please note:

  • All Institute responses are boxed and highlighted blue
  • Where the chair comments in that capacity this box is highlighted in yellow
  • For confidentiality, the identities of all delegates/attendees are anonymised 

This week we wrapped up on the last 15 weeks sessions, gathering some key thoughts to begin to shape the future for internal audit in key areas. As part of this process a poll was undertaken to obtain views on the agenda going forward, the results of the poll are below.

Next week will be a special session on climate change. This will be followed on 22nd July 2020 with an open house session for participants to ask questions. An email will be circulated about this. The 29th July 2020 sees the inaugural meeting of a new local government forum. We have received tremendous interest in the forum already and invitations will be issued in due course.

Today we reflect on key lessons learnt from the forum’s in previous weeks, capturing some key points. In the first week we captured what we believed were the ten guiding principles for how to deal with the crisis as an internal audit function, these were:

  1. Remember your role
  2. Take the audit committee chair with you
  3. Prioritise
  4. Keep your head up
  5. Be agile
  6. Be a trusted adviser
  7. Communicate
  8. Keep a diary
  9. Lead others
  10. Use the IPPF as a reference point

Further information on these key messages can be found on the COVID-19 Hub here is the COVID-19 hub.

Key messages 

Institute's response

Key messages taken from previous weeks reinforced with conversations with heads of internal audit over the last sixteen weeks include:

  • being agile of mind
  • being flexible in the way we work
  • recognising that we have challenges, all of us, in different ways: at work, in the home environment, helping our children with home schooling, perhaps looking after elderly relatives who are shielding.

It is about how we can manage to balance priorities without compromising the quality of the internal audit product.

As demonstrated in our forum meeting last week, the relationship between the chair of the audit committee and the head of internal audit is key. The Institute has undertaken a COVID-19 survey, the results of which will be shared shortly, has highlighted some interesting data in relation to the audit committee and the head of internal audit meetings. Perhaps, if there haven’t been regular/frequent meetings opportunities have been missed in terms of building a strong relationship with the chair of the audit committee?

We need to reflect on what we are all and individually going to keep as you move forward? What is it that you have learnt that you do not need to do any more and perhaps should not have been doing, or challenging yourself as to why am I doing this?

Resetting the risk agenda

Working more closely with our risk colleagues and looking jointly at what the risks are that the organisation is hoping to focus on. Are they the key risks moving forward? Are they the risks that will form part of your programme of work for the second half of this year? Are we all on the same page regarding what the key risks are facing organisations?

‘Bottling’ what we have learnt

This is key as we move forward. COVID-19 has been a game changer for internal audit. So much has been learnt over the last sixteen weeks as a profession, as an Institute, and as heads of internal audit. We must not go back to what we were doing before. We must take forward the best of everything we have learnt and build on that.

The IPPF

The foundation on how we deliver our job, high quality audits, and how we provide the assurance that our key stakeholders are looking for. It is important to remember what is in the IPPF, the Standards, the Core Principles, the Code of Ethics and the Definition and Mission Statement.  We need to make sure we know when we deviate because, over the last sixteen weeks we will have deviated. We have had internal auditors working in first and second line, we have had challenges around our independence and objectivity and conflict of interest. As professionals we have looked at how we might deal with these issues and have learnt some very valuable lessons. As we move through the next six months it may not get any better and we need to factor all these topics into our thinking.

 

Chair's comments

Going back to the principles I don’t think we have an example anywhere of an audit function who hasn’t had to change, quite significantly, through this crisis and this gives us a platform for the future.

The challenge today is: What are you going to do to help shape and take the Institute and the profession forward? The conversation now is going to be about what do you want us to do? What is the priority? How do we take this forward and help each other?

The agile principle is the one I want to apply for us going forward. We can’t tackle everything, but we can prioritise.

Topics we think might be relevant over the next few months for the agenda:

Leadership – leading in the new normal - how do we lead a team? How do we do that better? How do we lead with our key stakeholder – the audit committee and build relationships within the organisation?

Agile – being agile of mind, getting the mindset right and let’s talk about what that really means, capture that and share that as technical guidance. What does agile mean in terms of the process and the approach?

Climate change – what do we want to talk about and how do we want to define our response as an audit profession? It is not a subject that will be going away, and it will rise rapidly over the course of the next few months.

Culture - it has been here for a long time, particularly in the financial services world but it isn’t as grounded as everyone might have hoped and certainly isn’t as visible and grounded in other sectors.

Cyber – one of three major areas of focus for the Institute in coming months.

Data analytics – it has been around for a while but is it really grounded as much as we want? The COVID-19 crisis has spurred us into action on data analytics because of remote working.  

 

Poll results on future subjects

Topics Which subject would you like to see as top of our agenda going forward? Which subject would you view as least relevant for our agenda going forward?
Build back better 37% 10%
Climate Change 20% 17%
Cyber Security 10% 3%
Data Analytics 17% 7%
Brexit 0% 40%
Disruption 7% 13%
Agile 10% 10%

 

Chair's comments

The intention is to move to fortnightly meetings, the model for these is quite flexible, such as:

  • inviting representatives of heads of internal audit who might want to speak on a subject
  • bring someone in from a firm to talk on a subject
  • bring in a specialist from outside of the internal audit profession.

The starting point is probably a bit of a mix.

We will start with the topic that you have chosen, ‘Building back better’ then work through the list.


Reflections from participants

Velocity and alignment of agility: the mindset of the auditors should consider, is there anything more important compared to what I am doing now and do that. There should be 100% visibility of what the business does, and the alignment should follow.

Agility is clearly up there, not just agility of the plan but also the agility of how we execute audits. The leveraging data more and different audit offerings, such as advisory and design adequacy as opposed to operating effectiveness and having that lens has been helpful. The ability of what to focus on, what is important look back to the strategy and inherent risk profile. That ability to re-prioritise comes into the agile mindset but the learning is to continually focus on what is important otherwise our scarce resources are not used to their best effect.

One of the journeys is trying to educate the audit committee that have been used to an annual audit plan and traditional targets about actual delivery, that there is a need to change  mindset from traditional waterfall auditing to agile auditing that is key. Short but sharper focused audits, getting that message out quicker about the key risks and how we are managing them.

Root cause, I don’t think we see enough root cause, the recommendations are at too low a level. Guidance from the Chartered IIA for the audit committee saying that the agile approach is acceptable, something on that would be quite helpful.

The first is to recognise that the first line of defence is the most important line of defence not the third line of defence, particularly where everything is virtual, and you are working from home. Team ethics in a global organisation is also making sure that we are paying attention to the people – team leaders speaking to their team, checking how they are and supporting them. This has been seen across the company as helping operational performance, a real attention to people in managing risks. The third thing is creating the space to recognise that we are not going to be perfect and actually one of the secrets of being agile is to accept that it is ok to fail but to do that failing safely and move forward.

What I have really appreciated over the last sixteen weeks is exactly this type of interaction. It has been absolutely fantastic and I think the Institute has brought everyone together and made it a really good sounding board for everyone to be able to talk and discuss things - exactly the response that was needed. It is not so much what do you do, but how do you do it, and to what extent. A lot of the guidance gives you the basis but, it is the extent to which you go to, how do you influence your audit committee chair? So more guidance on the extent to which you do things, how good is good, how do we influence our stakeholders, how do we persuade our audit committee chairs to engage with us more, that sort of practical help and guidance.

Root cause - It is interesting, especially in reporting, how often auditees, as much as anything else, wish to focus on specific instances rather than drilling down into why something happened, putting a sticking plaster over it, the issue remains which then causes other issues. Over the last 2 years we have spent an awful lot of time trying to focus our reporting more on themes and root causes. The impact has been huge, really getting into some very meaty issues. These have not always been easy to solve and it means that we sometimes end up with actions that are very long tailed, but it stops you ending up with recurring problems. It comes back to internal audits role not being a tick box approach but much deeper than that. We want to get to the root cause of problems and help the organisation as a whole. 

Institute's response

The Institute has an initiative in progress creating a page on our website that will be accessible by audit committee chairs and members that will give them access to key documents they need for their role.

We will build case studies on how large organisations’ audit committee chairs tell us they operate versus smaller audit committee chairs so that we can learn from each other, exchange knowledge and grow and develop our audit committees. Enabling them to be challenging of their heads of internal audit who will then be challenging of the Institute and continue to push us forward and as part of this journey.

We will be developing a picture of what internal audit is going to look like in 2025 to provide a goal focused on what we should be seeking to achieve. This will be relevant to audit committees as well as heads of internal audit. The Institute will think about: How do we get you there? How do we help you build and deliver in the 2025 model?

Professionalism is fundamental to the Institute and our duty and obligation to our members.

The disruption piece includes exploring from an internal audit perspective: Have we been disrupting ourselves or have we been disrupted by our organisation demanding things from us? Should we have been there ahead of the game? We are looking to explore these challenges and link them into the professionalism agenda.

The reality is that the Institute is going, I hope, to be more engaged with our stakeholders and more engaged with our members and heads of internal audit. This is a journey for the Institute as much as anyone else, but we will commit to doing it.

We heard last week from a chair of an audit committee about the relationship with their head of internal audit, that they really value that relationship. We want to crystallise what that means to have a great relationship between internal audit and the audit committee – that will bring a huge amount of benefit for the future.

 

Chair's comments

As a profession we don’t connect well, and we need to connect better for the benefit of everybody. We have a variety of forums linked into the Institute; we have a variety of other forums that don’t link in. Our mission is to try and connect as far and as wide as possible to help get more connected for the benefit of all.

If you are involved in a forum we haven’t been speaking to recently and you speak to them on a regular basis, we would welcome the opportunity to engage with them, for the purpose of just connecting to see what we can do to help each other.

Next week we will touch on climate change and disruption. This is not in response to the survey we have done this afternoon; this is just to introduce these topics in a bit of detail to shape future sessions.

Finally, as today’s session draws to a close, I would like to thank you all for attending and for contributing to our discussion.

This was the last forum in the current format. Given the feedback received to date we will be retaining the forum going forward but refocusing on other topics which we hope will help shape the future. Broadening out the meeting, opening it up to more people depending on the nature of the topic and the discussions we have and not necessarily just by invitation.

Bear with us as we get this right so that we get the best out of the time that we spend with you over the next few months. I think we are starting something that will go on for quite some time – it has to be relevant to be successful and we will keep it relevant but we hope to be speaking to you on a frequent basis over the next 6 months to year and beyond for this to work properly.

If you have any ideas and suggestions for the format or content of the forum going forward, please do share your thoughts with Liz Sandwith (liz.sandwith@iia.org.uk) or Derek Jamieson (derek.jamieson@iia.org.uk).

And of course, we will happily take further questions outside this forum please do get in touch.


Chat box comments from attendees

In response to the key messages taken from previous weeks by the Institute

Wise words 

Fantastic and very much agree 

With change comes opportunity. Our working ways and business interactions will inevitably be more flexible for the foreseeable future. 

I agree, that's why it is tragic to hear that some of the heads of internal audit want to go back to old ways. 

  • Agree with the comment above - very well said. 

In response to the Chair’s comments on engagement

I agree with the need for more engagement with members, I would add that we all have a responsibility to help raise the profession and profile of internal audit with the Institute and not to expect a silver bullet to come our way.

In response to the Institutes initiative on audit committees

We are adopting agile but what would be really good is some formal guidance for the audit committee about agile and how our professional body supports such an approach. Sometimes audit committees are so used to the traditional waterfall approach that it is what they expect. I know that as head of internal audit we have to deliver some training to get them onside, but any help would be great.

In response to polling for future meetings

Just putting in my 'actual' formal vote for leadership and culture as top priority.

Not as exciting, is/will UK SOX be on the agenda at some point?

Apologies to press this a bit, you mentioned 'culture' as one of the top risks in your list, and that it was inadvertently missed from the survey. Is there an intention to circle back to that at some point? Not least because the literature on "culture eats strategy for breakfast" is vast, it is evidence-based, and it makes for unnerving reading.

Would be really interested in some focus on culture too please. 

In response to reflections from participants

Agree we should be able to adopt more flexibility to audit planning but agree audit committees are wedded to a 12-month plan - this is really not appropriate in an ever changing environment - how can we bring audit committees on the journey?

  • It is not just the audit committees that we need to persuade to let us be agile/flexible, but also regulators and 'interested bodies'. Perhaps the Institute could have a role in educating them?
  • As a committee chair myself, I pleaded to move away from the annual plan with immediate effect.
  • Flexibility of audit plans should be achievable at least via regular formal refresh. Regular communication with stakeholders and audit committees should be the key process to ensure refreshes are relevant and as frequent as required.

Can we make it fail forward better?

Very good point that root cause needs to be central to internal audit. It has been said before in this forum I think, but it is important to distinguish between agile and agility. I think there is sometimes a bit too much focus on the buzzwords and specific practices associated with the agile methodology without enough focus on the principle of being flexible and adapting approach. The focus on agile as a methodology and people using this as a synonym for agility in internal audit can be off-putting for small audit teams where the methodology itself is difficult to implement meaningfully.

  • I agree with your point about distinguishing between agility and agile.

Has anyone used causal reasoning versus defensive reasoning in their root cause analysis?

These sessions have been fantastic. The Chartered IIA’s response to our new ways of working have been of great support to myself, team, and the wider organisation that I share the information with.

In response to the Institute’s work on building a picture of what internal audit is going to look like in 2025

Would be interesting to see how that picture is aligned with our audit strategies - sounds very interesting.


Further reading

The following guidance is only available if you are a member of the Chartered IIA:

Guidance - Root cause analysis

Articles and reports on agile internal auditing

Global Insights

Agile internal audit - Leading practices on the journey to becoming agile

Agility and innovation