The Ardonagh Group internal audit team is used to disruption. The group includes over 30 companies in the insurance sector, and it has a strategy of constant expansion. This brings challenges and risks. However, the advantage of a diverse group is that some parts usually do well, even when circumstances are tough for others.
We are immensely proud of what our companies achieved when the pandemic struck – we got over 6,000 people working from home within a month and we believe all of our customers received their renewals on schedule.
Of course, we hadn’t planned for a lockdown. No one did. Our crisis plans provided for moving offices if one area went down; not the whole country closing. The situation was unprecedented. However, we focused on our statutory duties to treat customers fairly and to ensure they got the best outcomes.
We had been working on a conduct risk framework before the crisis began and we recently reviewed how it has worked in practice. Our experiences during a cyber incident last year provided evidence that conduct risk was well controlled in a real situation. The main report into our conduct risk performance in the pandemic was green-rated, so it also shows we managed it well.
We’re a small team (12 people) in a complex business, but we are supported by a separate risk and compliance team and a clear three lines model. On 17 March 2020, I told our main board that I predicted a general lockdown. We’d done some homeworking tests and I told them that if this happened, I would prioritise core issues on the audit plan, scrutinise our response to the crisis, highlight and monitor elevated risks caused by the pandemic and focus on regulatory issues. I was recruiting six people and I said I would pause the recruitment process, but that I needed the board to commit to provide whatever we required to complete fewer, more targeted audits.
One useful outcome was that we got involved in response plans from an early stage and our challenges were appreciated by the business. We’re now more likely to be invited to review projects early in the process, which is much more useful than criticising later.
We also took someone on secondment from the business during lockdown. This was a win-win – they were facing redundancy and during their secondment they were offered another role, so the business kept a good person and they fed back their understanding of internal audit to their colleagues, which was really valuable.
However, we mustn’t become complacent. I’m telling our boards that it is dangerous to believe that we don’t need to do more tests because we survived this crisis well. We’re a growing business and I tell them that a car that is serviced regularly can be driven fast more safely than a car that is untested.
In addition to the pandemic, we’ve faced disruption from Brexit, which has caused our businesses to develop offices in European countries. As an industry, we’re also likely to see more impact from climate change disruption in future. We have specialists looking at the details, and as a group we may have to do more.
Some changes will stay. We need to establish a working model that is sustainable in the long run, no matter what happens. Internal audit will continue to do far more work remotely in future and the rest of the business has to address it as well. We ended the lease on one of our London offices last year and I don’t see us returning to full-time office life.
This home-based working is efficient, but it makes communication harder – you lose the nuances. There’s less scope for “chat” and it’s hard to “read the room” when you give a presentation. It will also affect some employees more than others and we need to consider this and find solutions. I’ve been holding social Teams meetings, but it’s not as good as getting together in person. I predict that our new way of working will include a mix of home and office time – this will quickly seem normal if we approach it with sufficient commitment.