Disruption case study: Holly Sykes
Holly Sykes - Chief Internal Auditor, Cornwall Council
If you’d told me two years ago that we’d be working the way we are today, I’d have said it would have been impossible. Cornwall’s geography makes it challenging to instigate rapid change but when the pandemic began we had to react fast. I can’t praise our IT staff enough for ensuring we could continue essential work immediately.
The internal audit team started by reflecting on how we deliver our work. We were midway through a restructuring programme, and we were engaged on assurance on a huge new council-wide IT project, finalising the current year as well as planning our audit year.
Everyone pulled together brilliantly. The audit team was already agile and dynamic, but we took this to a new level to identify what we could deliver virtually and what the organisation needed from us. We had to consider what the pandemic meant for our team, for the Council and for vital services. We couldn’t stop work on the IT project because it was a massive investment that would affect long-term services, so audit work had to be adapted to ensure that it was still meaningful.
One early red flag was the delivery of government grants to local businesses. Cornwall Council was one of the fastest to roll out grants in the first lockdown, but while this was celebrated, I worried about whether the money was going to the right people and whether we were doing all the correct checks. A counter fraud team review confirmed that the Council did well, largely because we had strong systems and processes in place before the crisis.
I communicated constantly with the Chair of the Audit Committee and our Section 151 Officer. I was also involved in other elements of the Council’s work – for example, I was exposed to the planning in regard to excess deaths in the County, which was being led by the Council’s Monitoring Officer. These conversations could be overwhelming, especially when we were all scared and knew so little about Covid-19. However, it made me appreciate even more the significance of internal audit and what the real assurance requirements of the Council were.
The Council set up an emergency response team with core staff from each critical area and this helped to break down silos. Internal audit helped managers to pull together the Council’s risk framework and risk became a driver in a new way – with these teams appreciating the value of good risk management.
Another benefit was that the pandemic increased our awareness of, and access to, the wider internal audit community as suddenly everything was online. The Chartered IIA opened many ways to learn from what others were experiencing. It’s been hugely useful and made us feel part of a community of internal auditors. I also value this for horizon scanning for emerging risks.
Putting our business resilience and business continuity plans to the test taught us valuable lessons. It demonstrated that having huge, detailed plans is only an element of the planning. Business continuity is about living through a crisis and being resilient and adaptable. When the crisis happened, Cornwall Council changed overnight. My only fear is that, having delivered amazing outcomes, we mustn’t revert to old practices. The Council has really stepped up and responded in such a positive way.
As an Internal Audit Section, we were already moving away from rigid annual plans, but the pandemic emphasised the need to focus on the assurance the Council needs here and now. Gone are the days of a three-month audit. Delivering a good audit must also be about listening to what the organisation needs.
One risk with remote auditing is that you can miss out on important information if you’re not in the office talking directly to people. You miss the informal comments and conversations. I’ve also learnt lessons about optimising communication with the Audit Committee. Virtual meetings have made me focus on what’s most relevant and how I present important messages and leave time for questions. The style I have adopted is something I will always keep with me.
If this happened again, I would emphasise personal communication with the team earlier – ensuring that the informal meetings take place to just check in and see how everyone is. The Council prioritised staff mental wellbeing, but remote working makes it even more important to be aware of other peoples’ lives and that staff must be allowed to switch off from work.
On a personal level, my tolerance level has changed – I don’t worry the same way about things that I would have worried about 18 months ago. It’s important not to over think issues. My perception of the audit landscape and context has shifted and the team appreciates the bigger picture much more.
The pandemic didn’t create an influx of extra issues for internal audit or the Council (besides Covid-19 itself), but it brought existing ones to the fore. We’ve focused more on outcomes, have forged new relationships with management and the Council has gone someway to eliminate silos. All this should enable us to face future disruption more effectively.
In partnership with:
