Internal Audit: Hybrid Working - factors to consider
This short briefing note addresses some of the practical considerations and potential risks with respect to hybrid working which Internal Audit needs to consider not only in terms of its own day-to-day operations but also as part of its audit work, as it assesses the impact on other business areas and the wider organisation.
This briefing draws on the experience of several senior internal audit practitioners in the financial services sector. However, the content can be easily applied to other sectors.
The approach to hybrid working will depend on a range of factors, including the nature of the business and the views of senior management and board. Irrespective of the model adopted, there are several risks and challenges which need to be managed, examples of which are outlined in this briefing.
Background
The extended periods of remote working experienced during the Covid-19 pandemic had a major impact on how organisations functioned. Significant changes included:
- The acceleration of the adoption and use of existing and new technologies to enable effective remote working.
- Changes in day to day working practices e.g. through greater digitalisation of processes.
- A better understanding of the impact of remote working leading to a greater acceptance of and demand for flexible working.
Following the relaxation of Covid-19 related workplace guidance, most organisations have moved to a form of hybrid working. As noted below, there are a wide range of hybrid working models in use by organisations.
These working arrangements have implications for the management of internal audit functions and for the execution of internal audit work.
What is the objective of hybrid working?
Hybrid working aims to achieve a balance between a strong collaborative working culture through regular face-to-face contact whilst giving staff a degree of flexibility to achieve a better work / life balance.
What type of hybrid working models are being used in practice?
The following are examples of models which we have seen operating in the financial services sector, based on feedback from several senior internal audit practitioners. These examples illustrate the range of approaches adopted.
It would be fair to say that the choice of model for most organisations involved some element of ‘guess work’, particularly given the absence of peer comparisons at the stage of roll out. Accordingly, several organisations have indicated their intention to review the effectiveness of their policies in this area in a few months and possibly modify these based on their own experience and benchmarking.
The examples of hybrid working practices included:
- 2 or 3 days per week in the office ‘expected’, but no mandatory policy stipulating this; ‘needs driven’ or up to individual teams to decide;
- a minimum of 2 or 3 days in the office, which are stipulated across the organisation (e.g. Tuesday to Thursday);
- 4 days per fortnight, with larger teams agreeing two fixed office days per week;
- 4 to 5 days required in the office (a small minority of cases);
- fully hybrid with no stipulated requirements;
- some organisations set rules by business areas depending on roles e.g. trading desks, middle office.
What risks and challenges should Internal Audit consider?
Factors to consider both in relation to Internal Audit teams and the wider organisation include:
- Are the ‘ground rules’ around hybrid working completely clear i.e. what is expected and meant by ‘hybrid working’? Is there scope to review and modify this based on team and organisational requirements?
- Integration and development of new / junior staff e.g. learning through regular face-to-face interaction and mentoring is generally regarded to be me more effective
- Maintaining a sense of ‘fairness’ where staff choose different working practices e.g. risk of giving preference to staff who are in the office – ‘proximity bias’ or ‘presenteeism’. Are there wider implications for diversity and inclusion?
- Are all teams / leaders able to manage a hybrid working model effectively e.g. right skill sets; approach? Is additional training or sharing of good practice needed?
- Some audit tasks may be more difficult to finish and complete if not in the office e.g. publication of audit reports and dealing with complex or sensitive issues, and need to be managed accordingly.
- Is there consistency in the assessment of risks and key judgement calls?
- How do you promote a strong ‘cultural cohesion’ or drive cultural change; is there a risk of creating ‘sub-cultures’? Are there longer-term risks to an organisation’s culture?
- Are there staff who are reluctant to spend time in the office and what can be done to address this e.g. planned activities, team days?
- To what extent does flexibility help to attract and retain staff? Does feedback from staff recruitment and exit processes indicate the balance is right?
- Are there differences in attitudes to flexibility e.g. between teams or different levels of seniority? How is this being addressed?
- Are office layouts and the provision of hardware devices still fit for purpose e.g. for video calls from desks?
- Are staff taking adequate time off for holidays and in cases of illness? Is there any evidence of trends or patterns?
- How do individual staff and teams maximise effective use of time in a hybrid work environment e.g. desk-top work at home vs face-to-face meetings in the office? Is there a risk that staff interact less when in the office?
- To what extent are there geographic differences and what additional challenges does this create e.g. assessing culture; co-ordinating meetings and visits?
- Is there an appropriate balance between flexible working / employee rights and the operational needs of the organisation?
References
Cyber and remote working Cyber and remote working | COVID-19 guidance | COVID-19 hub (iia.org.uk)
Hybrid working press release Hybrid office working exposes post-pandemic culture crisis | Press releases | Policy and research (iia.org.uk)
Remote auditing iaf-report-the-remote-auditor-1.pdf (theiia.org)
