The sixth in our fortnightly series of guest blog posts focusing on sector specific challenges from an internal audit perspective.
Take a look through the lens of the charity sector.
We have become all too familiar with ‘unprecedented’ situations over the last 15 months, and this has been particularly true in the charity sector. Huge and unexpected challenges, from bumper increases in service demands coupled with a significant loss of income due to the closure of charity shops and cancellation of key sponsorship events. So, what challenges does this pose for charity internal auditors, and what learnings can we take forward?
The landscape has been changing rapidly. Internal audit teams have had to adjust to changes to the risk profile of the organisation, availability of auditees, resources available in their own teams and reporting expectations. Audit plans need to be able to flex to reflect the changing circumstances of organisations – this affects the way we do internal audit (with some organisations demanding more quick and dirty reporting, embedded continuous assurance on change programmes or instant critical friend feedback), as well as what we are auditing.
We are seeing a particular focus on providing assurance on reforecasting. Finance is a key priority, and with income and financial sustainability recently flagged as the top risk facing the charity sector in 2021, this trend is likely to continue.
Does your audit plan reflect the risk landscape?
Are you regularly revisiting the audit plan to adapt to the changing needs of your organisation?
In 2019 I wrote about the need to raise the profile of internal audit in the charity sector (Audit and Risk p6). Charity responses to COVID-19 highlighted some huge progress in this area but also exposed, once again, the lack of awareness or understanding of internal audit in some organisations.
We’ve seen a truly mixed picture with some charities thrilled to realise that their internal auditors knew all the key risks of the organisation, had a good sense of the new risks emerging from working from home, and were independent enough to provide valuable critical friend feedback to leadership navigating a crisis. On the other hand, we also saw many charities furloughing internal audit staff without considering how valuable internal audit’s insights and skill set could be (in some cases without even asking the audit committee!).
This tells us that there is a lot more to do to help charity leaders understand how valuable internal audit can be, and to ensure our charities are getting the most out of their internal audit functions.
How are you raising the profile of internal audit in your organisation?
Are your skills and insights a valued part of the governance framework?
Every charity I’ve spoken to deprioritised activities previously viewed to be high priority as a result of the pandemic. Looking at the top risks facing the charity sector, identified by Grant Thornton earlier this year, there has been an increased focus on governance and ability to adapt.
Key areas of focus include:
These risks have become very real due to the pandemic. And yet we still have to find time to think about all of the evergreen risks around safeguarding, cyber, data protection, regulatory compliance, business continuity and reputation. Several organisations will have been in the midst of implementing solutions or reviews related to these risks when we were suddenly forced to reprioritise. In many cases, deprioritising resource-intensive change programmes will have been the right decision, but the risks that led charities to plan or start those projects haven’t gone away and as charities move out of crisis mode, internal audit has a critical friend role to play in challenging leadership to reprioritise improvement projects or compliance reviews where significant risks remain.
We need to reprioritise activities within our own teams too. How many of us were about to undertake a gap analysis of our compliance with the Chartered IIA's Code of Practice when our plans suddenly got thrown into disarray in March 2020? Or put our continuous improvement or EQA plans to the side?
Is your charity prioritising activities based on key risks?
What activities do internal audit, and the organisation as a whole, need to refocus on?
CIAN is a free-to-join network for charity and not-for-profit organisations. Members benefit from free professional development and networking sessions, internal audit resources, benchmarking data and discounted training courses. Click here to join.