A&R_mag_issue62_Nov-Dec

Issue 62 November/December 2021

The magazine of the Chartered Institute of Internal Auditors

Climate change

What audit committees need to know Plus: A&R Awards nominations open; the future of internal audit; supporting new business ventures

Contents

24 FRONT

2 The institute view From the chief executive.

6 View from the top From Jeremy Eagles, group chief audit officer, Bupa Group.

10 Outside the box One question to ask this week.

12 Update The latest news affecting the profession.

18 Reportage Key findings from Risk in Focus 2022.

For support and guidance for internal auditors on all current topics, visit the Chartered IIA’s Community Hub.

38

FEATURES

20 Audit & Risk Awards The Audit & Risk Awards are now open for nominations.

24 Time to talk; time to act What are you doing about climate change?

38 Your future: you decide Internal audit in the next decade.

44 Pulse of change Award-winning innovation at the British Heart Foundation.

50 Future shock The opportunities and risks of brand diversification.

58 Tools for the Job: Quality assured The new route to Chartered status explained.

44

10

70 MEMBER MATTERS

60 Q&A

Your questions answered.

66 Training insights The IIA Certificate in Internal Auditing and Business Risk.

70 Events What’s on across the UK and Ireland.

View from the institute

Consequences l time to reassess your risks “Complex risks usually have multiple causes as well as multiple, hard-to-predict consequences. This makes internal auditors’ jobs even more challenging right now.”

John Wood is CEO of the Chartered IIA.

2

Anyone who hoped that emerging from Covid lockdowns would return us to business as it was in 2019 has been swiftly disillusioned.

Since the economy began to re-open fully in the summer, we have seen chronic shortages of HGV drivers, soaring gas prices, empty petrol pumps and a lack of carbon dioxide causing gaps on supermarket shelves.

Some of this has been attributed to panic-buying by consumers and dire warnings in the press about “cancelling Christmas”, but the shortages of products, materials and people are not fictional.

They are affecting retailers, hospitality venues and factories and, ultimately, pretty much everyone in our society.

That is the trouble with risks. As internal auditors are well aware, they ripple outwards, causing wave after wave of disruption, inconvenience, and worse.

It’s human nature to seek to blame someone – “irresponsible” people, the government, Brexit or Covid – but complex risks usually have multiple causes as well as multiple, hard-to-predict consequences.

This makes internal auditors’ jobs even more challenging right now. Many are under pressure to get “back to normal”, but what does that mean? It cannot mean going back to the way we worked before the pandemic. The world has changed and so must internal audit – as Richard Chambers told the Internal Audit Conference this week, no one will decide the future of internal audit except internal auditors themselves.

Understanding the

interrelated nature of the broad, structural and endemic risks we now face is crucial to this. Things change rapidly and constantly and, each time they change, they shift the pattern of the ripples.

Things that start small can escalate rapidly causing major, shifting, challenges. Some are local, or confined to one sector, but Covid has taught us that geographies and sectors are so closely connected that any “trouble at t’mill” soon affects not only other “mills” but many other industries and locations as well.

It is therefore not surprising that our landmark Risk in Focus 2022 research highlighted three key concerns that should be on all internal audit leaders’ radar – workforce fatigue and culture erosion, supply

chain strains and the race to flexibility, and the climate change and sustainability parts of the environmental, social and governance (ESG) agenda.

All of these are wide-ranging risks that have a tendency to grow and extend tentacles into new areas of concern the more you explore them. These are the issues that internal audit leaders told us are keeping them awake at night. And they are all issues likely to continue to throw up new risks, and exacerbate the severity of existing risks, in the future.

If internal auditors are to help their organisations manage such risks, we need to develop innovative systems and ways to monitor the risk ripples

“We cannot go back to the way we worked before the pandemic.

The world has changed and so must internal audit.” as they spread. We need to become better at connecting different categories of risk, because the consequences of a rapidly changing environment do not lie in convenient packages marked “supply chain” or “transport”.

This is not new, but the degree and extent of the disruption and the number of ripples currently travelling around the world is exceptional.

Internal audit teams that coped well in the pandemic should hope that their organisations look to them for help in the subsequent crises that loom large. We need to rise to this challenge and offer substantial support to help management cope in difficult times, which seem likely to continue.

Make no mistake; many of these emerging risks could destroy a business. The pandemic is not over and new variants may yet cause further disruption or even

<

3

“How will internal audit teams identify and attract the best people when good employees can look further afield and think differently about how and where they want to work?”

4

lockdowns. Pubs, restaurants and shops are closing early or for part of the week, because they lack supplies and staff. Scarcities and record prices for materials and fuel are threatening the viability of building projects and challenging online retailers, many of which thrived in lockdowns.

There is little point hiring new HGV drivers if there are no goods to transport – or customers have to focus their spending on heating their homes instead. Consequences matter, but may not play out in the way they have in the past.

Internal auditors also need to assess how evolving issues affect their own ability to work “as usual”. They must continue to seek ways to circumvent barriers and offer new forms of assurance, and accelerate their reactions to emerging risks, planning and reporting.

How will internal audit teams identify and attract

the best people when good employees can look further afield and think differently about how and where they want to work? Can you still do site audits and, if these are necessary, how will you get there and what will this cost? How sustainable is the internal audit function and how resilient is it to deal with further, rapid change?

The Chartered IIA continues to monitor emerging risks and to provide forums and opportunities for members to discuss these and other challenges in a safe, supportive environment. We are continuing to support and evolve the networks and hubs we set up in 2020 and build on the lessons we learnt, even as we open up our face-to-face events and courses again.

Our flagship Internal Audit Conference demonstrated how we can blend traditional and new ways of providing support to ever more members simultaneously – and,

importantly, develop further the sense of community that has proved important to many people in the past year and, we hope, will encourage more members to share their experiences and their concerns to benefit us all in future. So keep checking our website and emails for details of new guidance and events – our guidance for audit committees on climate change is out this month – and read Risk in Focus 2022 as a starter for ten.

We also know that sharing and celebrating excellence is as important as offering advice, so, if your team or leader has excelled and you want to see them recognised and to share their experiences, the Audit & Risk Awards nominations are now open.

Watch out for the stories of last year’s winners in this and subsequent issues of A&R. The years ahead may be tough, but they should also be exciting, so brace yourself for a bumpy, but exhilarating ride. n

View from the top

Advocacy | a route to the future

“Internal audit functions of the future must be data led, data literate and data analytical to understand their businesses and deliver assurance with valuable insight. This is not easy, but it is no longer optional, and it represents an exciting challenge.”

Jeremy Eagles is group chief audit officer, Group Internal Audit, Bupa Group.

6

If you want to be interested in something then you should find somewhere interesting to be, and the healthcare sector certainly fits the bill. In my two and half years at Bupa I have been privileged – and humbled – to witness the immense efforts my colleagues have made to support and care for our customers, be it support for our health insurance policyholders, patients in our dental centres, hospitals and clinics, or residents in our care homes and villages.

The pandemic undoubtedly tested (and in some places continues to test) my company’s resilience and adaptability, but it has also accelerated wider changes in the sector, driven by two key factors.

The first of these is the development in the nature and type of healthcare solutions.

It is likely that healthcare systems focused historically on “sick care” will increasingly give way to organisations that can better support chronic care, preventative care and, ultimately, predictive care.

The second is the use of technology focused on supporting the customer’s journey and improving their health outcome and

experience along the way. Accessing and navigating health systems can sometimes feel more complicated than it should be and Bupa, together with many others in the industry, is working hard to leverage technology and manage data more effectively (but responsibly) to make this better. We call this making healthcare more frictionless.

Companies will stand or fall depending on how well they navigate these waters, and whether they address the challenges at the pace required, while still maintaining an appropriate risk and control environment.

This requires my function – Bupa Global Internal Audit (GIA) – to keep up. Internal audit functions of the future must be data led, data literate and data analytical to understand their businesses and deliver assurance with valuable insight. This is not easy, but it is no longer optional, and it represents an exciting challenge.

It requires a thoughtful and strategic approach to core elements, some of which are obvious and some not so obvious.

The obvious elements include the necessary investment in team skills and capabilities as

“Bupa, together with many others in the industry, is working hard to leverage technology and manage data more effectively.” well as technology tools. Everyone has been to webinars on these topics. The not-so-obvious elements are the approach to getting better and faster access to relevant organisational data, and obtaining stakeholder buy-in to the internal audit function’s new ways of doing things.

Success here is everything and this must be the key focus for internal audit leaders. It’s the difference between developing a connected, collaborative and valuable function which can deliver meaningful and more timely insights – or just building a cost centre. At Bupa GIA we’ve developed a data access and analytics strategy that encompasses all of the above. We appreciate that it will take time, but we’ve made a great start, are clear about where we’re going, and know how we’re going to get there.

But data is only half the story for our future.

The other half must come from advocacy.

As organisations embrace change, in

7

particular the “digital revolution”, it is hard for our first-line colleagues (and sometimes those in the second line too) to maintain their focus on effective risk management and control – let alone evolve and automate faster and more effective internal controls as part of the journey.

There are various reasons for this, but top of the list in my opinion is a lack of resources dedicated to helping business leaders really understand what an effective internal control environment is, what it comprises, why it is important, how it can be framed and how it can be implemented.

This is why we’ve developed a framework for describing internal controls. It’s a deliberately simplified, “easy to describe and digest” version of COSO. It describes an effective internal control environment as a combination of optimised governance (oversight), management and operational controls which can be applied

<

View from the top

“We’ve developed a framework for describing internal controls. It’s a deliberately simplified ‘easy to describe and digest’ version of COSO.” at all levels of the organisation. We’ve built it into Bupa’s risk management framework and internal audit methodology.

Most importantly, GIA is taking the initiative by being its strongest advocate. We are promoting conversations about it with everyone we meet, bringing it to life via communication and learning materials, and demonstrating the difference it makes in improving internal controls throughout the business. Every 8

member of our global team is working to bring it to life for our stakeholders.

In turn, our stakeholders are recognising our controls advocacy alongside the independent assurance we provide, and they are being influenced to act because they also learn.

This matters because it means that GIA plays a role in building the culture of the organisation, and that’s exactly where I think all internal audit functions should be. n

Data access and analytics Enablers

Applications

Data Skills & Literacy Risk Assessment Planning

Risk Profiling

Agile risk assessment

Data Access Data Analytics Audit Application Execution Areas

Predictive risk identification Enhanced assurance coverage

Data Tools

Continuous control monitoring

Reporting

Advocacy & Stakeholder buy-in

Risk quantification

Visual dashboards

SHINE A LIGHT ON YOUR AUDITS Whole-population testing

Advanced Analytics

Eliminate the risks of missing vital revenue-leakage transactions with 100% population testing for complete confidence in your data

Utilise IDEA Lab to access advanced and powerful analytics plug-ins to further improve your audit process

Integrated, pre-built standard tests

Task Scheduler

Save time and effort by using IDEA’s integrated, pre-built audit tests covering General Ledger, AP & AR, Fixed Assets, and more

Contact us on 01622 355200 or visit https://www.caseware.co.uk/business/idea

Minimise downtime, automate out-of-hours testing, and speed up the audit process with IDEA’s built-in task scheduler

Outside the box

USE YOUR INFLUENCE If you ask one question this week make it this one:

10

Q: How can I help my team/ function/organisation to be more sustainable?

A: Little steps, big steps, giant leaps – they all make a difference. Participants at COP26 are discussing the highlevel issues, but whatever agreements they reach will take time to filter down to corporate and personal level in the form of official targets and regulations.

However, we already know the direction of travel, so there’s no point in delaying setting off just because we don’t yet know our exact destination. Big changes are needed and they need to start now. Some of the largest ones won’t be possible until organisations pave the way with the smaller things – so get started.

We often talk about internal audit’s unique holistic view of the business. This also gives it unique access to multiple departments, global locations, managers and sites.

Internal auditors talk to people across the organisation and see what happens on the ground as well as scanning for potential

and increasing risks originating outside the walls.

This makes internal auditors real trusted advisers. Every audit and every conversation can be an opportunity to consider sustainability and ask: Could this be done better, with less waste or more bio-diversity? Could we save energy, cut emissions or reduce water consumption?

Could the cost of investing in more sustainable technology be offset by reduced risk, lower operating costs or positive customer relations? What can we gain by doing something now, rather than waiting till we are forced to do it by the government or competitive pressure? What are we planning to do about TCFD reporting – is internal audit planning to be involved in providing assurance over the accuracy, completeness and timeliness of the reporting?

When it comes to influencing, the opportunities from change

may make a stronger case than the risks. Falling behind more innovative competitors is a business risk that can be hard to quantify – until it’s already happened. And failing to be innovative (either as an internal audit team, or as a business) can cause long-term reputational damage. Forging new relationships with potential allies or collaborators may not give a tangible return immediately, but could put your organisation in a far stronger position if you need to branch into a new business sector or source more sustainable energy or products in future.

All internal audit departments need to be looking beyond their own walls to assess macro risks, and climate change is more macro than most. The proverbial butterfly fluttering its wings in China or South America may already be sending drought, heatwaves,

“All internal audit departments need to be looking beyond their own walls to assess macro risks, and climate change is more macro than most.”

11

“If every member of every internal audit team used every audit and every piece of assurance work and every conversation to ask ‘Is this sustainable?’ what results could they achieve?” flooding and other natural disasters in your direction – not to mention all the consequent economic, operational and supply chain issues.

No internal audit team can track all the potential risks from this global phenomenon, but all can do what they’re best at; asking questions, fulfilling our trusted adviser role, observing

real actions, planning scenarios and identifying data and being assurance providers. They need to tell management and the audit committee what’s really going on, highlight problems that need solutions and, sometimes, suggest solutions for problems management may not yet realise exist.

If every member of every

internal audit team used every audit and every piece of assurance work and every conversation to ask “Is this sustainable?” and “How could it be more sustainable?” what results could they achieve?

Whether it leads to multiple small steps or a few big leaps, they will at least be going in the right direction. n

ADDITIONAL NEWS, FEATURES AND VIEWS are posted online. For guidance and support on current and emerging issues visit the Chartered IIA’s Community Hub.

UPDATE

We round up the latest business and regulatory news to affect the internal audit profession

Compliance risks rise when controls are not embedded in routine processes Compliance teams that fail to embed their controls into employee processes suffer from significantly higher rates of compliance failures than those that do, according to a recent survey by risk management consultancy Gartner.

The researchers found that organisations that put a heavier compliance burden on their employees create higher levels of risk, leading to increased control failures.

They warned that introducing new rules and obligations for employees without properly integrating them into the processes these people have to carry out, leads to multiple causes of control failure. Staff reported being unable to find or comprehend the information they needed, or said they did not recognise or remember it when they needed it. n

12

Align risk management with AI New guidance to help organisations align their risk management with their artificial intelligence (AI) initiatives has been published by COSO, the international body responsible for developing frameworks to improve internal controls.

The paper, called Realize the Full Potential of Artificial Intelligence, says that organisations that understand their AI-related risks may be better

equipped to deliver strong return on investment and meet their stakeholder expectations.

In addition, organisations that implement enterprise risk management can refine and adapt their innovation initiatives to support their strategies in a rapidly changing business environment. The research says that AI solutions need to be “trusted, tried, and true”. n

Bank of England report reviews global supply chain risks

Resilience and risk rise up corporate agenda

The global pandemic has increased the importance of risk management and resilience in organisations, according to more than 90 per cent of European risk managers surveyed

by European risk management association FERMA. More than half of those who were questioned said that it has made resilience planning “considerably more important” than it was in their organisation before.

Overall, the majority of respondents said that they thought their organisations are well equipped to manage resilience.

Most said that risk managers are involved in the process in a meaningful way and that they have further room to lead initiatives, especially in predictive capabilities such as scenario planning and stress testing.

Over 60 per cent of the participants in the survey acknowledged resilience as either a top priority or as “very relevant” in strategic decision-making.

Looking ahead, almost three-quarters of the risk managers surveyed said there is a clear need for improving risk culture and integrating resilience more deeply into their organisations’ strategy. n

13

A new report from the Bank of England examines the risks that are inherent in global supply chains. It asks whether initiatives to source goods and services locally are necessarily the best course of action to offset the risk of future economic shocks. n

<

ADDITIONAL NEWS, FEATURES AND VIEWS are posted online. For guidance and support on current and emerging issues visit the Chartered IIA’s Community Hub.

BSI guidance offers whistleblower management best practices

14

The British Standards Institution (BSI) has published international guidance to help organisations set up an effective whistleblowing management system.

The guidelines aim to provide companies with help establishing, implementing, maintaining and improving whistleblowing policies and procedures.

According to the BSI, it

has developed the standard to encourage and facilitate the reporting of wrongdoing; support and protect whistleblowers and other interested parties involved; ensure that reports of wrongdoing are dealt with in a proper and timely manner; improve organisational culture and governance; and reduce the risks of wrongdoing.

It explains that the

guidance should enable a company to identify and address wrongdoing at the earliest opportunity to help prevent or minimise any loss of assets (and/or recover them). It should also help them to ensure compliance with policies and procedures, as well as legal, regulatory and social obligations.

The BSI stresses that any effective whistleblower management system needs top management leadership and commitment to succeed. It emphasises the importance of internal communication, training, and regular reviews to assess a system’s suitability, along with monitoring how well managers have assessed and responded to (and escalated) whistleblower reports. n

Survey highlights compliance priorities Organisations’ efforts to improve internal controls are focused on enhancing regulatory and internal compliance assessments, introducing more compliance training to improve employee awareness, and elevating third-party management, according to a report by IT vendor MetricStream.

Its 2021 State of Compliance Survey Report found that tracking third-party compliance was the primary concern for almost half the organisations in the survey, while two-thirds of organisations said that their top priority was to enhance regulatory and internal compliance assessments.

The report also found that 63 per cent of organisations are still using inadequate productivity and knowledge management software to manage compliance. n

Pandemic has stifled innovation in one in three companies

Data integrity cited as a key risk for FS firms

Legacy technology and manual processes are compromising the ability of financial services firms to manage and minimise risk, according to a report by data management organisation Duco.

Its survey found that almost three-quarters of firms in the sector believe they are struggling with too many different formats and systems to manage their data risk.

Over two-thirds said they find it hard to maintain data quality and integrity as it moves through the organisation.

Risk teams also complained that legacy systems and technology are not keeping up with requirements.

Almost a third of those questioned said their existing technology is too slow or expensive, while a fifth said their risk data is too complex for current systems. As a result, around two-thirds of risk teams said they spend most of their time handling repetitive issues such as sourcing, reconciling and transforming data for use in risk management systems.

Despite this, many are still nervous about adopting more agile, automated solutions. More than a third of respondents said moving manual data processes on to new systems would be too expensive or time-consuming, and more than one in ten could not see any compelling business case for automating their processes. n

One third of businesses have failed to innovate during the pandemic, according to research by business performance consultancy Ayming Group.

Market uncertainty and reduced R&D budgets are the

15

main reasons why companies may be lagging behind, the researchers said.

More positively, 82 per cent of businesses agreed that the pandemic has demonstrated that a business must be able to identify and react to opportunities, and 76 per cent agreed that the pandemic has proved how important it is to innovate during a crisis. n

<

ADDITIONAL NEWS, FEATURES AND VIEWS are posted online. For guidance and support on current and emerging issues visit the Chartered IIA’s Community Hub.

IT teams fear remote working is creating a security breach “time bomb”

16

Three-quarters of IT teams admit that security took a back seat to business continuity during the pandemic, according to a report by IT vendor Hewlett Packard.

Many also told researchers that their attempts to increase or update security measures for remote

Chartered IIA launches animation to explain and promote internal audit

workers have frequently been rejected, particularly by younger workers who feel frustrated when security gets in the way of their deadlines. This is causing many to circumvent controls.

The latest HP Wolf Security report also found that 83 per cent of IT teams believe the increase in home workers has created a “ticking time bomb” that will lead to a corporate network breach. n

The Chartered IIA has launched its first explainer video to introduce the institute’s reach, scope, influence, network and suite of services. “We are the Chartered IIA” is an accessible animated overview aimed at promoting both the institute and the purpose and work of the internal audit function.

The video is the first in a planned series of explainer videos that answer basic questions about who internal auditors are, what the institute does and the profession we represent. Two further videos will ask what is internal audit and will compare internal audit and external audit.

The initiative began when research identified a need for rich content providing detailed answers to basic questions. The BEIS consultation on the future of audit and the challenges that internal auditors have worked to overcome in the past year only added to the need for short explanatory videos that members can refer to and use in their organisations, and that offer a simple overview to those unaware of our work. n

ATTRACT THE BEST

talent

Bringing together the latest job roles within the internal audit, risk and corporate governance industry

Internal Audit & Risk Jobs The official job board of the Chartered IIA Advertise with us jobs.iia.org.uk

REPORTAGE

Risk in Focus 2022: The latest Chartered IIA analysis of hot topics for internal auditors focuses on the challenges of auditing amid rapid change, based on findings from 13 European countries.

Themes include the lasting consequences of Covid-19. Large sections of the workforce are seeking new employment or migrating into different sectors, triggering staff shortages and high vacancy rates.

Workforce and labour market disruptions have implications for culture, while businesses are also contending with critical supply chain issues and inflation risks. In addition, those who ignore the sustainability agenda will risk extinction. The report is intended to inform internal audit’s thinking and provide a benchmark for chief audit executives (CAEs) to contrast and compare their risk assessments.

What are the top five risks your organisation currently faces?

18

1. Cyber security and data security 2. Changes in laws and regulations 3. Digital disruption, new technology and AI 4. Human capital, diversity and talent management 5. Business continuity, crisis management and disasters response 6. Financial, liquidity and insolvency risks 7. Macroeconomic and geopolitical uncertainty​​ 8. Climate change and environmental sustainability​​ 9. Supply chain, outsourcing and “nth” party risk​​ 10. Organisational culture​​​​​

82% 46% 45% 40% 38% 33% 32% 31% 30% 27%

GOING UP

• Climate change and environmental sustainability • Human capital, diversity and talent management • Business continuity, crisis management and disasters response • Organisational culture

0 1 1 1 0 0 1 1 0 1 1 0 0 1 1 0 1 1 0 1 1

Health, safety and security 1 0 1 •0 1 1 0 0 1 1 0 1 1 0 1

1 1 0 1 0 1 1 0 0 1 1 0 1 1 1 0 0 1 1 1 0

DOWN 1GOING 0 1 •0 1 1 Financial, 0 1 1 1 0 0 1 1 1 liquidity and

0 1 are 1 the 1 1 0 1 1 0 0 1 1five 1risks 0 0 0 1your 0 0 1 1 What top0 that

1 0 0 1 0 1insolvency 0 0 0risk 1 1 1 0 0 1

organisation will face three years from now?

1 0 1 1 1 0 1 0 1 0 1 1 1 0 0 1 0 1 77% 0 1 1. Cyber security and data security 2. Digital disruption, new technology and AI 3. Changes in laws and regulations 4. Human capital, diversity and talent management 5. Climate change and environmental sustainability

62% 47% 44% 44%

• Changes in laws and regulations

1 1 1 •0 0 1 1 Digital 1disruption, 1 0 0new1 0 1 0 technology and AI • Communications, reputation and stakeholder relationships • Fraud, bribery and the criminal exploitation of disruption

311%

“The post-pandemic impact is probably the most important unknown. I expect default risk to go up. Inflation risk is going up and that will affect businesses.”

– the increase in the ransom paid by victims to have their data and systems decrypted by perpetrators in 2020.

CAE, Switzerland, insurer and constituent of the Swiss Market Index

41% increase in the proportion of CAEs who view climate change and environmental sustainability as a top-five risk since last year’s survey.

Climate change and environmental sustainability is a moving target that companies will have to make continuous efforts to mitigate for decades to come. This should therefore be considered a “forever risk” that is likely to move up the risk rankings over time.

82%

40%

32%

150%

27%

31%

56% 26% 90%

38%

30%

of CAEs said that cyber security and data security are among their top five risks, putting it ahead of any other risk type. 34% of CAEs said it is their single biggest risk.

of CAEs put human capital, diversity and talent management among their top five risks, a rise from 35% in 2021 and 27% in 2020.

– the increase in the volume of ransomware attacks in 2020. Of these:

of CAEs viewed organisational culture as a top five risk – seven percentage points higher than last year.

recovered their data via system backups.

of CAEs said business continuity, crisismanagement and disasters response was a top five risk (34% last year).

paid a ransom to have data returned.

global growth in ESG regulations and laws since 2016.

46%

of CAES said changes in laws and regulations was in their top five risks – but only 8% saw it as their top risk.

45%

of CAEs put digital disruption, new technology and AI in their top five risks – 8% said it was their top risk.

Risk In Focus 2022

1 1 0 1 1 1

0 1 1 1 1 0

1 1 1 0 0 1

0 0 1 0 1 0

0 1 0 1

0 0 1 0 0 1

!

1 1 0 0

33%

of 1 European 1 CAEs viewed 1 financial, liquidity 0 and insolvency risk 1 as one of their top 1 five risks – a fall from the 42% who said the same a year ago.

However, 10% saw this as the single biggest risk to their organisation.

of CAEs said that macroeconomic and geopolitical uncertainty is one of their top five risks, while 10% said it is their top risk. of CAEs said climate change and environmental sustainability is a top five risk (compared with 22% of CAEs last year). of CAEs said supply chains, outsourcing and “nth” party risk is a top five risk (down one place from last year).

22%

of CAEs put health, safety and security in their top five risks (up two places from last year).

“How do you keep the culture alive when everything’s remote or hybrid and when you’re not interacting in person?”

CAE, Ireland, travel operator listed on Euronext Dublin

19

Audit & Risk Awards:

Time to nominate

20

Nominations for the next Audit & Risk Awards are now open. In the past two years we have seen unprecedented turbulence and disruption to all sectors and organisations.

The challenges continue with staff shortages, supply chain problems and soaring gas prices. We know that internal audit teams have risen to the considerable challenges and delivered outstanding performances to support management and help their organisations to weather the many and varied storms.

Outstanding teams and individuals deserve to be recognised and their contributions celebrated – both for their own sakes and because highlighting the real benefits of great internal auditing helps to enhance understanding of the profession and appreciation of its value. Being nominated, getting on to the shortlist or receiving an award is a win-win for everyone involved.

This year we have introduced categories to demonstrate the role that internal audit can play in two increasingly important areas – “The Judges’ Award for Outstanding Contribution by Internal Audit to Furthering an Organisation’s Response to Climate Change Risk” and “The Judges’ Award for Outstanding Contribution

by Internal Audit to Enabling an Organisation to Gain Opportunities from its Diversity and Inclusion Agenda”.

If your team can demonstrate innovation leading to improved performance, or can tell us about their journey towards increased awareness and actions to mitigate risk and to benefit from opportunities in either of these areas, we want to hear about it.

Now it’s your turn. We need you to nominate the people and the teams who have made a real difference. We need to hear your stories and find out what you and your colleagues have been doing in some of the most testing circumstances we have ever endured. And we need to find out how internal auditors are tackling cataclysmic threats and seizing opportunities from disruption. Nominate someone today and shine a light on their achievements. n

“Being nominated, getting on to the shortlist or receiving an award is a win-win for everyone involved.”

Closing date for nominations: 16 February

Categories and criteria

Outstanding Team – Public Sector Private Sector (non-FS) Financial Services Sector Third Sector We want to hear about teams that have performed exceptionally and/ or have achieved exceptional results.

We are looking for teams that have overcome challenges (within their organisations or externally), have operated in new, unfamiliar or technically demanding areas or who have otherwise demonstrated exemplary professional auditing skills, teamwork and personal abilities. *In recognition of the fact that some third-sector teams are extremely small, nominees in the third-sector category do not have to be a member of the Chartered IIA or have a member in their team.

Inspirational Leader We are looking for a chief audit executive or a head of internal audit who has demonstrated not only superb technical skills, but who has also achieved exceptional results because of their leadership, strategic and soft skills. The winner will be inspirational not only to members of their own team, but also more widely within their organisation. They should demonstrate a clear view of the future

<

21

Closing date for nominations: 16 February

“What did the team aim to achieve and what evidence is there that they have achieved these goals?”

22

of internal audit and of the ways in which they are developing their team and the function to be fit for this future.

Evidence should include not only examples of successful audits, but also accounts of the ways in which this person leads their team, sets an example, encourages junior internal auditors and increases the influence of internal audit within the wider organisation. The judges also want to see evidence of the individual’s superior commercial acumen and of the ways in which they are actively supporting management and the organisation to deal with commercial challenges.

Innovation in Training and Development Has your organisation implemented a fantastic new training scheme or a new system for developing the skills of the internal audit team? Has it found a way to engage staff with their continuing development obligations or introduced better ways to share the collective knowledge and expertise of the team with peers and new recruits? We are looking for innovative ideas and lateral thinking about training and development as well as for evidence of improved results in the delivery of audit engagements or increased motivation to take and pass additional qualifications.

Let us know what was innovative about your training (for example, did it change the way you worked with other teams or

improve collaboration with colleagues across the organisation or the quality of overall governance and control?). The judges will be looking for a clear focus on the outcomes of the training and what it achieved in practice.

The Judges’ Award for Outstanding Contribution by Internal Audit to Furthering an Organisation’s Response to Climate Change Risk The Judges’ Award for Outstanding Contribution by Internal Audit to Enabling an Organisation to Gain Opportunities from its Diversity and Inclusion Agenda.

Nominations in these two categories should focus on the way in which internal audit has made a difference to the performance and outlook of their organisation. The judges will be looking for clear evidence of outcomes and results. What has internal audit done? What did the team aim to achieve and what evidence is there that they have achieved these goals?

The judges will want to see endorsements from across the business and a focus on the way in which the nominated team is helping to steer their organisation forward in these crucial and rapidly evolving areas. They will want to see evidence of real change and how this has benefited/is benefiting the organisation in practice (beyond the demands of regulatory compliance).

23

Time to talk; time to act

Sophie Malleson challenges audit committees to ask themselves whether they’re taking full advantage of their internal audit functions in tackling the growing risks from climate change, drawing on the Chartered IIA’s new guide, “Harnessing internal audit against climate change risk: a guide for audit committees and directors”.

24

T

he COP26 conference in Glasgow presented an opportunity for the Chartered IIA to look again at what it could do to help internal audit grapple with the challenges and opportunities presented by climate change. We know that this is arguably the most acute challenge facing our planet right now, and it is an issue that is moving fast up the agenda for businesses and governments. As a profession, internal audit cannot afford to be complacent.

What’s more, there are many compelling reasons why internal audit can lead and excel in this space. Not only do internal auditors have the skills, knowledge and experience to tackle climate-related risks and opportunities, they also have a “helicopter view” over, and a unique perspective on, the organisations they

<

25 25

“There has never been a better time for boards, and in particular audit committees, to start a conversation with their internal audit teams about the work they are doing on climate change.”

26

serve. Internal auditors should understand the organisation’s overarching strategy, as well as its composite parts.

This, coupled with their direct links to the board and open lines of communication with directors and the audit committee, puts internal auditors in a strong position to add real value to this everincreasing risk area. When we talked to our advisory panel of experts to help inform and shape our new guide, “Harnessing internal audit against climate change risk: a guide for audit committees and directors”, one of their strongest messages was that,

when it comes to grappling with climate-related risks and opportunities, communication between the audit committee and internal audit functions is key.

But when we talk to members across the UK and Ireland we see that organisations in different sectors are at very different stages on their individual journeys to tackle climate change. In some organisations, internal audit functions are carrying out innovative work and stepping up to lead.

But in others, climaterelated risks are rarely (if ever) discussed by the audit committee.

We want to be sure that audit committee chairs demand that their internal audit functions are fully engaged from all angles. Whether we talk about increased threats to supply chains caused by extreme weather events, or reputational damage caused by “greenwashing” and ill-thought-out environmental proclamations, or opportunities related to green investments, internal audit should be a critical friend, trusted adviser and independent assurer in all of these areas.

The Chartered IIA, too, has a responsibility to do all we can to encourage and support our members to rise to the challenges. Part of our role, and the purpose of this guide, is to engage actively with our members and encourage them to address the demands of an increasingly globalised and interconnected world in which complex and multifaceted risks and uncertainties come with the territory. There is no greater example of this than climate change.

With this in mind, the Chartered IIA is urging internal auditors to show their worth.

Our new guide isn’t intended just to increase demands

“We want to be sure that audit committee chairs demand that their internal audit functions are fully engaged from all angles.”

on internal audit teams. Its primary audience is audit committees, board members and directors. They also have a role to play and important questions to ask – we want them to initiate the discussions around climate change and the accompanying risks.

Few now question that organisations will face dire consequences if they fail to prepare for the transition to a more sustainable future and the physical consequences of climate change. It is now a question of “when” rather than “if” these happen. There has never been a better time for boards, and in particular audit committees, to start a conversation with their internal audit teams about the work they are doing on climate change. We urge directors to work in partnership and collaborate with their internal audit functions to ensure they are rising to the challenges.

Audit committees need to reflect on how they’re using

<

27

Internal audit and climate change

their internal audit functions. Could internal audit be doing more in this space?

For those organisations that haven’t yet started fully assessing what climate change means for them, we want to inspire audit committees to start these vital conversations.

28

Further information This isn’t the first time the Chartered IIA has looked at climate change risk. In 2020 we published “Organisations’ preparedness for climate change: an internal audit perspective”, looking at how internal audit teams were tackling this area.

We know from our annual Risk in Focus that climate change and environmental sustainability is becoming an increasing priority for CAEs across Europe and that this will only increase. n Sophie Malleson is policy and external affairs executive at the Chartered IIA.

Many internal audit teams across all sectors have already started work on a range of activities around climate change – some to ensure their organisations are equipped to meet increasing regulatory and compliance demands; some to assess specific risks to their operations and offer assurance on the commitments senior management is making to stakeholders; and some to help their businesses identify and capitalise on potential opportunities from innovation and new markets.

Education and collaboration are common themes, as organisations have to forge new relationships (and utilise those they have already) to mitigate risks that transcend traditional borders and sectors. Others are working to use their communications and products to influence staff and customer behaviour and to work in new ways with third parties and suppliers.

Internal audit may be involved in assessing the data used to inform strategic decisions and planning, in advisory work on new collaborations and scenario planning and in finding and assessing new sources of assurance in unfamiliar areas. We asked a few heads of audit to explain what they and their organisations are doing about climate change now – and what they expect to be doing in the future.

“Education and collaboration are common themes, as organisations have to forge new relationships (and utilise those they have already) to mitigate risks that transcend traditional borders and sectors.”

View from: Dermot Byrne, head of audit (Internal & EU Audit Unit), Department of Public Expenditure and Reform, Ireland Climate change is a risk that has emerged in a very short time span. My role includes leading internal audit for the two central Irish Finance Ministries – the Department of Public Expenditure and Reform and the Department of Finance. The first of these is responsible for expenditure allocations for the budgets of all Irish government ministries.

As well as ensuring that state spending is effective and sustainable, climate change

initiatives are monitored to ensure they meet the exacting and challenging demands set out in Ireland’s Climate Action and Low Carbon Development (Amendment) Act 2021 and other EU requirements.

Ireland has committed to cutting greenhouse gas emissions by at least 50 per cent by 2030, which is an ambitious target. Each time the government allocates money to a department, it asks a series of questions, one

of which is now: “What are you doing to combat climate change?” Our department then has to monitor how they are meeting their obligations.

The key sectors for climate change policies are: electricity and power; transport; the building sector (both public and private); industry; agriculture; and land use and forestry. The department’s focus is on financial oversight of cost-effective policies to encourage more climatesustainable practices among all our citizens and organisations. Although the government is only a small direct contributor in terms of greenhouse emissions, we also try to demonstrate a “do as we do, not as we say” approach to other organisations. Schemes to retrofit older buildings to make them more heat efficient must be able to demonstrate that this is having, or will have, the intended effect.

In addition, we need to be prepared for possible slippage in the achievement of targets or, indeed, the potential for more stringent EU targets in the future. And we need to identify conflicting targets – for example, the government needs to secure our national

<

29

30

energy supply, yet we still have electricity plants that are based on burning peat, which is not sustainable.

Importantly, in internal audit, we need to structure our work on climate change to ensure we are conducting meaningful reviews of the department’s key risks and the planned mitigations in place.

Many of these involve other government departments, where their own internal audit teams will have a role – we don’t want our work on climate change requirements and capital expenditure to duplicate what they are doing internally.

Our department needs to ensure that all climate change projects are assessed centrally and to the same standards in all departments – so we are consistent and can offer clear guidance on integrating climate change into capital expenditure. This may require extensive collaboration and a joined-up approach between different internal audit teams and managers in various departments.

Right now, our audit committee is asking how internal audit will incorporate climate change into our own departmental audits. Our three

“Our audit committee is asking how internal audit will incorporate climate change into our own audits.” key areas of concern would be expenditure pressures caused by increased climate ambition (ie, how much money will it cost to meet our climate change challenges and are our actions cost-effective?); whether the geo-physical impact of climate change will lead to economic damage (such as reviewing our actions to mitigate flooding); and the risk that failure to meet our climate change commitments could lead to compliance costs (eg, EU-regulated carbon taxes).

Over the past ten years, our internal audit team has sought to offer a more proactive and consultative approach. We hope this increased traction will help our review of climate risks mitigations. We recently conducted a review of culture in partnership with the HR function that was extremely successful and opened up areas where we previously had little involvement. I hope this has helped us to develop our role as a business partner.

Perhaps we can try to flag any gaps between the department’s climate change ambitions and the policies and actions being put in place. To some extent, we are starting with a blank sheet of paper. If we can’t look to commercial businesses for comparisons, we may look further afield to other governments, including the UK and our other European neighbours for successful and cost-effective initiatives. In the end, we are all in this together. n

View from: Jeremy Lawson, group internal audit manager, Persimmon Homes As a house builder, we are very alive to the risks of climate change and there are two main ways it affects our business. We have to consider how climate change will manifest itself physically – for example, how extreme weather events may affect build programmes and our land holdings. We also have to think about the requirements of the transition to a low-carbon economy – for example, potential changes to building regulations and energy standards, and the ways we will heat houses in the future (and who will bear the cost of this).

We are actively trying to get on the front foot on both of these. We’ve built our own concrete brick factory, because this helps to mitigate our supply chain risks and because concrete bricks are more sustainable than clay ones (typically, manufacturing concrete bricks produces 28 per cent

less carbon than manufacturing clay bricks). We also have fully accredited, science-based carbon reduction targets, and we have built a zerocarbon home as a demonstration project, so we can monitor its ongoing efficiency when people are living in it. This will help us to understand how we can build low-carbon solutions cost effectively at scale.

Internal audit has been involved in some of these initiatives. Three years ago, we worked with second-line functions to establish a climate change risk register. We didn’t own this process, but we facilitated it and we were well placed to help the business carry out the exercise.

This project also looked at transition risks – for example, the effect of new building requirements and how land availability may become constrained in higher flood risk areas. However,

<

“We’ve completed audits on waste management and sustainability disclosures and this is likely to be a growth area for us.”

32

we also looked at the opportunities for new markets – for example, offering customers low-carbon solutions such as vehicle charging points in houses – as well as ways to increase the efficiency of our own buildings and operations across our 31 operating companies and three off-site manufacturing plants.

Global prices and competition also affect us, because some of our materials, such as timber, come from overseas, so climate-change-related natural disasters (for instance, forest fires in Canada) can influence global prices and affect us in the UK. Internal audit has to understand these challenges, because we assist and advise the audit committee in discussions about the principal risks that the organisation declares in its annual report and accounts. The company recognises climate change as one of our principal risks and we need to show stakeholders that we are committed to actions to meet obligations and mitigate the key risks.

We have also started doing more assurance work on environmental issues. We’ve completed audits on waste management and sustainability disclosures and this is likely to be a huge growth area for us. I know there will be more demand for this kind of work in future, and doing the audit work now means that we highlight the issues to the board and help to prompt the discussions that management needs to have.

In future, sustainability is likely to be a key part of the work we will need to do to meet the new Audit and Assurance Policy that is likely to be introduced as part of current BEIS audit reforms. We must be in a position to explain how we provide assurance over all aspects of corporate reporting, including climate and sustainability issues, which for us could include tree planting or bio-diversity commitments. This will have to be robust, transparent and verified as rigorously as our financial figures. I feel strongly that internal audit is the ideal function to do this and to partner with the business to help it to establish new controls and procedures.

We need to help it to ensure that reporting structures for our sustainability figures are reliable and operating effectively.

Emerging risks and opportunities are another important area for internal audit in the future. We’ve just completed an exercise on our principal and emerging risks for the audit committee and the board, and climate change and sustainability were high on everyone’s radar.

More broadly, the organisation is exploring climate-related opportunities, but internal audit has not, so far, been involved in this.

However, it’s clear that our engagement with sustainability and the requirements around this subject are developing fast and will only gain traction in the next few years. Things are changing rapidly and internal audit will need to stay ahead of these changes. n

‘Watershed moments’ at Cornwall Council Cornwall Council has been on a sustainability journey for a number of years, but since it declared a climate emergency in January 2019 this has accelerated. “It led to an organisational shift that is so fundamental we’ve almost had to redefine the role of our local authority,” explains Steven Ford, the council’s head of environmental growth, climate change and heritage.

It was a “watershed moment” when the council realised the task ahead was far bigger than just getting its own house in order, he explains.

After the political declaration, they formed an action plan and undertook a series of resourcing and strategy-building exercises to inform and plan the way they would act to meet the stated aspiration of becoming carbon

neutral. “This changed the nature of our decision-making and planning, the way we travel to work and the way we travel within work and it led to a real change in the behaviour and consumption habits of staff.

It’s changed the way we work forever,” he says.

Changing the way council staff work and act was only one strand of the ambitious plan. It also looked to influence the way local businesses and residents act and the decisions they make by forming strategic coalitions with The Cornwall and Isles of Scilly Local Enterprise Partnership and The Cornwall & Isles of Scilly Local Nature Partnership.

Last, but not least, it identified where the council would need to collaborate regionally and nationally to

reduce carbon emissions and improve sustainability.

“The whole programme was underpinned by incredibly complex data – we needed to know where we already were before we could establish where we wanted to go,” Ford adds. “And we needed to find people with the right skills, which was challenging in itself.”

One solution was to work with local universities to develop necessary skills. However, they also wanted everyone who worked for the council to understand how they could contribute by changing the way they worked and lived. They developed a climate literacy course for all staff and asked them to identify ways to make their jobs more sustainable and to pass on what they learnt to friends and family.

Another campaign targeted tourists with a “Love where you are” message via QR codes at beauty spots asking visitors to pledge money to community environmental initiatives.

“The council’s operations make up about 1 per cent of Cornwall’s emissions, but we believe we can influence up to 40 per cent of the Duchy’s emissions via our collaborations with businesses

<

33

“One campaign targeted tourists with a ‘Love where you are’ message via QR codes at beauty spots asking visitors to pledge money to community environmental initiatives.”

34

and organisations such as the NHS, and by educating residents,” explains Mark Holmes, Carbon Neutral Cornwall manager at the council.

There are specific challenges. The largest cause of emissions in the county is transport, but electric buses and waste collection vehicles currently won’t cover the distances needed in rural communities. Half of Cornish houses have no gas and are powered by oil and electricity.

Enabling council employees to work from home one or two days a week was first introduced to reduce vehicle emissions, but Covid lockdowns accelerated this scheme, when everyone switched to remote working. While people use energy working from home and the aim is for Cornwall, not just the council, to go carbon neutral, Ford and Holmes are confident that it has had a net positive effect on emissions over the past 18 months based on the average energy use at home versus the previous average commuter journey. One of their tasks is to work out how to keep these gains in a post-Covid era.

Finding and verifying the data on which to base strategy

has been challenging.

Established international standards could be used in some areas, but in others the council had to identify the data it already had and what it needed to collect in future, as well as whether this could be crossreferenced and then refined and put into a usable format.

The internal audit team has provided independent assurance on this data, its sources and the way it is used to inform decisions. Beyond this, however, the internal audit team has also undertaken a higher level appraisal of risk, including examining the scale and size of the challenge and assessing whether the council is fully prepared for physical

climate change risks, as well as those created by the transition to a lower carbon future.

“We have a three-pronged approach to strategy. The first part deals with the climate change emergency and how we decarbonise.

The second focuses on the ecological emergency, including bio-diversity and nature recovery. The third concerns environmental resilience and climate adaptation, for example, natural flood management.

These all interlink,” says Ford.

“Internal audit is working out how these come together in its strategic assessment of risk.

We’re working with the internal auditors to get a granular look at what climate change risk means – because, to a certain extent, the genie is already out of the bottle.”

Ford adds that he views the council’s internal audit team as a valuable partner.

“What internal audit tells us about future risks is extremely helpful to us,” he explains.

“Their assessment has more impact as it is viewed as being independent, rather than us marking our own homework.

They give management an independent view of what we’re doing and what needs to happen." n

New opportunities for collaboration at Northern Ireland Water Water is not only a vital utility, but it is also a front-line resource when it comes to climate change. Northern Ireland Water has had to operate under drought contingency conditions for the past three out of four summers, so is well aware of the potential risks to its operations.

However, the business is also working hard to prepare itself to take advantage of opportunities for innovation and collaboration.

“A risk analysis and scenario planning exercise is under way looking at the impacts of climate change on our operations – from physical risks to the financial and supply impacts, and also considering organisational transitional risks,” explains Nicola Brennan, head of internal audit at Northern Ireland Water. “For example, our assets on low-lying land are at risk from rising sea levels and flooding, while recent exceptionally dry and warm summers have shown that we need to plan for building in additional resilience. The

35

business is looking into various initiatives, such as recommissioning some smaller water treatment works and using borehole supply. Some pilots are already in action.”

The problem, she points out, is that demand for water rises sharply when it’s hot – at the very time when the reservoirs are at their lowest and water treatment processing is running at capacity limits. During these recent warm summers, operational teams have worked relentlessly to transport tankers of water to areas where the reservoirs are lower to avoid supply disruptions, which also comes with a cost. “We can already see that climate change is real and is happening here,” she says.

This is one reason why the company has been conducting advertising campaigns to educate customers about water consumption. Last-resort measures, such as hose-pipe bans, damage customer relations and are a reputational risk,

<

36

so the organisation is working hard to raise awareness of the issues and help customers to reduce their consumption.

Meanwhile, the internal audit team is examining the company’s preparations to meet future reporting requirements established by the Task Force on Climate-Related Financial Disclosures (TCFD). Northern Ireland Water is not yet required to report against these, but last year Brennan’s team commissioned their co-source partners to help them conduct a gap analysis so they can ensure it will be fully prepared when it is.

“This provided a framework so we can pull together all the good work the company has already done and produce a coherent and comprehensive action plan for those activities that still need to happen,” Brennan explains. “The company is currently developing its climate change strategy, including its net zero carbon routemap, and internal audit will be involved in ongoing advisory work supporting this. Then in the future it will provide assurance over the implementation of this and associated reporting.”

But it’s not all about risk. While the business has been examining its energy consumption – it is the largest user of electricity in Northern Ireland – it has also identified significant opportunities to assist an integrated low

carbon energy system for Northern Ireland involving novel collaborations with other utilities, businesses and across government, and Brennan is considering the skills the internal audit team will need to provide the necessary assurance as these progress. “As the largest landowner in Northern Ireland, and with a lot of that land on high ground, there’s significant potential for wind turbines. Also, with over 3,000 sites connected to the grid across the province, we could potentially provide an enterprise battery solution for Northern Ireland, capable of storing electricity from renewable sources and feeding it into the grid and local networks as required. We are currently running a pilot scheme to use the electrolysis process to create green hydrogen as a by-product of the wastewater treatment process, which could be used to fuel vehicles or heat homes,” Brennan says.

“There are lots of potential new partnerships and revenue opportunities, which will also contribute to decarbonisation for Northern Ireland Water and the wider province – but also lots of new issues for internal audit to consider in the future. The critical thing for me is that we identify when and where it is most appropriate for internal audit to be involved,” Brennan says.

“At the moment, the organisation is still setting out the possibilities.” n

Your

38

“The future is not something that is going to happen to us.

We will make our own future.”

future ¯ you decide Richard Chambers told delegates at the Internal Audit Conference that the only people who would determine the fortunes of the profession over the next decade would be themselves.

Words: Ruth Prickett

“Everyone makes predictions about the future as if there is only one probable outcome – I believe there is a range of different possible scenarios and that, if you apply bird analogies to the internal audit profession, we could dive, glide or soar in the coming decade,” says Richard Chambers, former president and CEO of IIA Global. If there’s one message he wanted delegates to the Internal Audit Conference to take away, it’s that internal auditors are the ones who will decide which scenario materialises.

“It’s up to us, not external factors,” he says. “The future is not something that is going to happen to us. The only thing that will happen to us is us – we will make our own future. We have to make it happen.”

He believes that the profession is at a crossroads. A series of crises in the past decade, from the aftermath of the financial crisis of 2008 to scandals resulting from poor corporate cultures, led to an increase in guidance and legislation. For many internal auditors, this was a chance to increase their profile and help managers as they worked out what this meant for their organisations.

Then came the pandemic. “This

<

39

40

was the most disruptive event in the history of the internal audit profession,” Chambers points out. “It reached into every crevice of organisations across the globe and put renewed pressure on internal audit functions to demonstrate their abilities.”

But even those internal audit teams that proved their value and emerged with increased respect and status cannot rest on their laurels.

They should already be looking ahead to see what the future holds, he warns. If nothing else, the pandemic showed us the speed with which risks change – even risk assessments completed in June 2021 were often out of date four weeks later because of the emergence of the delta variant of the virus. Who knows what is around the corner?

“That’s the speed of risk today and why we need to be able to deal with it in a dynamic environment,” he says.

Executive table or children’s table?

The availability of talent will continue to be a huge risk and soft skills for internal auditors will be a basic requirement. “These are the ‘table stakes’ in gaming terms – you will need skills such as critical thinking and communication before you can even start to act as a strategic adviser,” Chambers warns.

In a recent poll asking for the five strategic risks that will be critical in the decade ahead, over 700 internal audit leaders identified the chief risk to the profession as internal audit’s ability (or inability) to assess risk.

“If this is where we are in the current environment, where might we go in the next decade?” Chambers asks. “The first scenario is that complacency causes us to dive and

“You will need skills such as critical thinking and communication before you can even start to act as a strategic adviser.”

our stature is diminished. I don’t believe that it is likely that internal audit will disappear in the next ten years, but I can see a situation in which our stature is lower than it is today.”

The chief causes of this, he argues, would be internal audit’s failure to identify emerging risks, leading to repeated situations in which a disaster occurs without any preparation by, or warning from, internal auditors. This could exacerbate “stakeholder fatigue” and encourage organisations to invest less in assurance and oversight. “If we don’t spot emerging risks we will end up at the children’s table, rather than the executive table,” he says.

This is not just a macro risk to the fortunes of the whole profession, but a risk to each and every internal audit function in every sector, he adds. Even if the profession as a whole soars, one weak individual function that fails to prove its value could decline. The threat is therefore personal as well as general.

The second feasible scenario is that the profession glides along, but does not gain stature or recognition. “Internal audit functions that adopt a ‘don’t ask, don’t tell’ approach, and which fail to identify and highlight to the board areas that they do not currently cover adequately, or that do not invest sufficiently in technology and upskilling, will rely on a disaster not happening on their watch,” Chambers says.

“Those that neither sail towards storms, nor seek to avoid them, will have to deal with whatever fortune throws their way. Most are likely to end the decade with their reputations intact, but not seen as indispensable.”

He acknowledges that it can be difficult to admit you’re not doing something, or that you lack the skills to address a specific risk,

<

41

42

and that this creates a temptation to ignore potential problems (particularly if no one else seems to have spotted them). However, internal auditors in his third scenario – who will soar in the next ten years – would take control of such risks and put them firmly on management’s agenda.

Internal auditors in this category will have dynamic audit plans that are continuously updated to take into account rapid changes in an evolving environment. They will embrace technology and “future-proof their value” by upskilling and developing to meet emerging risks. “It’s not a question of just introducing Agile techniques; we need to develop an agile mindset,” he says.

So which of these scenarios does he think is most likely to transpire? “Probably 2.5,” he says. “Over the past decade, the profession has glided with a slightly upwards trajectory and if we don’t apply ourselves and aim higher, this will continue – like the bright child at school who doesn’t aim to get A grades,” he explains.

“I think we should be aiming higher than this.

Change isn’t just happening to internal audit, it’s happening everywhere. The speed keeps accelerating and we have less reaction time and less time to anticipate what’s coming next. But this is exciting – if I were earlier in my career and in a chief internal audit role, I would relish this challenge.”

Beyond the cone of certainty Too often in the past, organisations after a crisis have asked “where were the internal auditors”, he adds. “The question

“The question that chief executives ought to be asking is ‘where are the internal auditors – I need them’.

You can’t believe you’re valued if you never get a text demanding your immediate attention.” that chief executives ought to be asking is ‘where are the internal auditors – I need them’. You can’t believe you’re valued if you never get a text or a message demanding your immediate attention.” There is a direct correlation between the value you bring and how often you are asked by management to engage with them, he adds.

Key emerging threats in the coming decade will include risks from climate change and the environmental, social and governance (ESG) agenda, as well as evolving risks from artificial intelligence and data. Internal auditors will not be able to

43

offer assurance on every threat, so they need to become smarter about identifying those that matter, Chambers points out.

“Lots of internal audit teams are still working to keep the lights on day to day. The issues that enable the organisation to operate smoothly are important, but internal auditors need to increase their value by moving up to focus more on existential threats to the business,” he says.

“The vast majority of internal audit departments are not anywhere near that at the moment.”

Internal audit is generally good at thinking and planning for short term risks, but is not so confident thinking beyond the next year, Chambers explains. “It’s true that if you don’t survive today, you won’t need to worry about

tomorrow, but we need to get better at looking to the long term,” he urges.

“There’s a term ‘cone of certainty’ that applies to hurricanes and is important if, like me, you live on the coast in Florida – it shows the likelihood of being in the direct path of an approaching tropical storm and becomes clearer as the storm gets closer,” he explains.

“I watch storms coming off the East African coast and then monitor them carefully. Most will not turn into anything, but if I wait until a major storm is three days away then I’ll find it hard to get provisions or evacuate before it hits. Internal auditors need to monitor longterm risk like this – we need to plan tactically and think strategically. n

44

The closing date for nominations for the next Audit & Risk Awards is 16 February 2022.

Pulse of change When Covid struck in 2020, the Risk and Assurance team at the British Heart Foundation responded with innovations that will significantly change the way it works long after the pandemic is over. As a result, the team won the A&R Award for Change and Innovation in a Crisis, and was highly commended in the Outstanding Team – Third Sector category Words: Ruth Prickett

C

harities exist to raise and distribute funds, so what happens when key elements of their funding supply are cut off overnight? This is the situation that faced the British Heart Foundation (BHF) when the first UK Covid lockdown abruptly closed their network of 730 shops and cancelled all of their face-to-face fundraising activities. The way in which the charity’s Risk and Assurance (R&A) Team responded to the disaster, changed the way it worked, supported operations and management and introduced innovative ways of working, won it the Audit & Risk Award for Change and Innovation in a Crisis, as well as a commendation for Outstanding Team – Third Sector.

“During the crisis, our income took a massive hit – we were losing millions of pounds each month, because our retail network was unable to trade and all of our face-to-face fundraising events, such as the London to Brighton bike ride, were cancelled,” explains Rohan McMillan, head of risk and assurance at the charity.

His team of 11 people is split evenly across retail and non-retail operations. On the retail side, most of the R&A team were furloughed in the first lockdown, since they were unable to undertake shop visits. But when the second national lockdown began, many were redeployed into other departments to offer their skills and expertise in areas from health

<

45

“Remote working for at least a few days each week is likely to remain important.”

46

and safety to IT and finance. Managers were aware that this could lead to questions about independence once these people returned to internal audit, but McMillan was confident that their co-sourcing arrangement would enable them to manage this risk.

“I was keen to put our team front and centre of the BHF’s Covid-19 response in order to actively support this and our organisational recovery. From the outset, it was clear the team had a unique set of skills and attributes which could easily be deployed to support the response, while ensuring impartiality and fairness as we returned to our roles in the future,” McMillan says.

“There was some initial resistance to crossing boundaries, because we are naturally keen to protect our independence and objectivity, but it was obvious that we had to roll up our sleeves and use our talents and skills to help out, and it was in keeping with our values of ‘brave, informed, compassionate and driven’,” he adds.

“We’ve used the IIA Code of Ethics as the basis of discussions about what we should and shouldn’t do but, as a result of getting involved, we are now more adaptable and flexible and it increased our confidence and our exposure in the charity. We are asked for our opinion far more now than we were before.”

The team is also responsible for risk management and, from the outset of the pandemic, it was clear that it needed to reprioritise its risk focus. Working closely with the executive group and management, the organisation’s risk manager, Alex Paterson, conducted a full review of the BHF’s risk registers to help reprioritise the focus and approach during the pandemic. This meant that they could temporarily remove many longer term strategic risks and focus on those that were more critical.

McMillan and Paterson also joined the BHF’s Gold Coronavirus Response Group, convened to co-ordinate the organisation’s actions from the start of the crisis. Over the following couple of months, management asked the team to establish and lead two additional response groups – a Silver Second Wave Group focused on plans to re-open shops and prepare for subsequent lockdowns or restrictions related to Covid-19, and an Incident Response Group, which met daily to track national and local news stories as well as government reports.

This provided a single source of information to underpin business decisions and help the charity to ensure that it operated safely and in compliance with Covid safety rules.

Business as unusual Realising that their planned audits were both impractical and no longer focused on current priorities, the corporate audit team, led by Frankie Johnson, introduced a revised audit process, which produced short lessons-learned feedback reviews that took around three weeks (rather than the usual eight for a full audit). These did not offer full assurance but did ensure that management

“The team worked with colleagues in security and income protection and in central operations to develop a range of new ways to monitor premises remotely.” received key learnings about the charity’s business continuity so they could adapt and respond rapidly.

In turn, the short reviews enabled internal audit to explore and develop new agile auditing techniques that they could use to improve and accelerate the way they deliver audits once their “normal” audit routine began again.

When it came to the retail sites, all full site audits were postponed, but retail audit manager Tim Baker developed a “support visit” programme that could be delivered by the audit team under Covid safety rules. The programme focused on helping individual shops to re-open and staff to return to work safely after lockdowns.

The auditors also captured data and feedback that they reported regularly to central operations on how effectively the Covid safety precautions were being embedded to help ensure that any issues were identified and addressed quickly.

McMillan is confident that this timely interaction of feedback reviews and support

visits, which enabled rapid and targeted action, strengthened the reputation of the R&A team in both the retail operations and across the wider organisation.

Well covered One big challenge during lockdowns was to satisfy insurance requirements for unoccupied premises and to find new ways to assess and monitor shops while they were closed. The team worked with colleagues in security and income protection and in central operations to develop a range of new ways to monitor premises remotely and flag up anomalies that might indicate a need for a physical maintenance visit. Using live CCTV feeds, electricity usage data and till network connectivity reports, the team was able to identify issues including burst pipes, storm damage and possible intruders. Monitoring the estate remotely meant that the team could

<

47

“We established a virtual ‘coffee morning’ every day at 9am to help us catch up with each other socially.” satisfy insurers without putting staff at unnecessary risk.

An unexpected bonus was that the team managed the transition to a new insurer during the pandemic and the new arrangement saved the charity £80,000 a year.

McMillan points out that switching to a new insurer typically involves collating information for the tender from every one of the charity’s directorates and this was the first time it was all completed remotely.

48

Lessons for the future McMillan believes that the R&A team has learnt to be more empathetic during the crisis and has increased its reputation and its understanding of the organisation and the people who work in it.

“We found that the three-week feedback assessments and support visits went down very well with managers and teams in other functions, because we really knew how people were responding to, and coping with, change.

Within the team, we established a virtual ‘coffee morning’ every day at 9am to help us catch up with each other socially and raise spirits. We’ve kept this going and now do it three days a week,” he says.

Remote working for at least a few days each week is likely to remain important in future. Experiences in lockdown demonstrated how efficiently the team worked from home and McMillan hopes that a flexible working environment will help them to recruit people with scarce skills, such as IT, from further afield, as well as accommodating staff who already live further from offices or who have

moved away from cities.

“While the technology and the use of Teams has held up incredibly well, so too has our team’s appetite for working in a different and dynamic manner. Daily team meetings help to bring the R&A team together more, meetings with stakeholders tend to be more focused and regular, while still informal, ‘side-bar’ chats have replaced tea point catch‐ups,” he says.

They have also learnt lessons from the changes they made to audit planning and McMillan says these will continue to evolve in the post-pandemic era. The team has restarted eight- to ten-week risk-based in-depth audits, but is also using more agile audit planning. It has abandoned its former 12-month planning cycle and introduced an Audit Log, which it re-visits with management and the audit committee each quarter.

“We give feedback on what we’ve done and our priorities for the next period and report this to the audit committee each quarter. We’re confident about our plans for the next four to six months, but after that we’re not committed to any particular audits and can respond to emerging needs and focus assurance where it’s needed most,” he says.

The R&A team is currently engaged in a third round of scenario planning, trying to work out what is likely to happen in the crucial retail season before Christmas and considering the risks of a bad flu season, recruitment challenges, changes to shipping charges, rising gas bills and the effect of increased ventilation in shops on heating. “About a quarter of my work is still focused on Covid-19 issues,” McMillan says.

Key facts: British Heart Foundation

730 shops

£100m pa paid into medical

4,000 employees

research (in normal years eg, 2019-20)

19,000 volunteers

£300m pa turnover

(in normal years eg, 2019-20) He adds that they will need all their new flexibility to deal with rapidly developing risks, such as the impact of climate change. “Two or three years ago, this was not a big issue for managers, but now it’s important and we can see many potential impacts from it, so I think it will be a key audit in the coming year,” he says. “It may be that demand for our services from cardiovascular patients will increase as a result and we will need to plan accordingly. In our retail division, we may need to look differently at seasonal stock and we have a social responsibility to think about our fleet, and how we heat our offices and shops. We also need to consider what effect hybrid working has on our carbon footprint.”

However, McMillan is confident that the charity is in a much stronger position if another national or international calamity occurs in future. “As an organisation, we are much more flexible and agile than we were. Some of this is down to technology. If the pandemic had

happened two years earlier the situation would have been very different. But we mustn’t get over-confident and believe we’re prepared for anything – for example, we have been hugely dependent on digital tools and everyone’s home broadband during the crisis. If this stopped working it would hit everyone,” he warns.”

He believes that management is now more appreciative of internal auditors’ broad view of the organisation and realises that it can be a source of innovation and ideas.

“Rather than being seen as wholly focused on risks and controls, we can also help to spot improvement opportunities in the organisation,” he says. “This is more interesting for us and is appreciated by managers.”

McMillan knew his team had done well, but winning the award gave everyone a “huge buzz”.

“We’ve got cracking people here who have worked so hard, so it was great to be able to show management that this has been recognised.” n

49

FUTURE SHOCK 50

Business models are being disrupted at a dizzying pace. Many companies are having to seize upon new markets and revenue sources to recapture growth and ensure their long-term relevance. Amid this strategic pressure, what can internal audit bring to the table?

Words: Brendan Scott

S

trategic obsolescence is a very real threat. Take the high street. Amazon steadily chipped away at physical retail for years, before the advent of smartphones gave shoppers the ability to buy anywhere, at any time and at the lowest prices. This alone was already weakening the proposition of undifferentiated retailers. Then along came the pandemic and made matters even worse, especially for those with poor digital customer channels.

Many established business models across sectors are rapidly losing relevance, and they need to pivot strategically to recapture growth. John Lewis is one of many companies that is branching into uncharted territory.

In a fundamental departure from its roots, the co-operative last year decided to become a residential landlord, with plans to build 10,000 rental homes above or beside Waitrose supermarkets around the UK as part of a strategy to bring profits to £400m within five years. In addition, John Lewis (alongside furniture retailers DFS and Sofology) is embracing the “circular economy” by partnering with the peer-to-peer rental marketplace startup Fat Llama. Instead of buying a sofa or kitchen table, shoppers can now have items delivered and rent them for as long as they’re required.

<

<

“Lack of change may destroy the business’s long-term viability.”

“Fashion brands are encouraging shoppers to return used clothes to be resold.”

52

Meanwhile, clothing retailer H&M has launched Resell, a digital platform for the resale of its clothes and other fashion brands are also encouraging shoppers to return used clothes to be resold. Vehicle manufacturers know that carbon commitments are changing the market for petrol, so carmaker Jaguar announced earlier this year that all of its vehicles will be electric by 2025. The list goes on.

The basic premise behind all these rapid foundational transitions is to make businesses more strategically relevant and futureproof them to meet the evolving needs of consumers. Such change creates its own risks, while lack of change may destroy the business’s long-term viability – so where does internal audit fit into this equation?

Changing course Traditionally, internal audit focused largely on the technical issues of controls and processes. More recently, however, it has become important for internal auditors to be more strategically minded – they must look more broadly at the external environment and emerging risks, not only flagging up declining markets, but also opportunities for growth. This is a more interesting, but also a more challenging role, asking more of internal auditors and of chief audit executives (CAEs).

Done well, it creates far greater value for the business, but requires the CAE to have a highlevel profile and a voice that is heard at the top levels of management.

Julie Gooderham, director of audit and risk at John Lewis Partnership, believes that internal

audit’s ability to carry out this role depends on how the three lines are established in the organisation and the position of the CAE at the senior table, in terms of trust and access to information. In her case, she oversees both the third and second lines, the latter being very much responsible for challenging the possible impact of strategic decisions on the business from a risk perspective.

“If there was interest at the executive and senior management level to move in a new strategic direction, the second line risk team would challenge them to understand the risks of going down that route and ensure that all aspects of the business are taken into account in thinking about potential risk.

For example, that might include the impact on customers, partners and on achieving our ethics, sustainability and wider business purpose,” she says.

“The risk team would generally be involved much earlier than internal audit, helping with the development of senior management’s thinking and why they might move in certain ways,” she adds. “However, if there is high risk change at pace, as we see in the current environment, internal audit may be independently involved in testing management’s operational thinking as it develops detailed plans and communications on change, for example. But early on in strategic thinking I wouldn’t necessarily expect management to have planned for, or really understand, every impact on the control environment.”

At John Lewis Partnership, the second line

53

“More recently, however, it has become important for internal auditors to be more strategically minded – they must look more broadly at the external environment and emerging risks, not only flagging up declining markets, but also opportunities for growth.” would also begin to push decision-makers to extract the next layer of detail on risks and opportunities and mitigation planning, Gooderham adds. This helps to join the dots across the business using the risk function’s knowledge of the wider Partnership, how the change will be achieved, what risks need to be mitigated and what the business can learn from past experience.

“The risk team would be asking things

like: Have you considered the impact on sustainability plans? Are you confident that you have the right capabilities to manage this type of contract and deliver the service at the pace and quality required? Is it a new market?

What is the information security and data management risk? What regulations need to be considered? Have you thought about X or Y?” Gooderham says.

Internal audit tends to come in once a

<

“Kenneth Chen, vice-president of finance strategy, operations and risk at Spotify, who was formerly the company’s CAE, says that the idea to move into podcasts was part of company strategy long before the pandemic.”

54

decision on direction and accountability has been made. “Internal audit is best placed internally, because it knows how the business works at a level of detail. It focuses independent challenge on the quality of plans, capability in its broadest sense, controls and mitigations,” she explains.

“If some of the objectives were to put new capabilities in the business, I’d want internal audit to understand whether the business has those capabilities and the route to build them.

It knows what good looks like, in terms of both operations and the softer stuff.”

At a more tangible level, she says that she’d expect internal audit to review aspects such as risk registers and the clarity of mitigation plans.

“They would need to talk to project teams to understand the operational and contractual arrangements in place if we’re moving into a new venture, all of the elements around customer service management, compliance and data. Internal audit needs to kick the tyres and get into the nitty gritty of the efficiency and effectiveness of the control environment.”

Coming on stream Meanwhile, in a very different sector, executives at music streaming provider Spotify made a strategic decision to move into proprietary content. They decided that

offering music also available on other streaming platforms is not sufficiently differentiated, whereas exclusively hosting the world’s most listened-to podcast – the Joe Rogan Experience – among a library of other “pods”, attracts an audience for advertisers and converts new subscribers.

Kenneth Chen, vice-president of finance strategy, operations and risk at Spotify, who was formerly the company’s CAE, says that the idea to move into podcasts was part of company strategy long before the pandemic and had nothing to do with internal audit raising its hand. However, the third line has been deeply involved with the change.

“Internal audit’s role in the grand scheme of things was to ensure that, once these strategic decisions were made, the business didn’t execute them without regard for the risks, and that we were able to provide a point of view on where the execution risk is.

Where could we take a wrong turn that might mean the return on investment takes longer, or that we make some serious mistakes that could pull us back? We’re a big part of those conversations,” he says.

As an objective function, internal audit doesn’t need to clamour for a seat at the table at every turn, Chen adds, but it can be a helpful business partner by providing input

55

once decisions have been solidified, and teams are established with responsibility and accountability for the strategic change.

“In a company like ours, ideas are constantly being floated. Teams experiment, test things and throw ideas at the wall to see what sticks.

You want to give them space to experiment and figure out what’s the right product mix that fits with our customers and creators,” he says. “If you don’t give them room and are constantly reminding them of all the downsides, it’s suffocating and they’re not going to want to talk to you.”

However, once teams embark on their multi-year journey of executing the strategy,

internal audit can come in and give its opinion, evaluating, for example, whether the business has the operational muscle to support the rollout of the new business model, or the teams and infrastructure to address new risks that arise as a result.

“Podcasts introduce an interesting set of new challenges. They are spoken word, a lot of new episodes come in every day and there are guests on these shows. They open a whole new realm of risks that we didn’t have to deal with when it was just recorded music,” Chen reflects. “And we need to assess the risks from a different vantage point and work together with the teams as they implement

<

56

“CAEs need to understand the industry and the business and use that commercial knowledge to call out the elephant in the room.” different processes and systems to support our podcast strategy.”

Discomfort zone In these two examples, internal audit didn’t highlight the commercial opportunities that the businesses have taken up, they came in to check that everything was in place to support the change process once decisions had been taken. But there is also scope for CAEs to flag

up whether the business is making adequate efforts to adapt to changes in the external world, says Amy Brachio, EY’s global business consulting leader.

“The pandemic was a wake-up call. It really accelerated the sense of threat, particularly for businesses in sectors that hadn’t been evolving. This has caused boards of directors to ask whether enough is being done to understand existential threats to their

“Access to external data can be really helpful.

That can come in the form of benchmarking data or macroeconomic and sector trends.” organisations, and whether they are sufficiently future-proofing themselves,” she says. “But for internal audit to serve in that role, it has to be viewed as strategic by the organisation. It has to have a seat at the table and you need a CAE with the appropriate business acumen.”

This may be outside some CAEs’ comfort zones. A central question is how do you begin to determine whether strategic or future operational risks are being appropriately analysed by the business when, by their nature, they are hard to quantify?

What’s the benchmark?

“It does get trickier than when you are auditing against a compliance standard. But what it gets to is a clarity of understanding of the strategy and then asking what steps are being taken to understand the risks to that strategy,” Brachio says. “Access to external data can be really helpful. That can come in the form of benchmarking data or macroeconomic and sector trends. Internal audit can highlight that it’s seeing these risks and that organisations within the same sector are having significant issues as a result of not adapting fast enough or adopting certain technologies.”

The CAE needs to collate these insights and have a seat at the table when strategic decisions are being weighed up, so they can use them to challenge senior management.

That requires confidence and an acceptance that the concerns they raise may not always be well received, says Janet Barberis, managing director in Protiviti UK’s internal audit and financial advisory group.

“CAEs need to understand the industry and the business and use that commercial knowledge to call out the elephant in the room. You might not be popular as a result, but it’s necessary as it’s part of the value creation to the organisation,” she says. “As internal auditors, we always like to have the evidence behind us to back up everything that we do and having that will add weight to your challenge.

However, you might not always be in a position to show that evidence and sometimes it’s really about using your own judgment.”

Don’t assume that everyone sees the same information. The broad view that internal audit has across an organisation may mean that the CAE can deliver insights that are not obvious to management, and which may help them to make better strategic or fundamental operational decisions.

“We’re in a unique position to compare and contrast data that individual business units may not be able to, or think to, assimilate,” says Sam Cornish, a director at Protiviti UK. “Internal audit is almost a broker in that way.

It could be unpopular, because you might tell the business things they don’t know and haven’t considered. But that can really help with decision-making and it’s something we’re seeing more and more departments wanting to do and being able to do, especially over the past two years with the challenges that companies have faced.”

The world is changing faster than ever and more and more companies in all sectors are making existential decisions about their futures. The unique insights of a strong internal audit team could make all the difference. n

57

Tools for the job

““

QUALITYASSURED

T 58

here’s rarely been a better time to think about developing your career. As we emerge (we hope) from the Covid crisis and return to normality, businesses are crying out for experienced well-qualified people in every sector and type of job. Many internal audit teams have transformed the way they work during lockdowns, winning important friends across the business on the way. Internal auditors have learned new skills and demonstrated their versatility and the value of their role.

Now, we keep being told, is the time to build on this momentum to develop the people internal audit will need in the future.

Chartered membership of the institute is an important indicator of professionalism and experience, and will always be valuable on a senior internal auditor’s CV. This is why the institute has been working over the past year to develop a new syllabus to help aspiring internal audit leaders develop the advanced managerial and strategic skills they need

The institute is introducing a new route to Chartered status (CMIIA) designed to provide internal audit leaders with the skills they need to develop the internal audit teams of the future. to demonstrate to gain the Chartered designation – the right to call themselves CMIIA. The new syllabus and course will focus on helping candidates to develop crucial higher level skills, as well on assessing them. It is intended to build on the foundation CIA qualification to help more experienced internal auditors develop skills in

areas such as leadership, planning, talent management, strategic assurance and risk assurance that they will need to lead an internal audit team at a time of rapid change and many new challenges.

While the maximum period of study to gain accreditation will be capped at three years, the programme is intended to be flexible, so candidates can choose to do the sixmonth modules concurrently and finish in 18 months, or spread them over the longer period. Each element will be fully supported with a blended programme of online training sessions taught by experienced tutors, and via forums, videos and packages of training materials.

Candidates will be able to access all the content online, so can complete it from anywhere in the world and, in the

“Candidates will be able to access all the content online, so they can complete it from anywhere in the world.”

“Chartered membership of the institute is an important indicator of professionalism and experience.” case of private study, at times that suit them best.

Importantly, the new syllabus will be a level seven apprenticeship, equivalent to a Masters degree, so the relevant parts of the apprenticeship will be updated accordingly. The new syllabus will form the backbone of the Birmingham City University MSC in internal audit management and consultancy and the Internal Audit Professional apprenticeship, all of which will lead to Chartered status.

Candidates who are already studying for IIA Global’s Qualification in Internal

Audit Leadership (QIAL) via the Chartered IIA will be able to transition to the new Chartered syllabus, or they can choose to continue studying for QIAL. Not everyone aspires to be a head of internal audit or a chief audit executive, however for those that do, the new programme is intended to offer a structured, supported route to gaining crucial senior level skills. The new elements have a strategic and an operational element and they will continue to be developed to ensure the programme meets changing needs.

The world has changed

rapidly in the past couple of years. Internal audit needs to change just as quickly to keep up – and even faster to get ahead. Businesses need highly skilled, experienced internal audit leaders who have the connections and relevant knowledge to build and lead the teams they need now and in future. Anyone who gains the Chartered designation should be equipped to do just that. n The new route to Chartered internal auditor status is now open for enrolment and courses will start in March 2022.

59

Q&A Our technical helpline provides valuable advice to members on a host of professional issues. Here are some of the questions you’ve recently asked.

60

Q I am a head of internal audit for a multinational organisation. I have a small team and management has proposed that I use locally based compliance teams to do my testing. Can I adopt this cost-effective approach and still comply with the IPPF? A With appropriate safeguards in place, it is acceptable for internal audit to rely on the work of other assurance providers. The IPPF recognises that internal audit is one of a number of assurance providers with different remits. Both the IPPF and

the revised Three Lines Model, as outlined in A&R magazine (issue 56), make the case for coordination to avoid duplication, overlap or gaps in assurance.

Standard 2050 Coordination and Reliance addresses this point. “The chief audit executive should share information, coordinate activities and consider relying upon the work of other internal and external assurance and consulting service providers to ensure proper coverage and minimise duplication of efforts.”

Interpretation of the

“Where reliance is placed on the work of others, the chief audit executive is still accountable and responsible for ensuring adequate support for conclusions and opinions reached by the internal audit activity.”

Standard states: “In coordinating activities, the chief audit executive may rely on the work of other assurance and consulting service providers. A consistent process for the basis of reliance should be established, and the chief audit executive should consider the competency, objectivity and due professional care of the assurance and consulting service providers. The chief audit executive should also have a clear understanding of the scope, objectives and results of the work performed by other providers of assurance and consulting services. Where reliance is placed on the work of others, the chief audit executive is still accountable and responsible for ensuring adequate support for conclusions and opinions reached by the internal audit activity.”

Members may also find the supplementary guidance for this Standard useful as it goes into detail on the topic. n

Q I work for a medium-sized company that has started to make commitments relating to climate change. My chief audit executive is reluctant to include anything related to environmental, social or governance (ESG) on our audit plan, preferring to focus on traditional compliance and financial risks. How can I get this on to our audit plan for 2022?

A The Chartered IIA recognises the challenge for chief audit executives (CAEs) to balance the audit plan and provide assurance over risks that are new or high profile, such as climate change, culture, inclusion and diversity, etc.

Your CAE, in common with those in many organisations, is on a journey and some are

embracing the need to change more quickly than others. Our research published in November 2020, “Organisations’ preparedness for climate change: an internal audit perspective”, includes examples of good practice as well as highlighting the pressing need for internal audit to be more engaged with climate assurance.

A compliance approach can be a good way to start.

Take a look at one of our

“Our latest report makes a great discussion aid because it is aimed at audit committees.”

recent technical blog posts, it explains net zero commitments and the role of internal audit. While environmental disclosure is voluntary at the moment, it is good practice and is often encouraged by shareholders – and particularly by investors.

We suggest you talk to your CAE. Our latest thought-leadership report, “Harnessing internal audit against climate change risk: a guide for audit committees and directors”, makes a great discussion aid because it is aimed at audit committees.

It sets out clear expectations of the role of internal audit, which should give your CAE the confidence to start the journey and to have a conversation with your audit committee chair. n

<

61

Q&A

62

Q I am writing a paper for our CEO on the pros and cons of different models of resourcing internal audit.

What key points should I include?

A The main models are outsourced, co-sourced and in-house; within this, there are also options for partial outsourcing and subcontracting.

It is important to emphasise to management that the oversight and responsibility for an internal audit function cannot be outsourced. The board, through the audit committee, is ultimately responsible for oversight of internal audit. Consequently, there is a need for more formal documentation and channels of reporting and approval when all, or a material part of, the function is outsourced.

The Chartered IIA Codes of Practice address this point: 21. Internal audit should have sufficient and timely access to key management information and a right of access to all of the organisation’s records necessary to discharge its responsibilities. In organisations in which the internal audit function is outsourced this Code still applies, and the chief internal auditor should always be employed directly by the organisation to ensure they have sufficient and timely access to key management information and decisions.

We have outlined key points (see panels, right). Members can also access Models of Effective Internal Audit, which includes case studies of six different models. There is no definitive structure as the assurance needs, size and complexity of an organisation should all be considered when deciding which model to adopt. n

Advantages

Disadvantages OUTSOURCED

Immediacy: Outsourcing can provide an immediate audit department.

Critical mass: The smaller an internal audit team, the more difficult it is to maintain a diversity of skillsets in-house.

Efficiency: On a per-hour basis, outsourced internal auditors are usually more efficient.

A fresh set of eyes from outside the organisation giving an objective and unbiased view.

It reduces the company's investment in continual training on changing requirements.

Flexible staffing resources.

Independent: There may be a perception that the internal auditor is more independent of management.

Cost: The cost of outsourcing the internal audit function may be so high that directors decide not to have an internal audit function at all.

Absence of ownership.

Lack of knowledge of business process.

Lack of coordination with other assurance providers.

Internal audit may look for faults simply because there is a belief that it justifies the cost.

You have the challenge of managing contracts and service level agreements with an external service provider.

Internal audit may lack deep knowledge and awareness of the culture of the organisation.

The organisation may be less receptive to an external service provider.

There is the risk of confusion over responsibility and accountability.

Internal audit is often used as a training ground for internal promotions. Depending upon the extent of outsourcing, the opportunities for this may disappear or, at best, be significantly reduced if internal audit is outsourced.

Advantages

Disadvantages CO-SOURCED

It may solve a temporary shortage of internal audit staff when there are tight deadlines; be useful for special project work; resolve difficulties recruiting qualified internal auditors (especially IT auditors); help cover remote business sites; ease skills shortages – particularly if a business wants people with experience of nascent or fast-moving technologies, or to review compliance with new regulatory regimes.

It offers access to specialist expertise, innovations in the latest audit techniques and technology and the opportunity for benchmarking.

Independent: There may be a perception that the internal auditor is more independent of management.

It may help to revitalise a long-established internal audit function.

The credibility of the internal audit activity may suffer if the co-sourcer does not "fit" culturally with the organisation.

Managing the relationship requires continuous coordination to ensure seamless delivery of the internal audit services.

Advantages

Disadvantages

The drivers for each option OUTSOURCED Value: Some internal audit teams consistently fail to execute and/or deliver value. Their audits may focus on the same old risks and miss new or emerging risks.

Trust: If internal audit has lost the trust of management there may be poor cooperation, which reduces the function’s effectiveness.

Cost: An outsourcing contract may cost less in total (despite having a higher per-hour cost) than the previous internal audit function. This will probably result in fewer internal audits, but it may not be a concern if the previous audits were of low value.

IN-HOUSE Cost: Outsourced auditors are typically twice as expensive as in-house auditors on a per-hour basis.

Audit hours: Given the same budget, internal audit hours will be much higher for in-house internal audit functions (owing to the per-hour cost advantage).

Organisational knowledge: In-house internal auditors are on-site all year round, so have a better understanding of the business and its potential control weaknesses, as well as its strengths.

“The oversight and responsibility for an internal audit function cannot be outsourced.”

Internal auditors have less opportunity to draw on best practice observed elsewhere.

Internal auditors may have difficulty acquiring or maintaining the same depth and breadth of specialist skills because of the cost of specialist training.

Teams may lack flexibility to accommodate increasing demands from oversight bodies to provide control assurance on certain areas if they cannot access resources.

CO-SOURCED Skills: You may need skills that are not available within the in-house internal audit function.

Vacancies: A team may be unable to fill vacancies in time to provide the assurance that stakeholders require on business-critical risks.

IN-HOUSE Growth: Companies that start with outsourced internal audit teams may grow to the point where supporting an in-house team becomes viable.

Fees: While the first-year cost of outsourcing an in-house internal audit function may be attractive, several years of fees and/or increases to the rates per hour may make it less attractive.

63

Q&A

“The proposal for an Audit and Assurance Policy should help to strengthen internal audit functions and is a golden thread that will help to tie the strands of a company’s assurance together.”

64

Q My head of audit has asked me to draft a new board Audit and Assurance Policy. I know this is a potential new corporate governance requirement, but I feel uncomfortable. Is it ok for internal audit to do this?

A First, it is commendable that your board is being proactive. The Audit and Assurance Policy is one of the proposals in the BEIS white paper Restoring Trust in Audit and Corporate Governance.

The remit of internal audit covers both assurance and advisory engagements. Given the scope of the new policy, the Chartered IIA believes that the Audit and Assurance Policy should be owned and signed off by the audit committee, which must be accountable for it.

However, internal auditors are in a strong position to act as facilitators and coordinators of the drafting of the policy in collaboration with other key internal business stakeholders, such as finance and risk management. The function’s unique position as the third line in the business

means it has an independent “helicopter” view of the entire audit, risk and assurance landscape, which will help it to weave the policy together, in partnership with the other assurance functions.

The proposal for an Audit and Assurance Policy should help to strengthen internal audit functions and is a golden thread that will help to tie the strands of a company’s assurance together.

In many organisations, internal audit will be the only function with the appropriate knowledge and skills, such as assurance mapping, to support the board in understanding and developing the Audit and Assurance Policy. It is also an opportunity to showcase the value of internal audit and, where necessary, to enhance assurance through informed discussion with the board and audit committee.

Members can access new guidance on how to develop the policy and the role of internal audit. n

GOT A QUESTION? Contact the Chartered IIA technical helpline on 0845 883 4739 or email technical@iia.org.uk

Training insights

Strong foundations

66

If internal audit departments are to provide the support their organisations need and meet the ever-increasing demands of stakeholders, they must work together with others in the organisation who can provide assurance.

They may also be bringing more people into their teams who are subject experts, but do not have previous internal audit experience or in-depth understanding of corporate governance. All these people – and others in the business working in compliance roles or on audit committees – may benefit from gaining the IIA Certificate in Internal Audit and Business Risk.

Heads of internal audit, in turn, benefit from knowing that they can rely on other assurance providers and compliance functions to understand the corporate governance framework and work to common standards and levels of knowledge. So, by encouraging internal auditors in their teams who lack formal internal audit qualifications and others working in compliance to study for the certificate, they will also be supporting the business and reinforcing their own team’s work.

It’s worth thinking broadly

The IIA Certificate in Internal Audit and Business Risk is aimed not just at internal auditors, but also at their colleagues in compliance, risk and other governance roles.

Why should you be urging others to get accredited? about who this applies to since the costs and penalties of inadequate compliance are increasing all the time – and it is likely that the government’s work on audit reform will put more onus on the senior leadership team to understand the quality of the assurance they receive and where it comes from. A board that can state confidently that all the relevant assurance providers have gained the certificate will at least know that everyone

who needs it has a common basic level of expertise.

This is also why the course is included as part of the internal audit apprenticeship programme. “One advantage of the certificate is that we do not have to focus on preparing candidates to answer exam questions, so the courses can be more flexible and activity led,” explains Marian Silltow, one of the Chartered IIA’s course trainers. “We have the freedom to explore topics and encourage open discussions about issues that attendees want to understand better.”

The programme comprises five modules. “Corporate governance and risk management” and “Internal audit planning and assurance framework” are compulsory.

Participants then choose two of the remaining three modules: “Effective delivery of audit and assurance”, “Interpersonal skills for audit and assurance”, and “Compliance audit and assurance”.They must complete a Personal Development Log for each module within six weeks of completing it and then, after finishing all four modules, they must submit a Professional Experience Record and

“Each group of attendees is different, so no two courses will be the same and you meet a variety of people doing different roles on each one.” demonstrate that they have at least six months’ relevant experience in a related audit or assurance or risk role.

Each module is supported by a two-day training course led by an experience Chartered IIA trainer. These can be run in-house for organisations that require several people to gain accreditation, or via public courses.

“I love running these courses because there tends to be lots of positive interaction. People are usually willing to talk and exchange ideas and questions about issues they are seeing in their own organisations. Junior team members don’t always get much opportunity to do this in their normal roles. It can be really valuable for them to talk to their peers in different

sectors and other businesses,” Silltow says.

The whole certificate can easily be completed within a year. Some people do it faster, but Silltow recommends allowing a month to six weeks for each module to give participants time to complete the reading and reflect on their learning. The range of relevant backgrounds means that each person brings a different mix of knowledge and experience to their training, so the amount of work they need to do varies widely.

“This is one of the main benefits of the course,” agrees Stephen Maycock, another of the Chartered IIA trainers.

“Most people know how things are done in their organisation.

This gives them a chance to find out what best practice is

based on the insights of the institute and to explore how others in their sector and more widely do things. Each group of attendees is different, so no two courses will be the same and you meet a variety of people doing different roles on each one you do.”

At the end of the course, you not only get letters after your name, which is always good for the CV, but you also have transferable skills that will be relevant and useful in a wide range of roles whether you work in internal audit or in a variety of second or first line jobs during your career, he points out. Whatever you plan to do in future, the need for assurance is only going to increase, so gaining this certificate gives you a strong foundation. n

67

Nurturing expertise With internal auditing ever evolving, are you taking the opportunity to build upon your current skills and cultivate new techniques? At the Chartered IIA, our tailored training, qualifications and development courses nurture everyday practices of the internal audit function to develop both you and our profession.

Members of the Chartered IIA are required to complete 40 CPE points every year to maintain their professionalism.

Attending a training course is an effective and motivating way to build these points.

We offer a variety of courses which develop your skillset and help you further your career goals.

• IIA Certificate in internal audit and business risk • Introduction to Internal Auditing • Soft Skills • Auditing Specialist Topics • Strategy and Leadership • Tools and Techniques

Book early & save

£100 on 1-day courses

£200 on 2-day courses

£300 on 3-day courses

Live virtual courses also available.

For booking, pricing and dates, visit charterediia.uk/courses

Events Browse and book our programme of events at iia.org.uk/training-and-events

Key events, seminars and networking

Our extensive volunteer network provides local support to members across the UK and Ireland. Each region organises a programme of events to help members network and stay up to date with developments at the Chartered IIA.

November

22 Exploring the challenges and opportunities to internal audit post-pandemic.

Sponsored event with Wolters Kluwer Online 70

23 Digital transformation and internal audit: how to maximise audit’s impact Online 30 Celebration Dinner London

December

8-9 Chartered IIA South West 40th anniversary event Bristol 16 Agile Auditing – the art of the impossible Online

New events for 2022 will be confirmed shortly, so check the Chartered IIA website for updates.

ADVANCE your CAREER Search for internal audit, risk and non-executive director roles Search the latest jobs Sign up for alerts Create a job seeker profile

Internal Audit & Risk Jobs Visit jobs.iia.org.uk

The official job board of the Chartered IIA

Tel. 020 7936 2601 internalaudit@barclaysimpson.com www.barclaysimpson.com

For a full list of current vacancies visit our website www.barclaysimpson.com

Latest jobs Senior Internal Auditor

Internal Audit Manager

Internal Auditor to Manager grade

Location: Home-based Salary: £60–£70,000+Bonus 10% Job type: Permanent RB/173826

Location: West Midlands Salary: £55–£63,000+Benefits Job type: Permanent SD/174014

Location: London/Birmingham/Manchester Salary: £38–£50,000+Benefits Job type: Permanent SD/173812

We are recruiting a home-based senior internal auditor for a major business services group. They are specifically looking for someone with end-to-end audit delivery experience in a complex global organisation. The services our client provides include software solutions, outsourcing and consulting. This role can be based anywhere in the UK.

A West Midlands based financial services business is seeking a fully qualified internal auditor with sector experience to join its growing governance function. To be considered you must have worked in a FCA regulated business delivering end to end reviews and be keen to progress you career in a dynamic environment.

This Top 10 accountancy firm is undertaking a strategic recruitment drive within its internal audit division across multiple UK locations. They are looking for a range of internal audit and risk profiles and can offer fantastic career progression, a variety of clients and a great work life balance including hybrid working.

Contact Russell Bunker rb@barclaysimpson.com

Contact Steve Driver sd@barclaysimpson.com

Contact Steve Driver sd@barclaysimpson.com

Internal Audit Manager

IT Audit Manager

VP Capital Markets Auditor

Location: London Salary: To£70,000+Benefits Job type: Permanent JAP/173818

Location: London Salary: To£90,000+Benefits Job type: Permanent JAP/173987

Location: London Salary: To£90,000+Benefits Job type: Permanent DH/173767

An Internal Audit Manager is sought by this global bank to join its investment banking audit team. You will deliver end-to-end audits and be responsible liaising closely with key stakeholders. This is an exciting opportunity for an experienced internal auditor to join at audit manager grade and undertake more complex reviews.

An IT Audit Manager is sought by this global banking group to deliver complex end-to-end audits as week as be responsible for managing a small team of more junior auditors.

This is an exciting opportunity for an experienced IT auditor to gain management experience alongside audit delivery in a well-established audit function.

This global bank has a position for an internal auditor with capital markets experience to review all aspects of corporate and investment banking. It offers candidates the opportunity to build on existing experience and to broaden their product knowledge. The bank offers a good work life balance with a flexible working approach.

Contact Jack Pyle jap@barclaysimpson.com

Contact Jack Pyle jap@barclaysimpson.com

Contact David Hornsby dh@barclaysimpson.com