Issuu

Avoiding the blind spot: Supporting financial stability and resilience

July 2021

“The current economic uncertainty will continue to test organisations’ financial sustainability for the foreseeable future and it is important that businesses prepare now for the next crisis. At the same time, there are a number of regulatory requirements on the horizon such as increase in corporation tax which could add significant costs to already struggling organisations. Similarly, there will also be a number of significant costs in the future for businesses associated with meeting government’s targets on the road to net zero.”

Avoiding the blind spot: Supporting financial stability and resilience

Foreword Without a doubt, financial resilience and stability has been at the forefront of many organisations’ thinking over the past year. It is estimated that 2020 was marked by the biggest economic contraction in over 300 years. With the pandemic having impacted operations, many businesses have faced difficult decisions around cost-savings with budget cuts and redundancies. There have also been a number of challenges faced by internal audit teams such as competing priorities and lack of resources. Others have been affected by furlough or redeployment. With many organisations being thrown into survival mode overnight with ‘stay at home’ guidance, the consequent cut in income has led to an immediate spike in liquidity risk. With organisations potentially making quick decisions on cost reductions - without the appropriate balance with risk management - there could be an impact on organisations’ long-term sustainability. However, there are also opportunities to be seized. The pandemic has led some organisations to reinvent their business models, by establishing an online presence and expanding to manufacturing of PPE and hand sanitiser to meet demand. Internal audit has a key role to play in supporting organisations to manage and mitigate financial, capital and liquidity risk. For example, by effectively managing any gaps and inefficiencies in the business to help deliver cost-savings, and highlighting opportunities for optimisation during the post-pandemic recovery. The effects of the pandemic were not experienced in the same way across all sectors of the economy. With shops, restaurants, and bars ordered to shut, and restrictions on international travel, it was the hospitality, retail, and aviation and travel sectors that were disproportionately affected during the crisis. Other sectors such as financial services have been less affected over the past year. In part, due to the more stringent regulatory framework and additional guidance that followed the 2008 financial crash, such as stress testing for unexpected economic shocks. This is why we wanted to conduct research on a sectoral basis and show how internal audit functions have supported the financial resilience and stability of their organisations over the past year. We wanted to better understand how internal audit functions can add value during times of economic strain in the future. The report is based on roundtable discussions with Chief Audit Executives across a range of sectors including financial services, hospitality, retail, aviation and travel, and public and third sectors. The discussions formed six case studies which highlight good practice internal audit in managing financial, capital and liquidity risk. The speed of change and uncertainty were cited as the main challenges throughout the pandemic for internal

audit teams. Our findings show that the role of internal audit has varied across sectors and over the course of the pandemic, with some providing assurance on treasury functions to ensure liquidity risks are effectively mitigated. Others in the role of trusted advisors helping with relevant cost-savings opportunities. There were also many lessons learned over the past year including on financial efficiency, resilience, and the importance of planning and preparation for the unexpected. The current economic uncertainty will continue to test organisations’ financial sustainability for the foreseeable future and it is important that businesses prepare now for the next crisis. At the same time, there are a number of regulatory requirements on the horizon such as an increase in corporation tax which could add significant costs to already struggling organisations. Similarly, there will also be additional costs for businesses in the future associated with meeting government’s targets on the road to net zero. That is why we would like to strongly urge internal audit functions to avoid complacency and support their organisations’ financial stability and resilience. Throughout this uncertain period and beyond, capital and liquidity management should continue to feature in internal audit plans. As organisations return to business as usual, this will help to ensure that any associated risks are appropriately managed and mitigated. We also urge internal audit functions to help the business identify associated opportunities during times of economic strain. For example, by helping to identify cost-savings, providing real-time assurance on initiatives and horizon scanning to ensure that any opportunities for the business are considered and seized at the right time. This will support the financial sustainability of the organisation in the long-term. We recommend that all internal auditors review the ‘actions and considerations for internal audit’ section of the report, and ask whether they are able to respond positively to the actions. If not, why not? We hope that this report will serve as a useful guide in navigating financial, capital and liquidity risk and inspire your work in this area. John Wood | Chief Executive

Avoiding the blind spot: Supporting financial stability and resilience

About the research We conducted six sector specific roundtable discussions with 40 Chief Audit Executives from a range of sectors including financial services, hospitality, aviation and travel, retail, public sector and third sector. The discussions took place virtually in May 2021. The purpose of the roundtable discussions was to explore how the internal audit profession can reimagine their approaches to financial stability and sustainability, and help the business to highlight relevant opportunities and the value of internal audit during uncertain economic times. The discussions have formed the basis of the six case studies included in this report, highlighting examples of how a range of sectors have effectively managed and mitigated financial, capital and liquidity risk as well as the key lessons that they have learnt along the way.

Avoiding the blind spot: Supporting financial stability and resilience

Introduction There is no doubt that the coronavirus pandemic has been the most significant and far-reaching event for businesses since at least the 2008 financial crash, having impacted every sector of the economy, businesses and individuals. Our Risk in Focus 2021 research found that financial, capital and liquidity risk has seen a notable annual increase at the beginning of the pandemic, with 42% of Chief Audit Executives voting for it as a top risk to their organisation – a 40% increase on the 30% of CAEs who said the same a year ago. It is evident that it has been at the forefront of organisations’ thinking over the past year. In March 2021, the Centre for Economics and Business Research (CEBR) said that it estimates that the economic cost of a year of COVID-19 to the UK is around £251 billion, citing national lockdowns, unprecedented uncertainty, and public sector interventions as one of the many reasons for this monumental cost.1 It is no surprise that this major health crisis will take a long time to recover from, both economically and socially. Similarly, Ireland is forecast to have the highest government debt per person in Europe this year, with a predicted €241.6 billion debt burden in 2021.2 However, not all sectors have been equally impacted during the pandemic. For example, McKinsey & Company estimate that air traffic levels will not return to pre-pandemic levels before 2024. They recognised that COVID-19 has changed consumer behaviour, and this will affect the airline sector for years to come.3 With many businesses already in significant financial distress which will take time to recover from, they need to be especially vigilant for any other events that may have an impact on their financial and liquidity risk in the future. The end of the furlough scheme is fast approaching in September 2021. The potential increase in corporation tax and the road to net zero to honour the government’s climate change commitments, will all add significant costs to businesses in the future. This, coupled with the increasing costs of the pandemic, as well as the impact of Brexit will

prove to be significantly more difficult to handle for many businesses. Organisations should all take steps to be vigilant of any additional costs on the horizon and harness the skills of internal audit to ensure that financial, capital and liquidity risk is being identified, managed and mitigated effectively, to ensure the long-term sustainability of the business. It was not perhaps surprising to discover from our discussions with Chief Audit Executives that many internal audit functions have been affected by redeployment to the first or second lines in order to help respond to the crisis. However, it was concerning to find that some internal audit teams have been partly furloughed. With most risks exacerbated by the pandemic, this is a time when the business needs internal audit the most, in order to carry out its most critical work, such as providing real-time assurance on new initiatives. This is consistent with our Internal Audit in Lockdown research, published in September 2020, which found that almost half (46%) of Chief Audit Executives surveyed said that all or part of their team has been redeployed to first or second lines. A further 15% said that all or part of their team has been put on furlough. Internal audit should provide significant value during economic downturn, and ultimately help the organisation navigate financially challenging operating environments. Times of crisis may lead organisations to make cost-savings decisions

1 Centre for Economics and Business Research (CEBR) | One year since lockdown: The £251 billion cost to the UK economy 2 The Irish Times | Ireland to have highest debt per head in Europe this year 3 McKinsey & Company | Back to the future? Airline sector poised for change post-COVID-19

Avoiding the blind spot: Supporting financial stability and resilience

in haste, without consideration of the impacts of those reductions on the organisation’s exposure to risks. Internal audit, with its holistic view of the organisation, is uniquely placed to help deliver cost-savings with its appropriate perspective on the internal control environment. Its vital assurance work can help to support the organisation in times of financial strain and help to ensure long-term sustainability. The aim of this report is to encourage internal audit teams to avoid complacency now that restrictions

are starting to lift. With a number of regulatory changes coming down the track, and the financial impacts of the pandemic to be felt for many years to come, organisations and internal auditors need to remain vigilant in identifying any additional costs that can affect them in the future. We hope that the six case studies that form the basis of this research inspire internal audit functions to promote the vital role that they can play in managing financial, capital and liquidity risk. We hope this report will help to support their organisations to better manage such crises in the future.

Questions for internal audit

1 2

Have you included financial, capital and liquidity risk in your audit plan?

Have the organisation’s major financial, capital and liquidity risks been documented on the risk register and are they subject to appropriate response against the organisation’s risk appetite?

6 7

Are financial, capital and liquidity risks on the agenda at board and audit committee meetings?

ave you helped the organisation to identify H any gaps and inefficiencies that could be closed to deliver cost-savings in the future?

Have you considered any regulatory changes that may be coming down the track that could affect the financial, capital and liquidity risk of your organisation?

Have you used relevant tools (such as stress testing or scenario planning) to test for any potential events that may impact the financial position of the organisation in the future such as climate change or cyber-attacks?

ave you assessed how successful the treasury H function and CFO have been in their efforts to manage the organisation’s liquidity risk?

Has senior management put in place cost cutting measures? If so, have you assessed what impact those measures have had on delivery of strategic ambitions and on key controls? Are these cost cutting measures sustainable or will they need to be adjusted as the pandemic recedes?

Have long-term liquidity risks been addressed? For example, around refinancing for when loan and bond terms expire?

Have you considered the impact of the end of the furlough in September 2021, on employee/ redundancy risks and the financial costs associated with this?

Avoiding the blind spot: Supporting financial stability and resilience

Actions and considerations for internal audit • Internal audit is a critical resource for the organisation during crisis to help manage and mitigate financial, capital and liquidity risk. Internal audit must champion its value to the business and support the organisation’s financial stability and sustainability as a valued business partner. • Internal audit should consider the potential impact of all decision making in a crisis, and in particular impact on the risk appetite and strategic objectives. They should engage with the business where costsavings and containment decisions are being made to ensure this is done in consideration with risk management. Otherwise, key controls could be weakened, and risks exacerbated in the long-term. • Internal audit should engage in financial planning and reporting processes to assess the effectiveness of controls that support financial modelling, scenario analysis and decision-making processes. • Throughout this uncertain period and beyond, capital and liquidity management should continue to feature in internal audit plans. As organisations return to business as usual, this will help to ensure that any associated risks are appropriately managed and mitigated. • Internal audit should help the business to identify opportunities during economic strain. For example, by helping to identify cost-savings, providing real-time assurance on initiatives and horizon scanning to ensure that any opportunities for the business are considered and seized at the right time. This will help to ensure long-term financial sustainability of the organisation.

Avoiding the blind spot: Supporting financial stability and resilience

Case study: Aviation and travel Aviation and travel has been one of the hardest hit sectors by the pandemic. The Civil Aviation Authority (CAA) said that the passenger numbers in and out of the UK fell by 75% in 2020 year-on-year compared to 2019, and overall air transport movements fell by 63%.4 Earlier this year, the BBC reported that Heathrow Airport suffered a £2 billion annual loss owing to a decrease in passenger numbers during 2020, citing it as the toughest year in its 75-year history.5 These trends were reflected in the discussions with Chief Audit Executives that we spoke to as part of our research. They reported that across their organisations, staff (including members of their internal audit teams) have been either furloughed or faced redundancy in the wake of the crisis, due to a significant decrease in demand for services. Others have been supporting second line work with the risk and assurance team by helping to set up control frameworks and ensuring that the right governance and processes are in place in terms of risk and capital portfolio management. This is as well as providing support to financial and operational teams to ensure they are updating financial information for liquidity and profitability, and making sure they are in line with budgeted forecasts for the business.

Reaction to the pandemic A large proportion of the operating costs that could be cut were payroll related, which is where internal audit had primarily looked for significant amounts of savings and inefficiencies to deliver cost reduction. In addition to this, internal audit teams looked at cost-savings in nonessential projects particularly on the capital side, where some needed to be postponed or stopped completely. In terms of financial resilience, internal audit has been working on reviewing capital management as well as helping to get contingency loans from banks, reviewing suppliers and their payment terms. With organisations working on an almost zero budget approach and a significant portfolio

4 Civil Aviation Authority (CAA) | Aviation 2020: Data summary 5 BBC | Heathrow passenger numbers fall to 1970s’ levels

of capital spend, they have participated in reviews on how to best prioritise the spending and then review what can be taken forward in light of limited budgets. Internal audit has also been involved in business continuity through business situation reviews. This is to ensure the financial stability of the organisation and to look at compliance with controls, particularly in light of the remote working environment. With particular attention on financial resilience through cost angles, internal audit reviewed revenue leakage, cost reductions, supplier risk management, contracts for discounts and rebates and whether they have been managed effectively. In addition to this, they worked on capital maximisation, which included debt management and making sure the billing is done on time and that the correct payment control mechanisms are in place. A number of organisations in the aviation and travel sector have also initiated financial transformation projects reviewing financial processes and systems, to see where the efficiencies from a cost perspective could be brought in. The role of internal audit in this case has been to feed into the business case, assess the weaknesses of the business model and review how they can provide revenue assurance. Looking to the year ahead, their internal audit plans will include reviewing cost-savings that that have been carried out during the pandemic, and focusing on the long-term sustainability of those savings.

Avoiding the blind spot: Supporting financial stability and resilience

Challenges for internal audit Although financial, capital and liquidity risk has been a top risk for organisations in the aviation and travel sector over the past year, the uncertainty surrounding the pandemic (and how long it will take to return to ‘business as usual’) has made it difficult for internal audit to provide assurance in real time. This is also the case for financial modelling that assesses the organisations’ future liquidity and profitability as the data has been skewed by the unprecedented nature of the pandemic. In addition to this, internal audit teams have reported a lack of skills in their teams to review those models and provide assurance over their outcomes.

As the aviation and travel sector has been severely affected during the pandemic, in order to deliver cost-savings the size of teams across the business have been severely reduced. At the same time, much of the sector has been suffering from a longerterm freeze in recruitment. This has meant that attracting new staff has been difficult. This is also the case for internal audit teams themselves, who have struggled to recruit suitably skilled staff to provide the level of coverage that they need to carry out their vital work effectively and deliver the assurance sought from their key stakeholders.

“Over 30% of our operating costs are payroll related, so we found ourselves zoning in quite significantly in those areas just to look for inefficiencies…certainly we were able to root out quite a significant amount of savings in those areas.” Chief Audit Executive, Aviation Services Company

Key lessons learned and advice for other audit teams There are more avoidable costs for the business than you realise, so leading on a zero-budget approach in the future to deliver cost-savings as an organisation will be the optimum choice, especially given the long-term recovery needed for the aviation and travel sector. All of the cost savings that were carried out during the pandemic need to be realigned as organisations begin to return to normal. Internal audit needs to assess whether the cost savings have exacerbated the business’ exposure to risks and whether they are sustainable in the long-term. The pandemic has also had an impact on the ability to model future financial results. Businesses need to take into consideration different perspectives as well as the future forecast, and be mindful when adjusting the modelling according to the forecast and include different perspectives. Internal audit teams have had to adapt processes into something more dynamic to reflect the risk profile of the business, with quarterly rather than annual plans which focus more on real time results and risks. For internal audit to be an agent of change, it needs to optimise opportunities and be a valued business partner. This comes down to the communication and relationships that they have within the business and with key stakeholders such as the board, audit committee and in some instances shareholders.

Avoiding the blind spot: Supporting financial stability and resilience

Case study: Hospitality Similar to the aviation and travel sector, the hospitality industry has been severely impacted by the pandemic. Restaurants and bars were completely shut during lockdowns and operating in a limited capacity in between. The decline in tourism has also led to a significant fall in demand for accommodation, leaving many hospitality businesses struggling to survive. PwC predicts that hotel occupancy rates will continue to be around 55% in the near future and it could take up to four years to return to 2019 levels of performance.6 Meanwhile, the BBC reported earlier in the year that a tenth of the UK’s restaurants have been permanently shut since the beginning of the pandemic a year ago.7 However, whilst some of the hospitality industry will no doubt benefit from local tourism over the summer months, there is no doubt that the industry still faces a challenging year ahead.

Responsibilities of internal audit during the pandemic Internal audit teams have been primarily focused on the control environment and ensuring that it remains robust. To some extent, the identification of operational improvements and efficiency gains have been a bi-product of that. This included looking at the extent to which the reduction of expenditure has impacted internal controls and the risk environment. It involved reviewing if there were cost-savings introduced in some areas, then assessing whether those cost-savings were increasing risks to the business in other areas. This is particularly relevant for diversified and organisationally split businesses, where controls could be affected in one location because costsavings have been made in another. Internal audit teams focused more on the areas that changed in the control framework and how everyone has adapted to working remotely especially in the treasury function. They also assessed bank and data reconciliation, as well as liquidity and their capital programme.

For businesses with multiple properties, the internal audit team helped assess the cash balances on each of the properties. They were testing throughout the year to make sure that there was no unusual activity in the cash balances and all bank and debt accounts were up to date. In addition to ensuring that the organisation was engaged with the government’s support initiatives such as the furlough scheme, business rate reductions and delays in submitting accounts to HMRC. For some organisations in the hospitality sector, such as those doing business with or who have operations in the USA, the impact of the pandemic has meant that internal audit teams’ responsibilities have been increased in relation to SOX testing. The impact of the pandemic and the subsequent costsavings meant that internal audit teams have had to take the testing in-house where previously they had only project managed it. However, the materiality of SOX testing had also reduced as result of the pandemic. This has proved to be a challenge for internal audit in reassessing how the data is viewed as part of that work. The pandemic has led businesses to reassess their modelling and the data that underpins it. This is in terms of assessing certain metrics as well as the definitions of those metrics such as ‘normal’ levels of cash flow. For example, before the pandemic they modelled only working at a 10% revenue drop and assumed that even a 20% revenue drop would not be feasible for the organisation to operate on. However, with the onset of the pandemic their revenue dropped by 100%. Through appropriately managing their response to that change, they have been able to assess their risk exposures in the current context.

6 PwC | PwC Hotels Forecast: COVID-19 pandemic prompts most volatile outlook for fifty years 7 BBC | Covid: A tenth of Britain’s restaurants lost during pandemic

Avoiding the blind spot: Supporting financial stability and resilience

As part of their advisory work, internal audit teams reviewed the impact of the decisions made by the business on optimising third party contracts and their related costs and optimising the workforce model. They have also carried out risk assessments related to any disruptive changes in the supply chain.

Similarly, internal audit teams have also assisted with managing the debt portfolio, which has consequently brought more income into the business.

“When the pandemic kicked in, all of the spend stopped, everything centralised and only essential spend was allowed. Our focus became assessing to what extent has the reduction in expenditure impacted internal controls and the risk environment. And we were focused on looking and making sure that if there were areas where cutbacks were introduced, was that increasing the risks to business?” Chief Audit Executive, Hotel Group

Key lessons learned and advice for other audit teams Since income had completely stopped for many organisations in the hospitality sector during the pandemic, businesses began questioning the ways in which they operate and if their processes could be improved to induce cost-savings. For example, some internal audit teams have reviewed the way that the business carries out transactions and the suitability of their contracts with vendors. This has meant that the business is less exposed to cash flow risks and will enable it to be more resilient in the future. The business model and the workforce is more resilient than originally thought. They have reviewed cash flow and metrics in the current context and will apply these to modelling. The data and metrics can also be used to help explain the impact of certain risk exposures in the future.

Avoiding the blind spot: Supporting financial stability and resilience

Case study: Retail The pandemic has had a significant impact on the retail sector. Some businesses such as supermarkets, technology and entertainment as well as online retail have dealt with unprecedent demand during the pandemic and consequently, have increased the pressure on more traditional business models. Others, such as non-essential businesses and high street retailers with limited or no online presence have suffered the most. The Centre for Retail Research (CRR) indicated that almost 180,000 retail jobs were lost in the UK in 2020, with up to 200,000 at risk in 2021.8 The months of closures and rent arrears that many have accumulated during the past year have impacted cashflow and liquidity and led many to either reinvent their business models. For example, some businesses have established their online presence and others, branched out to manufacture PPE, ventilators and hand sanitisers. Many have also faced difficult decisions around redundancies and in some cases even closed down all together.

on liquidity risk which helped to secure government funding. Similarly, they have been involved in strategic conversations on financial resilience including on directing spend in the most efficient way.

In fact, from discussions with Chief Audit Executives in the retail sector, many organisations found themselves thinking about the long-term sustainability of their business and the future of retail. This has led them to accelerate their online presence as well as other transformation programmes.

Impact of the pandemic

Internal audit in the last 12 months When the pandemic began, internal audit teams had to adjust their internal audit plan and conduct their plan in quick succession. This was in addition to identifying long-term costs-savings and standardising their processes to make them more efficient for the organisation. As the income grounded to a halt, internal audit conducted work with the treasury and undertook a review of the general financial situation. This accelerated the work that was already on the audit plan for the next year, such as the planned treasury operations audit. As part of their advisory role, some internal audit teams have been involved in discussions on the work of the treasury team in getting in place mitigations

Financial and liquidity risk has been at the top of the agenda for organisations in the retail sector over the past year. Looking to the year ahead, internal audit will be monitoring the impact of any cost-savings as well as reviewing any risks and opportunities that have been identified. These will be addressed as part of the internal audit plan this year.

The coronavirus pandemic has highlighted many new kinds of risks in terms of both safety and finances, as well as getting the business to effectively run remotely. For example, moving customer services centres to work from home and the ability of staff to take credit card payments remotely. Like for many organisations, there were substantial costs associated with making the stores safe for reopening, such as buying all of the necessary safety equipment such as PPE and sanitisers. This has added significant costs to already struggling businesses. Similarly, social distancing rules have meant that businesses had to reduce the number of customers allowed into the premises at once, leading to a potential loss in earnings. In the meantime, internal audit teams have been heavily involved in making sure that the business is adequately protected by conducting verification COVID-19 audits to make sure that customers and colleagues remain safe.

8 Centre for Retail Research (CRR) | The Crisis in Retailing: Closures and Job Losses

Avoiding the blind spot: Supporting financial stability and resilience

“We have multiple brands under one umbrella. So, through audit and risk analysis activity we have identified that there is opportunity for long-term cost savings and standardisation of processes across the group. In the long-term this will prevent any reputational damage or any potential fines by regulators.” Chief Audit Executive, Furniture Company

Key lessons learned and advice for other audit teams The business needs to be aware of the environment that they operate in and any legacy issues that can take up capital in the future. If there is a lot of unprecedented activity in the background, then internal audit needs to provide assurance that what the business is doing is sensible and sustainable. If there is substantial income and surplus, then it should be reinvested back into the business and into new processes and systems to make it more resilient. It is important not to lose sight of financial, capital and liquidity risks, and remain focused on outgoings and pay where possible as a business, rather than to rely on loans to prevent getting into further debt. This will in turn contribute to a better financial position in the future. All of the plans to digitalise businesses have been accelerated by the pandemic in a drive to generate revenue. The work that had been conducted before the pandemic to ensure processes and controls are operating effectively had meant that some were better prepared for its impacts. There is always a need for internal audit to support their business to be forward thinking for the future of retail as a whole, as this will help mitigate the impacts of any other crises that might arise.

Avoiding the blind spot: Supporting financial stability and resilience

Case study: Third sector The third sector provides many vital services to communities, and it has been a lifeline for many since the pandemic began. However, an increase in demand for their services and the need for COVID-19 safety measures, coupled with decrease in fundraising income, has meant that almost half of charities in 2020 saw their income decline.9 Similarly, BDO has estimated that few charities have cash reserves available to get through a 3 to 6 month downturn in donations and funding.10 This is why a key focus for many third sector organisations during the crisis has been financial stability and sustainability. Helping the business identify gaps and inefficiencies

Change in internal audit responsibilities over the last 12 months

Internal audit teams in the third sector reported including ongoing value for money inherently in the scope of their work. For example, when reviewing investment in IT in order to be able to illicit more savings in the future. In addition to this, the internal audit teams have been involved in testing controls around spend in the organisation and giving feedback on cost-savings opportunities and efficiencies that can be made. This has been embedded into every piece of assurance and advisory activity and has helped to identify operational inefficiencies.

At the beginning of the pandemic, some of the planned work on operational efficiencies on different directories was postponed, to be able concentrate on other imminent requirements of the business. Internal audit focused on financial controls and governance, reporting mechanisms and risk reporting around changes in financial profile, as well as some additional formal pieces of work on treasury management and cash flow. This is where they identified a number of operational efficiencies that have been put into practice throughout the year.

Their consulting and advisory roles include giving feedback on strategy and pressing leadership on clear objectives and alignment in terms of financial risks, as well overseeing the response to governance in light of the pandemic. Their feedback on inefficiencies and cost-savings focused on ensuring that the organisation is focusing spend on areas that matter most given its objective and mission. This has been achieved by consulting, giving ad hoc feedback, taking part in strategy meetings, probing, asking questions and being a critical friend to the organisation. Once the organisation is able to refocus their spend on their core mission and objectives, then internal audit is able to help identify opportunities to reduce further discretionary expenditure and activities.

Internal audit teams have conducted a lot of recurring reviews around internal financial controls, assessed whether the practices are appropriate and whether they need adjusting. In addition to this, fraud management and debt management reviews have also helped identify potential financial sustainability issues. Internal audit teams have reported doing more advisory and consultancy work than planned, as well as some second line activity including helping to review fraud risk assessments. Their advisory work included assessment of the different models and scenarios that the organisation was running in terms of cash flow and liquidity and their impact on sustainability.

9 Pro Bono Economics | January 11-18 Covid Charity Tracker Survey results 10 BDO | Charities and COVID-19

Avoiding the blind spot: Supporting financial stability and resilience

They also conducted analysis and advisory work around the cash flow, liquidity and long-term sustainability modelling and scenarios. This included making sure the data is valid, accurate and timely and conducting audit and assurance work in real time. Internal audit has been involved in reviewing essential tasks, looking specifically at what costs would be incurred and what projects need to be stopped to deliver short-term savings. The teams have contributed daily to business continuity meetings which included discussions on current risks, the risk profile of the organisation as well as how they are being mitigated. Internal audit reviewed those risks daily to ensure that there is sufficient cash flow to cover outgoing costs. This is an area where management have seen the immediate benefits of internal audit work and where the greatest value can be added. The importance of cash flow forecasting is critical for ensuring the organisation’s long-term sustainability. For example, one of the organisations reported that one of their grant recipients had not been conducting cash flow forecasting prior to the pandemic. Once the pandemic began and some of their funding had been pulled, they conducted a cash flow forecast which showed that they had only five months of cash flow remaining. It is a critical control to have in place to assess the financial viability in the long-term. Some third sector organisations who are responsible for funding other NGOs have also reported reviewing financial stability and sustainability of the organisations that rely on their funding. In particular, assessing whether they would be able to survive if they were unable to continue funding them either because of their own financial situation or change in their corporate priorities. They had also conducted similar reviews with their suppliers and assessed whether their financial situation would be sustainable if their way of working changed.

Challenges for internal audit A particular challenge for organisations in the third sector has been around legacy systems and income, which has been greatly impacted during the pandemic. As a consequence of charity retail closures and a significant decrease in cash and item donations, many organisations have conducted reforecasting internal audits, reviewed their financial modelling and the assumptions underpinning legacy projections. Similarly, the speed of change over the past year has been particularly challenging for internal audit when doing advisory and review work around finances, forecast and scenario planning. However, with forecasts and approaches changing so quickly, by the time internal audit is able to respond, there is the potential that feedback could no longer be relevant. Another challenge for internal audit teams in the third sector has been lack of available resources, which has been particularly felt during the pandemic. The needs of the organisation during the crisis have required internal audit’s response and input. However, limited resources, including as a result of furlough, have meant that internal audit teams have been stretched even further during the crisis with competing attention for risk areas. This has affected all areas of internal audit, not just aspects focusing on issues of financial stability and sustainability. Finally, like many others, the third sector has also been affected by redundancies and furlough in the interest of cost savings. This has led the ones left in the organisation to take on extra work, putting an additional pressure on resources and the ability of internal audit to provide assurance. Co-sourcing was not regarded as an essential spend with a zerobudget approach. Others that were able to engage in co-sourcing contracts have found that their partners were so busy during the pandemic they had limited availability to assist when needed.

Avoiding the blind spot: Supporting financial stability and resilience

“As we come out of the pandemic, we are looking at how we as an organisation should invest going forward, reviewing cost-savings and spending. We should be thinking about are we spending in the right areas and are we investing new sources of revenue and looking at new ways to grow the organisation or the business? That’s where we can add a different take on it and add a lot of value as internal audit.” Chief Audit Executive, Large NGO

Key lessons learned and advice for other audit teams It is important to embed financial sustainability issues within activities and plans so it becomes part of ‘business as usual’ for the organisation. This will allow internal audit to be able to look for value for money and efficiencies in the long-term. It will give the opportunity to move away from payroll or accounts receivable, and instead review cash flow forecast, liquidity, investment, scenario planning - which are more forward-looking for the organisation. As an organisation it is crucial to have a playbook ready for different scenarios that may arise in the future which will help to contingency plan for different scenarios. In addition to this, conducting cash flow forecasts and auditing key controls allows the organisation to see the viability in the future.

Avoiding the blind spot: Supporting financial stability and resilience

Case study: Public sector The Financial Times reported that at the beginning of the 2021/2022 fiscal year, the monthly figure for public sector net borrowing was estimated to be £31.7 billion. This is the second highest figure for borrowing since the pandemic began.11 The short-term relief provided by additional funding from the government could provide a sigh of relief for some public sector organisations. However, in the longer-term, the reality is that further public sector cuts are likely, due to increasing debt incurred during the crisis. The pandemic has been widely felt across the public sector, with increased demand for services and the move online. Digital transformation plans have been accelerated. From our research, we learnt that some internal audit teams in the public sector have also been assisting the second line in response to the pandemic. Their responsibilities included monitoring financial data for exceptions and outlying transactions to help provide additional assurance through data analytics. Their work has been driven by the urgent need to meet the demands of the business and effectively respond to the crisis.

Internal audit work during the COVID-19 pandemic Many internal audit teams in the public sector already include financial stability and sustainability as part of their internal audit plans. They also maintain a focus on stability and sustainability as two separate and distinct areas to help internal audit to provide appropriate coverage and assurance. The internal audit teams reported that assurance mapping against the assurance framework has particularly helped to highlight how healthy the controls were at a more transactional level. Internal audit has worked with senior management to identify which financial processes would be most affected as a result of the pandemic and the adjustments that need to be made. For example, the change in remote authorisation processes for payments due to home working. Internal audit

was also involved on work on payroll, treasury management and procurement to ensure that robust processes are in place. As part of their financial resilience work, where relevant, they have focused on revenue collections, such as business rates and council tax, and any changes to the resilience of the associated systems as a result of the pandemic. In addition to this, they have reviewed staffing in collection of revenue activities as well as their communication with payers, customers and suppliers. Their reviews have led to them revising their internal audit plan a number of times during the pandemic and enabling them to refocus it onto resilience. Looking forward as the situation improves and the risk tolerance falls, internal audit teams will be assessing how the organisation will be managing pandemic risks sensibly into a ‘business as usual’ environment. As the decisions that were made on cost-savings by senior management in a high-risk tolerant environment may not be viable as the organisations return to the new normal.

Challenges for internal audit 2020 has brought many challenges for internal audit teams in public sector organisations. For some public sector organisations, the pandemic has led them to review their service models to make them more shock-proof and sustainable in the long-term. This is particularly relevant as the levels of support may start to decrease in the near future. Similarly, there are also wider concerns in the public sector around being able to deliver services but not necessarily being able to recruit or retain the right

11 Financial Times | Covid response keeps UK government borrowing high in April

Avoiding the blind spot: Supporting financial stability and resilience

skills and knowledge. This has also the potential to impact internal audit teams and their ability to provide assurance on business-critical risks such as financial, capital and liquidity risk. Internal audit has also been involved in reviewing some of the key projects that have been put on hold during the pandemic. This included assessing whether the business case has remained appropriate and assess the projects’ interdependencies with funding. And even the

impact of the organisation on not moving the project forward at all. With internal audit actions not being implemented on schedule, internal audit functions have also been involved in assessing whether the priorities and the assigned implementation schedule are right, in light of the current operating environment. The key challenge for internal audit has been in managing their level of communication and being clear on what they are trying to achieve.

“Auditing financial stability is far more than just auditing financial processes. It is about effectiveness of an organisation as a whole, which in turn drives sustainability.” Chief Audit Executive, Large Public Sector Organisation

Key lessons learned and advice for other audit teams Financial stability is a broad concept and is not just about auditing financial controls, treasury function or supplier sustainability. It is also about what value it delivers for service users and the resilience of the organisation. Overall, the COVID-19 pandemic has taught a valuable lesson in the ability of public sector organisations to be flexible and react quickly in changing circumstances. As the internal audit methodology had to be adjusted due to remote working, organisations had to focus on cross-working and end-toend processes rather than teams working in a silo, which consequently helped the delivery of desired outcomes. Given the switch of some internal audit functions from provision of assurance to advisory/consultancy over the past year, an important aspect of this has been to sustain the objectivity and independence of internal auditors. Some organisations have reported providing additional guidance on the level of advisory work expected on a typical programme.

Avoiding the blind spot: Supporting financial stability and resilience

Case study: Financial services The financial services sector varies substantially from others in terms of the expectations and requirements that have been placed on the sector following the 2008 financial crash. Their internal audit functions tend to be more mature in their approach to managing and mitigating financial, capital and liquidity risk. Even so, some organisations in the financial services sector fared better than others during the pandemic. At the beginning of 2021, the Financial Conduct Authority (FCA) in their industry-wide coronavirus financial resilience survey, found that up to 4,000 financial services firms out of the 23,000 surveyed were at heightened risk of failure because of the pandemic. However, many of those were small and medium-sized organisations.12 The Chief Audit Executives who participated in our research said that their programme of work in 2020 has largely remained unchanged. Financial and liquidity risk remained at the top of their agenda, with a similar level of priority assigned to it before the pandemic. However, they did report adjusting their scope of work. This included doing additional work around the risk response and the different COVID-19 scenarios and situational testing.

Identifying operational gaps and inefficiencies The financial services organisations we spoke to have not had any direct input in identifying operational gaps and inefficiencies. However, in the past year their internal audit teams have been asked to get involved in wider exercises where concerns around cost have been a component. For example, in providing assurance on projects that feature as part of costsavings programmes. Their audit reports do not usually include separate operational efficiency findings. However, they do identify where efficiencies could be made as part of the assurance work by following up on their audit findings with actions that aim to illicit efficiencies. This helps to secure buy-in from management and provides

value to the business. Their work includes identifying gaps in controls where there are manual processes in place and raising management’s awareness on the need to invest in more efficient processes such as automation which will generate efficiencies and longterm cost-savings. Their programme of work helps to influence cost-savings and influence management to invest in the future of the organisation. For banks specifically, the UK government’s commitment during the pandemic to deliver loan schemes has had a big impact on the resources of the business. The work of internal audit teams in that area was around ensuring that the provision was effective and minimised conduct risk. Thus, preventing any future associated costs to the organisation. More broadly, the financial services internal audit teams have also been asked to validate the financial business case components as well as their overarching view on strategy, or other areas that may relate to the financial position of the organisation.

Responsibilities of internal audit teams, and the challenges faced The majority of organisations reported that the key responsibilities of their internal audit function have remained unchanged. Instead, the emphasis changed to reflect the COVID-19 specific angles on risks in their internal audit programme. For example, they put in place processes to do rapid COVID-19 assessments across investment portfolios and conducted work around them. The types of audits that they will continue to focus on may also evolve further as the crisis recedes. In particular, as the government’s financial relief starts to lift and the scope of IFRS9 audits, provision audits, liquidity and funding audits

12 Financial Conduct Authority (FCA) | FCA publishes coronavirus financial resilience survey data

Avoiding the blind spot: Supporting financial stability and resilience

might be slightly adjusted to reflect the change in business risk. Given the volatility of the past year, a particular challenge for internal audit teams has been around balancing the speed at which an audit engagement needs to be carried out, with the depth and quality needed to provide assurance. Financial services regulators such as the Prudential Regulation Authority (PRA) have also had an influence over internal audit’s programme of work in the past year. This included providing a steer on areas to focus on in more detail, such as engaging in reviews on particular aspects of the liquidity plan. The Chief Audit Executives we spoke to in our research also reported that over the past year they had seen an increase in some areas of their work.

For example, they faced additional work as a result of the internal ratings based (IRB) model. This has been particularly challenging for the teams as it requires specialist internal audit skill in a period where models themselves have been under pressure. The liquidity, insolvency and behavioural models pose further challenges for the internal audit teams. The historical data that is used in the models has been particularly skewed by the pandemic. Therefore, there are questions around the relevance of the data for the future and how businesses will manage model adjustments on such an unprecedented scale. The modelling usually requires a particular set of business skills as well as skilled internal auditors, meaning that organisations will often need to bring in additional expert judgement.

“We identified control gaps where manual processes were in place, or areas where we can raise management’s awareness on the need to invest in automation to generate those operational efficiencies and long-term costsavings. So, we have helped to influence cost-savings by suggesting where management invests in the future.” Chief Audit Executive, Large Insurance Company

Key lessons learned and advice for other audit teams All additional processes that financial services organisations have in place (such as enhanced liquidity reporting requirements, recovery planning, resolution planning, stress testing and scenario planning) come at a significant cost to the business to implement. However, all of these processes help internal audit teams to build capacity and capability and will mean that they are better prepared for future crises. For other organisations in particular, stress testing and scenario and recovery planning techniques would help to prepare the business for the unexpected and be particularly useful when faced with further large-scale events that may arise.

About the Chartered Institute of Internal Auditors The Chartered Institute of Internal Auditors is the only professional body dedicated exclusively to training, supporting and representing internal auditors in the UK and Ireland. We have 10,000 members in all sectors of the economy. First established in 1948, we obtained our Royal Charter in 2010. About 2,500 members are Chartered Internal Auditors and have earned the designation CMIIA. Over 1,000 of our members hold the position of head of internal audit and the majority of FTSE 100 companies are represented amongst our membership. Members are part of a global network of 200,000 members in 170 countries, all working to the same International Standards and Code of Ethics.

Stay connected

www.iia.org.uk

tel 020 7498 0101 email info@iia.org.uk