A panel of industry professionals closed ACCA's recent virtual Internal Audit Week with a discussion highlighting what organisations are increasingly looking for.

Internal Audit needs to step up to avoid being marginalised. This was one of the key messages picked up on by Lee Glover, Director, Haines Watts, as he reviewed the presentations given at this year’s ACCA inaugural virtual conference on the theme of resilience in a dynamic environment. “Let’s make sure we rise to the challenge, navigate change effectively and work with our organisations to be the best we can and to deliver trust in audit and governance,” he urged. 

In seeking to achieve this, panel member Robertson Stewart, management expert and coach, said that when he considers what he needs from Internal Audit, he asks himself what is most important among a list of possibilities, including employee customer satisfaction, market share and financial results. “The answer is a quote from JW Marriott,” he said. “Take care of your people and they’ll keep care of your customers and the business will take care of itself. I believe there has to be concentration on the internal service quality. Who makes sure customers get what they want? The answer is ‘the staff.’” 

In difficult times, the first budget organisations often look at cutting is training. Robertson suggested this is a mistake. “One month into the 2008 financial crisis, I suddenly realised my executive committee had no training in situational management,” he said. “Then I discovered no-one had any training in job evaluation interviews, so there was no basis on which to look at our training plans, development or future. Staff were meeting management once a year, which was nowhere near enough to look at milestone checkpoints and set future goals.”

Far too much time is taken analysing customer satisfaction and doing actions plans and  surveys when what should guide organisations is their employee satisfaction results. “If employees have the tools to do their jobs and they get everything right, you end up with customer satisfaction and loyal customers that drive up revenue growth,” Robertson said.

“My message for Internal Audit is to be sure that we are all speaking the same language and that the emphasis is on becoming more employee centric. Organisations need more help from them in middle management, rather than executive management, to ensure that employees have the correct tools and training to ensure they can do the front line job properly.” 

Looking around the corner

Jonathan Walters, Deputy Chief Executive at the Regulator of Social Housing, promised to compound his audience’s problem by suggesting that something rather different was being asked from Internal Audit. “The year 2008 saw a number of housing associations come close to bankruptcy and the housing market shut down,” he said. “All that shaped the way we think about Internal Audit and risk management within organisations. One of the roles of the regulator is to ensure continuity of service, which relies on those services surviving. So our interest is in organisations managing their risk effectively and looking round corners to where the risks are.”

In the social housing area, organisations fail because the Board has not really understood the risks they are taking on, or the information they are getting about those risks isn’t accurate, or it doesn’t tell them what they need to know. The Regulator wants to know: Does the Board of a given organisation understand the risks it’s facing? How does it monitor and understand whether those risks are crystallising? What does its mitigation strategy look like? Have they tested those mitigations for what might happen?

“Internal Audit is always about foresight and planning from our perspective,” said Jonathan. “A good Internal Audit service needs to have the ability to ask questions and test controls in advance. So, become a better client and get your Board, or whoever is buying in your service, to ask you the right questions. I think that is one of greatest skills of the IA service. Don’t just ask the Board what it wants, challenge whether it understands what it is asking for and whether it is the right thing. Where we see the best Internal Audit work is where they are providing that challenge.”

Taking the easy route

Sarah Pumfrett, consultant, independent board member and Audit & Risk Assurance committee chair at AHDB, agreed with Jonathan. “One of my frustrations is that Internal Audit tends to focus on what’s easy to audit, rather than what’s right to audit,” she said. “Partly that’s because the Board is not asking the right questions. Often discussions are not at the right level to drive internal auditors towards the right work and not enough attention is paid at the terms of reference stage when the Board is defining what assurance is wanted and why.” 

If all parties involved don’t spend enough time communicating upfront, as she pointed out, there is no point anyone asking ‘did you do this’ when the audit report hits the Boardroom. The end result can be disappointment all round because the Board thinks Internal Audit has done a bad job and didn’t give the assurance wanted, and Internal Audit feels unfairly treated because they set out the scope of the report but the Board understood something different. Management understood something different again and the result is three parties feeling the report doesn’t do the job it is supposed to.

Sarah also said that she felt that there is a drive in many organisations to get away from an opinion in audit reports: “However, I believe that if you’ve done sufficient work to be able to justify what you are saying in terms of scope of coverage, you should be willing to put your professional reputation on the line.

She added a warning about communicating risk in good times. “Bad news early is great but late news is catastrophic,” she said. “If I know something is going off track, I can challenge management about whether more resources or time are needed and who can be put in to fix the problem. If it hits the Board table too late, that’s when you’re going to find organisations going out of business.”