Transformation programmes are always challenging to manage and demanding on everyone affected by them. Derek Anderson, Head of Internal Audit and Assurance, Northern Ireland Education Authority, describes leading the authority’s internal audit service towards a position of “trusted key player” in an ambitious programme of change.

“Don’t go there, it’s a basket case”, Derek Anderson was warned when was offered the post of Head of Internal Audit and Assurance for the Northern Ireland Education Authority in September 2017. Choosing to ignore this advice, he took up the formidable task of re-positioning the organisation’s internal audit service during an ambitious programme of change.

“All assurance was down to me - what a challenge!” he told delegates at ACCA UK's 2019 Internal Audit Conference, “Collaborative Independence”. It certainly was. The Northern Ireland Education Authority had gone from five separate organisations to one, responsible for over 1,000 schools across the country.

“But while five organisations had merged, it was almost as if no-one had told them,” Derek said. “They were behaving as if they were still separate: there was no communication between the five teams, no single processes or systems, no consistency in the way they were working and they were auditing the wrong things in the wrong way. Did it amount to assurance? No, it didn’t.

“In the first year, I don’t even know how I provided assurance or what I based it on – other than a wing and a prayer. We were ridiculously inefficient. The Department of Education, the body that sponsors and monitors us, had lost faith in us and the NI Audit Office couldn’t place any faith in our audit reports. I was barely able to justify providing annual assurance. All I could do was promise that it would get better.”

A blank sheet of paper

The only sensible strategy was to start from scratch, which meant carrying out an audit needs assessment, establishing a key risks map, defining to the organisation what every audit was and what it would be looking at.

Activities that Derek deemed were not Internal Audit’s job were stopped. These included visiting every school to check that the annual school census they supplied was correct. Another, which proved unpopular, was ceasing to do a financial audit of private school funds, a responsibility which he said lies with the school board of governors.

Fraud investigations, which the authority’s internal audit service is responsible for, were many other eye-openers. “I thought there wouldn’t be many but boy was I wrong,” Derek admitted. “Wherever you have cash in an organisation you have huge risk. If I had one wish now it would be to take all cash out of Northern Ireland schools, and so we are trying to move to cash-free systems.”

Across the five teams, a range of job titles, descriptions and pay grades also needed sorting out. There were members of the teams who possessed no audit qualifications, so a programme of training was put in place. Around 50% of the auditing team passed all their exams.

Derek encountered a lot of resistance to the changes he made, having genuinely believed that if he explained why they were needed that they would be accepted. Nearly two years on, methods and process protocols have all changed and audits are far better. “We are getting there but the journey has been tortuous.” Derek said.

Maintaining independence?

The authority has brought in a new management team and Derek’s understanding of the business has placed him in a unique position. “I am sought after for interview panels, which is a huge demand on my time, but means I get a hand in appointing the right people with the right skills,” he said. “We are becoming digital by default, moving away from paper-based systems and introducing digital applications for jobs. We’re on our way to realising my vision: a future role for Internal Audit as a trusted, valued and strategic advisor.”

This vision raises the question of how, as an adviser, it is possible to retain the independence demanded of Internal Audit.

“I know what the standards say about independence and objectivity and I know there are a whole list of things that Internal Audit should not be doing,” Derek said. “Well, it’s really difficult. In my previous job, I was so far across that line I’m not sure I could find my way back again. I felt I was being involved in every decision.”

Acknowledging that this was going too far, he admitted that he sometimes wondered if his opinion and advice was really wanted or whether he was put in that position so he could be blamed when something went wrong. “That’s a big risk, isn’t it? he observed. “How do you square that circle?  If I’m closely involved in, for instance designing a system, I can stop it going wrong. On the other hand, how can I then audit it and retain my independence?”

Drawing together a corporate risk register was probably not something he should do, he admitted, but no-one else was doing it. “However, now I have that register, I have managed to divorce myself from it and hand it over to another team. The register is there, as it should be, to provide independence assurance and commentary to the audit committee.”

The sticky stuff

Derek suggested to conference delegates that if an organisation was “up to their middle in the sticky stuff”, it was not very effective to cite independence and objectivity as a reason not to come to its aid.

“That’s not helping the organisation in my view. And that’s the argument for riding a coach and horses through the independence thing. It is far better to help by putting in controls and processes that stop the organisation getting into problems again and then stand aside. Obviously, I can’t permanently be pulling the organisation out of the sticky stuff because that’s not my job. But I don’t think I could just let her go down.”

So, if organisations currently want understanding of the business and useful advice and guidance from Internal Audit, what will they want in the fast-changing future? “In the Brave New World of new technologies and AI, we are going to need to respond quicker, apply more judgement and use more real time outputs to deliver the organisation’s messages and meet stakeholder need,” Derek concluded. “That’s the future and we need to embrace it. “

Jill Wyatt is a business journalist