Changing the internal audit function - Developing functional outcomes

In part 1 of this series on changing the internal audit function we identified four characteristics of internal audit functional strategy that establish the conditions for continual and strategically aligned change and continual improvement in auditing, namely:

1. Start with the what – Developing a simple but inspiring, purpose driven strategy.
2. Set clear functional outcomes and associated activities – Developing a framework to guide decision taking on what and when to change.
3. Align all activity to the strategic outcomes - Ensuring that everyone and everything is aligned to this strategy so that every person and team pulls in the same direction.
4. Organise to deliver through developing a culture of continuous internal audit improvement - Pursuing an ongoing process of stretching change, enjoying success and celebrating and learning from failures on their way,

We also explored the first characteristic - Starting with the what through developing a simple but inspiring purpose.  In this next installment we explore characteristic #2 to understand how well-intentioned purpose counts for nothing if it isn’t the catalyst for clear outcomes outlining what needs to be true in order to achieve the defined purpose.

Characteristic #2 - Set clear functional outcomes and associated activities

When talking about change of any kind it is important that you start with the what. The biggest waste of energy, cost and time is carrying out change effort on areas where change isn’t required or the change isn’t a priority.

In order to successfully target your finite resources on changes that will really turn the performance dial and move you closer to achieving your Internal Audit Purpose you need to develop clear functional outcomes.

Internal audit functional outcomes set out what you believe needs to be true (or at least increasingly true over the strategy time horizon – typically 3-5 years) if you are to deliver on your purpose. In this context they typically will have the following two features:

• They are future focused statements of intent - They describe in more detail what great looks like across the function. Thye look into the future drawing on developments in areas such as technology and data analytics.
• They are stretching but generally considered achievable. Sometimes call ‘roofshots’ setting out ambition that whilst difficult to achieve is attainable. Note you may also consider including one or two (but no more) exploratory ‘moonshot’ outcomes as part of longer term innovation (see below for more on roofshots and moonshots).

Internal audit functional outcomes are likely to cover the four areas of a typical internal audit functions operating model, namely:

• Position – How the function will be perceived.
• Process – What do you need to excel at to be successful including the technology to enable the achievement of your strategy.
• People – what kind of people do you need.
• Performance – what does success look like (measurement) for your internal audit work.

But what do these functional outcomes actually look like? Here are some examples of internal audit functional outcomes that I have seen in my work. They are all intended to describe what will be true over a 3-5 year period and provide focus for activity across the function:

• Leverage IA’s reputation as experts in internal control – Advocate and educate the business on effective control & its positive impact on business performance.
• Data driven insights – Data is central to all we do, deploying leading edge data analytics / continuous auditing techniques. Increased coverage, deeper insights and early warnings of risk.
• Auditor enabling tech – Increased leverage of core technology and harnessing new technology to enable more dynamic working
• Collaboration, diversity and inclusion – Embracing diversity of thought & background. Collaborating to leverage all the global team’s capabilities.
• Auditor experience (AX) – Auditor experience is simple, clear and supportive. Enabling great work by great people.
• Making space to innovate - Allowing us to try the ‘art of the (im)possible’, test, fail and learn, try again and succeed.

How do these stack up? A clear example of a ‘roofshot’ outcome is the focus on improving the auditor experience in the ‘AX’ outcome. The organisation that established this as a priority outcome identified that it had a tendency to over engineer its methodology and technology and wanted to signal to the team that it recognised this and was strategically going to hold itself to account to simplify all that they do and make internal auditing a more enjoyable experience. This outcome acted as the call to action for a radical overhaul of its methodology (reduced from over 150 pages to just 15) and associated shift to simplify its implementation of its TeamMate audit system for much greater impact. All of this became simpler, quicker and much more auditor friendly, significantly boosting productively and auditor engagement.

From a more ‘moonshot’ perspective is the outcome to ‘Making space to innovate’. This was intended to give time and space for more forward thinking innovation activity and also permission to test and fail with new ideas. This was identified as being a problematic area as the internal auditors were relatively risk adverse in trying new things that had a probability of failure and this was leading to lost opportunities where some great ideas were not taken forward. One way that they did this was through running change hacks and innovation incubators – where they took colleagues out of their work and facilitated idea development through to product design and testing in a compressed manner. This led to significant change in their methodology implemented overnight and also a pilot beginning their journey on implementing continuous business monitoring and the adoption of a more agile way of working.

There are two aspects of developing successful outcomes of this type:

• Engage widely - This aspect of the strategy is more likely to be successful if it is developed with wide engagement. Whilst your internal audit purpose, typically, will be developed by the leadership team the outcomes need to be developed with significant input from a range of your stakeholders. What is the value you will bring to the organisation and how will this value manifest itself? Your CEO, COO, FD, HR Director, etc will all have a view and ideas of where your function can deliver value to them. You can then consider this alongside the views of the non-executive directors who will also bring thoughts from other organisations they are involved with. Alongside this it is important that you truly listen to your team. Can you get a conversation going in the function around ideas and innovation and areas to change? It has been shown that engaging the team in determining the change significantly increases the probability of the change being successful. So find out what excites your team about how auditing may look in the future and where they see blockers / challenges to achieving this.
• Set a manageable number of outcomes – A series of 8-12 outcomes (perhaps aligned to the 4 areas, or derivations of these, of an internal audit operating model set out earlier in this piece) is likely to be much more successful that 20. You want the outcomes to provide direction to activity not constrain everything your internal auditors do. Having too many will lead to them being ignored or worse acting as a detailed plan that constrains engagement. Having too few will inhibit appropriate prioritisation over the 3-5 timeframe of your strategy.

So at this point in the development of your internal audit functional strategy you have a compelling purpose and a series of outcomes which you can align all the function behind. Next you need to consider what actual change activities you need to set in train to get closer to these outcomes and ultimately the purpose. In this context the next article in the series will explore the third characteristic of internal audit functional strategy, namely Align all activity to the strategic outcomes.