Köln Bonn Airport & TeamMate+ Audit

Choice criteria

Germany’s airports are mainly owned by central or local government and are therefore subject to stringent tendering rules, so Hilgert highlighted three vendors and drew up his top level needs – things that the software had to have – and some secondary needs that would be good to have, but were not essential.

He initially considered buying software that could be run in-house, but the IT team was overloaded servicing multiple specialist software packages and had no capacity to take on another. This made the prospect of a system that could be hosted, maintained and updated remotely in the cloud an essential requirement.

TeamMate+ emerged as the only system that met all the top level “A” list of criteria. In particular, it was fully hosted, which was an essential requirement.

The next challenge was to familiarise the auditors with the new software. While one member of the team had used similar software in a previous role, another found it far more challenging, coupled as it was with the introduction of new control processes and audit expectations. The initial learning curve was steep, but once auditors became used to the idea that the entire audit documentation could now take place within a single system and to see how this enabled new ways of working, they began to appreciate it.

Follow-up flow

“Previously, it was time-consuming to follow up and close items – managers would receive a report and be told they had six months to resolve an issue, at the end of this they might say that they needed a further six months, and then eventually they would tell us it had been done and the team would close it. We never had many outstanding items, but equally we had little evidence that issues had actually been addressed.”

Now, he says, the team can see all open items, check the timescales and ask questions about progress. Managers can log into the system and submit evidence of actions and the auditors are automatically notified so they can review the actions and sign the item off once it is checked.

“Managers know that if issues stay open too long, this will appear in a report to the board along with broader questions about whether this creates organisational risk and needs to be escalated. They don’t want this,” Hilgert adds. Even more importantly, it gives the board an overview of risks to the business and areas where issues are not being resolved and helps managers to keep track of where they are against open issues.

Reporting is another significant improvement. Senior managers can see the key identified risks and drill down for details. The reporting process is faster and more flexible and Hilgert believes this has led to reports being more accepted by – and better used – by the board.

At the same time, the reporting structure has been revised so that Hilgert now reports to the supervisory board, rather than to operational management, and they are using TeamMate+’s dashboards alongside his reports and presentations to get a clearer view of the organisation’s risks.

“I feel now that we are working as a full internal audit team in a way we were not before,” Hilgert says.

Remote power

The new system and the team’s increased profile within the organisation have proved invaluable during the upheaval caused by the Covid-19 pandemic. The fact that the audit team (and board) can access their data and share documents securely from their homes has been essential while they identified and changed the airport’s risk profile and replanned their audit schedule.

“The file share function and the fact we can still send audit requests and other documents from home has enabled us to keep on track with audits throughout the crisis, as well as helping us to identify new fast-emerging risks caused by Covid,” Hilgert explains. “Overall, although the risks changed rapidly, the business of internal audit could continue remotely.”

From being a small, traditional, back-office function, the internal audit team now has the potential to be a trailblazer to demonstrate to other parts of the airport how things can be done smarter and more efficiently. “We are a gatekeeper in terms of maturity in the organisation,” Hilgert says.