In this series of articles we will explore aspects of how to be successful in making changes to your internal audit function and through this change how you go about auditing the business. We have all seen over the last 18 months the importance of successful change in what we do – the audits we look to execute in order to give the assurance our Board and senior management are looking for – and how we do it – our auditing methodology including innovations such as applying a greater range of data analytics, elements of continuous auditing, integrated assurance with our colleagues from other functions and increasing the agility of our audit approach. The pandemic has forced a number of changes on us, but as we emerge from the restrictions it is important for internal audit functions to continue the focus on continual improvement.
It is our view that the internal audit functions that will deliver the highest value and help protect their organisations from damaging control failures are those that continue to innovate and adapt how they work – both incrementally but also in more radical ways. This is not change for the sake of change or indeed jumping on the latest fad or trend. This is about internal audit functions that are clear on the role they play and are focussed on creating long term value and fostering their culture, such that it systematically generates ideas and drives change.
Having worked with a range of internal audit functions I believe that the most successful functions focus not on delivering one-off transformation, but on creating the conditions for continual and strategically aligned change. This is about getting the fundamentals of change in place and, through this, being able to sustain a higher rate of internal change that sticks. Internal audit functions that achieve this position share 4 characteristics. They all:
- Start with the what – Developing a simple but inspiring, purpose driven strategy.
- Set clear functional outcomes and associated activities – Developing a framework to guide decision taking on what and when to change.
- Align all activity to the strategic outcomes - Ensuring that everyone is aligned to this strategy so that every person and team pulls in the same direction.
- Organise to deliver through developing a culture of continuous internal audit improvement - Pursuing an ongoing process of stretching change, enjoying success and celebrating and learning from failures on the way,
Whilst each characteristic is important it is all four working together that drives the most successful internal audit functions forward. Those that get this right deliver higher value for their organisations (and ultimately its customers) and get higher returns from their change initiatives with these benefits sustained into the future.
Sounds good? But how do you go about achieving this? In this series of articles we will explore these characteristics and apply some of the ideas they contain to particular areas of change that many internal audit functions are exploring to understand what really makes the difference and how to get started. In this first article we explore characteristic #1 - Start with the what – Developing a simple but inspiring, purpose driven strategy.
Characteristic #1 - Start with the what – Developing a simple but inspiring, purpose driven strategy
The Internal audit Functional strategy sets out why the internal audit function exists, the essence of where it wants to go and the outcomes that need to be true in order for this purpose to be achieved. This is distinct from your auditing strategy – what you are going to audit and why – which is likely to be found in an internal audit plan of some sort.
Strategies often fail because they are complex, dull or often both. The consequence is they have no impact beyond the internal audit leadership team and, in reality, little impact there too. This excessive complexity means that delivering on the promises in the strategy is often painfully slow, important assumptions made are lost in the dirge of detail and the strategy dies or constantly flips leaving everyone confused about the direction required for success.
Successful strategy needs to be both simple and inspiring, providing a functional ‘North Star’ to all decision making, encouraging aligned activity and improved performance in the areas most needed. Internal audit functions with a clear strategy that remains consistent over a longer time horizon (typically 3-5 years), respond faster to change, keep investing ahead even when times are hard and are likely to outperform peer functions over the same period in both the impact and efficiency of their work.
So how do you create an internal audit functional strategy that lasts, that people will care about, and that accelerates - not stifles - innovation and change? The key is to start with your purpose - the reason why you exist as a function. Purpose compels people to act and gives us all meaning in what we do. Never has this been seen as more important through the pandemic and resulting recovery where people have questioned the meaning in their lives and what they are looking to achieve. In doing this you need to avoid the risk of developing a dull statement of generic good intentions disconnected from what the business you are auditing actually does. There is a big difference between simply having a purpose and having a purpose that propels your function forward. In this context a great purpose will:
- Be externally focussed; it will speak to the unique relationship you want with your stakeholders and how you intend to bring value to their world;
- Stretch you; it will be aspirational, ahead of you in the future not already true. This will challenge you and your team to innovate not just for today’s internal audit work but the internal audit work of the future; and
- Is worthwhile and meaningful for those that you wish to motivate; it will act as a call to action to all of your internal audit team, a statement that they will believe is worth pushing hard to achieve and drive them to give all that they can to your internal audit cause.
Yes, we are foremost self-interested in what we do looking to put what is best for us (and often our families) first, but what if we could see that our own interests are also aligned with doing wider good in the world in which we operate. Alignment of this type is powerful in harnessing discretionary effort and creativity. And in internal audit we have an advantage here over many parts of our business because all of what we do is intended to protect others in our quest for strong controls that support the business in moving forward to the benefit of customers.
But what does this actually look like. Here are some examples of internal audit purpose that I have seen in my work. They are all intended to achieve the same goal of delivering a simple but inspiring reason to do what we do every day. A call to do it to the best of our ability and innovate to continually do it better:
- 'Better insights, better outcomes’
- ‘Faster and more effective improvement in controls’
- ‘To keep the Group secure and sustainable’
- ‘Contribute to the sustainable success of the group ….by promoting an effective framework of controls’
How do these stack up? My favourite of these is ‘Better insights, better outcomes’. This was a function that was striving to move away from internal audit work which was dominated by testing compliance to the development of more strategic insights (including thematically across the business) from its internal audit work that would lead to better results for its organisation and its customers. The language of ‘outcomes’ was widely understood as it was at the heart of the organisation’s strategic intent so the internal audit function knew it needed to align to this. The purpose clearly signalled from the very top that compliance testing was not what the function was about. The team responded well to this enjoying the wider freedom that this presented in their internal audit work as they began to develop deeper insight through dialogue and testing and using genuinely creative thinking to provide suggestions to the business on how the improvements identified could lead to better customer outcomes. I also like ‘Faster and more effective improvement in controls’. This was a well-established internal audit function that aspired to move the function to a leadership role in the area of internal risk and control expertise. This set the tone for much of their change work which was focussed around being the leading internal advocates and educators on effective control and the positive impact this can have on the internal control environment. Again moving the function beyond traditional internal audit work to insight generation and in this case organisational educator on the power of a great control environment. This helped shift the team from often passive identification of issues to being the go to place for engagement on how to drive deep and sustainable control improvements in each business unit.
But well-intentioned purpose counts for nothing if it isn’t the catalyst for the development of clear outcomes that shape the day to day actions of your teams. This leads to the second characteristic of a great internal audit functional strategy - set clear functional outcomes and associated activities - which will be covered in the next article.