In the first three parts of this series on changing the internal audit function we identified four characteristics of internal audit functional strategy that establish the conditions for continual and strategically aligned change and explored the first three characteristics, namely:
- Start with the what – Developing a simple but inspiring, purpose-driven strategy.
- Set clear functional outcomes and associated activities – Developing a framework to guide decisions, taking on what and when to change.
- Align all activity to the strategic outcomes - Ensuring that everyone is aligned to this strategy so that every person and team pulls in the same direction.
- Organise to deliver through developing a culture of continuous internal audit improvement - Pursuing an ongoing process of stretching change, enjoying success, and celebrating and learning from failures on the way.
In this next installment, we explore characteristic #4 around how to organise to increase the probability of success in achieving your internal audit functional outcomes and the activity established to do this.
Characteristic #4 – Organise to deliver through developing a culture of continuous internal audit improvement
This series of articles has consistently argued that internal audit functions that deliver the highest value and help protect their organisations from damaging control failures are those that continue to innovate and adapt how they work. This requires audit leadership to develop an operating model that supports continual and strategically aligned change. Sustaining a higher rate of internal change that sticks.
How you set up to manage the changes you wish to make will depend on the size of your function and the scale and complexity of change that you have determined will continue to be necessary. There are, in my experience, two fundamental operating model choices that leaders face in establishing how changes will be managed in their function.
The first is about how you will manage the change alongside your core role of delivering ongoing assurance. You could ask colleagues to manage the change in addition to their day-to-day work – what I call a ‘side of desk’ approach. This is likely to be the necessary approach in smaller functions or where the change is identified as low effort. However, this can cause problems where your change is complex, for example, if you are looking at truly implementing agile or a sophisticated integrated analytics approach to your audit work. When the change is more complex you may wish to explore alternative resourcing models. For example, setting up a temporary team or giving someone time out of day-to-day audit work to focus their effort fully on the change you are looking to make. I have also seen larger organisations setting up permanent change capability in the audit function – for example one function I worked with targets having 5% of its resources deployed in this way permanently.
Whichever of these models is right for your circumstances you will need to think about the impact on the delivery of your audit plan of taking people away from their audit work, including how expecting colleagues to manage additional change activity from the ‘side of their desk’ may damage core audit delivery.
The second choice is around who should be used to deliver the change activity.
If you can avoid the significant use of consultants, it is good not only to help manage costs but also from building support in the team for the change that you are proposing. Change by auditors for auditors is, in my experience, more successful. Use consultants for short bursts of expert input and ideas and upskilling your team rather than the detailed work. Also if change is a strategic priority signal this by putting your best people on leading the change required, whilst also remembering to recognise others who continue in business-as-usual audit work and perhaps are asked to deliver a higher volume of audit work to help release resources. Complex change assignments are a great opportunity to allow your top talent to get prolonged and challenging exposure to the internal audit leadership team and show how they can adapt to different circumstances.
Even if you are set up to succeed with your operating model it is important that you also have a clear sustainability strategy to ensure that all your efforts lead to the results that you deserve and that the value generated is sustained. Failure to sustain success is commonplace, but there are four simple steps you can take to reduce the chance that this occurs for the changes that you have made.
Step 1 – Align your performance management system to the delivery of prolonged value
It is key that you use your performance management system to really embed relevant aspects of the change projects.
The first step of this is to include relevant aspects of change that have been made into individual objectives.
For example, if you have made a major change to your audit methodology or introduced data analytics capabilities and successfully trained your colleagues on these changes then ensure that every team member is held to account in their objectives for using the new methodology in their work or adopting the new data analytics technologies in place and skills gained through the training programme.
Step 2 – Focus the leadership team on value delivery through functional performance indicators and reward
Next consider establishing key performance indicators across the function for elements of the projects you have completed to ensure senior attention on the delivery of value and course correction where the change is not having the impact it should. These would be embedded in the function’s scorecard or measurement system for a period to ensure the attention is maintained. This could be for one year but may also be longer.
For example, in one organisation I worked with they permanently introduced measurement of the use of simple and complex data analytics in their audit work to ensure that the approach became core to what they do. To this day they still measure this and include it in their functional scorecard.
The establishment of relevant metrics in the functional scorecard in this way also allows you to collect reward the leadership team and function for delivering sustainable value through your reward system.
Step 3 – Ongoing role for project sponsor
You should also ensure that project sponsors from the delivery phase of a change initiative are not able to walk away from the benefits realisation phase that sustainability requires. The accountable audit director should be required periodically to provide an update to the leadership team on how successfully (or not) the change that occurred has moved into business-as-usual activity and how the benefits expected are flowing into the function. How long should this go on? This will depend on how confident you feel that the change has genuinely become part of the functions DNA and that sustainable value delivery is secured.
Step 4 – Consider establishing a Year 2 embedding project
Finally for major initiatives you may want to consider a follow-on year 2 ‘embedding project’ in your change initiatives with a project manager, project reporting, activities to support embedding, and simple measurement of how the embedding is going. An approach that I have adopted very successfully here is a heat map approach to monitoring the embedding of ‘product development’ into the day-to-day work of the internal audit function.
The example shown is for a function that had developed a new internal audit competency framework reflecting the need to change how they were managing relationships with the business and adopt new leading-edge analytical technologies. The framework was developed with wide engagement across the function, but they realised that often frameworks of this type end up simply gathering dust on a shelf rather than being used with real intent in the function as the project intended.
To avoid this they set out a number of simple outcomes that would act as indicators that the framework was delivering real benefits for the function. Five of these outcomes are shown on the slide in the left-hand column.
Over the next few months, each team had to self-report its status against each of these outcomes with this self-reporting subject to independent QA review on a sample basis. Where the heat map approach comes into its own is through looking whether reported problems are idiosyncratic, i.e. just one team struggling as is the case for a few of the outcomes for Team B, or more systematic problems as is the case for the outcome on impact. For the former, the team manager needs to be held to account for improvement as others have shown that it is achievable, for more systematic problems this may be an indication of a wider problem that may require some form of intervention to help all in the function in this area.
Following these four simple steps will increase the probability of your change work really delivering long sustainable value into the future for the team and their clients.
Conclusion
These four articles set out to explore aspects of how to be successful in making changes to your internal audit function and through this change how you go about auditing the business. We suggest that Internal audit functions that achieve this position share 4 characteristics:
- Start with the what – Developing a simple but inspiring, purpose-driven strategy.
- Set clear functional outcomes and associated activities – Developing a framework to guide decisions, taking on what and when to change.
- Align all activity to the strategic outcomes - Ensuring that everyone is aligned to this strategy so that every person and team pulls in the same direction.
- Organise to deliver through developing a culture of continuous internal audit improvement - Pursuing an ongoing process of stretching change, enjoying success and celebrating and learning from failures on the way,
Whilst each characteristic is important it is all four working together that drive the most successful internal audit functions forward. Those that get this right deliver higher value for their organisations (and ultimately its customers) and get higher returns from their change initiatives with these benefits sustained into the future.
I am pleased to have finally been able to find the time to codify what I have learned over the last decade about the development and implementation of an internal audit functional strategy from my experience with internal audit leadership teams at Aviva, Lloyds Banking Group, and Bupa.
Thank you to Wolters Kluwer for providing the platform and global reach to share my ideas with as many internal auditors as possible. Thank you also have to go to Paul Boyle, Aurelie Heurlin, Gareth Cronin, Paul Day, Marco Van Gurp, Colin Newham, Jeremy Eagles, Kristie Jephson, Paul Marshall, and Harjeet Powar for their inspiration and leadership to me and many others in audit strategy and leadership during this time. Many of the ideas here were from them, all the errors are mine.