On 3 September, The London Institute of Banking and Finance hosted a webinar to discuss how risk governance needs to change after Covid-19. The panel comprised risk experts from the first, second and third lines. In today’s blog, David Alexander, who has over 30 years financial services experience, mainly in senior internal audit, risk and consulting roles, summarises his key points from the webinar where he discussed his view from the Third Line.
Covid-19 has undoubtedly been an unfortunate and massive wake-up call for risk and internal audit professionals the world over. As boards and executive teams come to terms with some unprecedented operational and strategic challenges, internal auditors have the opportunity to really prove their worth.
Internal auditors are often considered to be the eyes and ears of the non-executives, particularly those on audit or risk committees. In the current environment, when uncertainty rules and oversight is more difficult, Internal Audit (IA) should be standing back and doing what they do best – listening, observing, and providing objective advice and insight.
The liberal use of the word “unprecedented” reflects the lack of experience that most executives have in dealing with the slings and arrows of misfortune that their firms are continually having to face. For IA to prove themselves of real value to their stakeholders in a Covid-19 world, I believe there are three key areas of focus; flexibility, relevance, and collaboration.
Flexibility
Flexibility for IA simply means that they need to be quicker to react, quicker to plan and assess where are the real hot spots, quicker to spot the big-ticket issues and quicker in informing management about real opportunities to improve controls and mitigate key risks.
Even before Covid-19, many IA teams had recognised that the traditional internal audit process took too long. A more agile and collaborative approach to planning, data analysis and reporting could save weeks in elapsed time and accelerate much needed solutions. Impact can be improved by talking to people and by using one page rather than 10 to 15.
Relevance
Flexibility is key but to grab stakeholders’ attention, IA resources must focus on what really matters. This factor is the cornerstone of the views of that well-known internal audit and risk guru, Norman Marks. His observations always seem to hit the nail on the head. His focus on what matters is more relevant now than it has ever been. And it’s not just auditing what matters, it’s auditing what matters today or tomorrow – not taking the traditional IA planning view which might look 6, 9 or 12 months ahead.
Collaboration
Today’s world is driving internal auditors to work more closely with both the first and second lines and to communicate more frequently with executive teams and with NEDs on audit and risk committees. Collaboration is also critical for IA in terms of sharing ideas with their peers and listening to the profession. We are facing a common fight and sharing good ideas and practices can only benefit the industry.
The Risk Coalition
The risk guidance produced late last year by the Risk Coalition is an excellent and timely example of collaboration, given the contributions from many relevant professional bodies, and it has even found support from the regulators. The Chartered Institute of Internal Auditors has been one of those actively involved in supporting the guidance, building on their experience of developing the Financial Services Code (published in 2013 and refined in 2017). This has really raised the bar for internal audit in financial services in the UK and the guidance from the Risk Coalition has the same aim for risk functions and risk committees.
In summary, internal audit has got to be more flexible and has got to turn things round and demonstrate its impact more quickly. Worry less about the form and more about the substance. Work closely with the first and second lines and audit what matters today. At this critical time, we should all be raising the bar (even if the government is telling us it needs to be closed by 10.00pm).
David Alexander runs his own audit and risk consulting and training company, Daart Solutions.