Derek Foster - Managing Change - Internal Audit Operations - Pt. 3

Article By Derek Foster

In the final article of a three part series discussing change management in the internal audit environment, Derek Foster, Director of Internal Audit & Risk Management at Royal Mail plc considers ways of recognising a changed and high performing internal audit function.

If you are trying to make changes in your internal audit function, it’s helpful to have a clear vision of what success looks like. In other words, what are the typical characteristics of an outperforming internal audit function? We’ve already discussed the why and how, so the logical next step is to address the ‘what’ question – what could the end result look like?

Of course, there is no single right answer as the IA function should reflect and adapt to the specific needs of the business, but it’s an intriguing question to explore. In fact, the process of visualising your end destination is one of the most useful things you can do when embarking on a change journey. So, it may be helpful to consider these questions and issues when deciding what successful change management within the IA function should look like.

1. Making change a constant.

How does the change programme feel to you and the team – a smooth, organic transition or inspired by panic? Has it been imposed on you from outside influences? Is it a catch up action, designed to hastily propel the function to where it needs to be? Does the scale and consistency (or lack of) within the change programme itself tell you something?

It’s always good to have a long hard look at what you do and how you do it, particularly in the area of change management within internal audit.
It’s always good to have a long hard look at what you do and how you do it, particularly in the area of change management within internal audit.

The ideal for a high functioning IA unit should be a process of continuous evolution which positions change not as a project but as a constant. It’s all too easy to be distracted by very real and pressing daily challenges, so you may need to make a conscious effort to devote some thinking time to the change process and how it could become an endemic part of your IA function. Spend some time considering how you recruit, encourage, reward those who look to dothe job in a new, better way.

2. The people dimension.

People are crucial to any organisation, so what questions should we be asking to really challenge ourselves on the people/staff dimension of the business? To what extent is the IA function an attractor of outside talent and is it seen as an aspirational destination within the business? Does the wider business position IA roles as career path roles? What is the level of engagement / motivation of your people compared to the rest of the business? Do you have a ‘guest auditor’ programme? If not, what do you think the take-up would be if you had one?

3. The efficiency dimension.

It sounds basic, but we can’t achieve the higher level stuff unless we have a rock-solid base to build on – and that can’t be taken for granted. So, consider whether the function is operating at a high level of efficiency. How do you know and is it something you measure? Does it have an established, dependable ‘engine’ that takes care of things like work papers? Are there simple, standard processes such as annual planning, assignment planning and reporting that are repeatable and avoid reinventing wheels? Is data analytics used where it makes sense to do so?

4. The customer dimension.

Ultimately, it is the customer who will decide if you are adding value or not. So, could the function’s key customers articulate the link between the business strategy and our work? Does the phone ring with requests from customers which show that they see your function as helpful and relevant – and do you react in an agile way? Are some of these calls asking for advice, and not just an audit? Ideally, your perception of the function’s status and ability to add value should be matched by its position within the organisational structure.

5. The value dimension.

To what extent can you point to added value e.g. through processes such as root cause analysis or the analysis of underlying themes from findings? Can you identify where you have anticipated the needs of the Board and / or senior management and devised solutions to help address needs they have not yet demanded? Do we sometimes tell them things that they don’t already know? Is enough of your focus on future business challenges? Are your messages really crisp, unambiguous, commercial, pragmatic? How close can you get to giving the Board a rolling view of the organisation’s control environment?

Derek Foster - Director of Internal Audit & Risk Management at Royal Mail plc Derek Foster is Director of Internal Audit & Risk Management at Royal Mail plc

When you look across the body of work you do you should be able to point to sustained improvement and/ or maintenance of organisational value as a result of your assurance, advice and insights. It’s also important to consider to what extent the internal audit function is becoming the function most appropriate to the future (and not just the current), overall business.

It’s always good to take a step back and take a long hard look at what you do and how you do it, particularly in the area of change management within internal audit function. And let’s not forget – internal audit is not compulsory.

It’s a great time to be part of the IA profession. Business is changing rapidly, looking for resources that are attuned to these changes and which can help an organisation stay ahead. So, it’s important to remember that how we make change happen in our own functions is central to credibility.

I leave you with what I believe to be a compelling aspiration for us all and those who work in internal audit functions. We should strive to be seen not just as role models in giving strong, objective assurance and advice, but as role models in making change happen productively and successfully in the world of business.