Involvement of internal audit in strategy (Grid 11)
Involvement of internal audit in strategy (Grid 11)
Some interviewees felt the introduction of risk-management processes had had a positive impact on their company’s strategic decisionmaking;nolongerwasitdowntothe‘gutfeel’ofthechairman. However, the interviewees had little involvement in strategic processes. Theintervieweeswereaskedspecificallyaboutthisareabecauseithad been brought up by one of the initial interviewees (Company U) and because there had been indications that an effect of the introduction of business risk auditing had been to encourage external auditors to offer strategic advice. Some interviewees were clear that this was beyond the remit of internal audit, while others had a different view:
We don’t do any work really at looking at the strategic build and direction of the company. Now my personal view of this is that we are missing a trick there, but it is a very, very difficult area to audit. We don’t actually have a great deal of interaction … when the strategic plan is built, they are asked to identify the key risks in the strategy
T HE T URNBULL R EPORT ,I NTERNAL A UDIT AND R ISK M ANAGEMENT 73
and we try to get the risk workshop timed so that when they are building the strategic plan they are performing a risk workshop so it actually feeds into the strategic plan build and also into the timing of the putting together of our audit plan, but it doesn’t always work that way. That really is the only sort of interaction between the two, we don’t audit the strategy. (M)
I think we are being pulled more in the direction of strategy. The improvements we suggest require to be incorporated in an execution matrix. We make a contribution to the implementation of strategy – we are a lot closer to strategy than compliance. What we do is identify the riskiness [inherent in strategy] and feed it into our processes. (G)
In another company, inter nal audit had reviewed board processes:
We are just finishing at the moment an audit of the risk that the board becomes ineffective, so inappropriate structures, inappropriate membership and internal conflict, and we have looked at the mechanisms that the board has, that they use to manage the risk internally. That’s the most difficult one we have ever done, because we are not experts in that, in fact very few people are, but what we have done is to interview the directors, talked to them, get their ideas, consolidate them, just as you are doing with me now, and then we played it back to them, and we said “Well these are the things you have said are the key issues, and we have done a very short questionnaire, and what do you think about these”, just, you know, five little questions on a note to all the directors and then they come back. Because as we serve them we can’t actually audit them as they are our masters, but what we are doing is holding a mirror up to them saying “Look you can reflect or pass back to yourselves collectively in an anonymous way”. (Q)
74 T HE T URNBULL R EPORT ,I NTERNAL C ONTROL AND R ISK M ANAGEMENT :
Involvement in strategy had implications for the independence of internal audit:
… it is not us who is making the decisions, the strategic decisions, so we may advise but we would not be a decision taker or maker, and our advice, as I said, is generally far more from the controls aspects point of view anyway, in terms of this is something we are looking at, what are the internal audit considerations regarding this, you know, to see which way we go on this decision. So no, I feel quite comfortable about our independence, more so now actually, since de- merger and since we are a group audit function reporting directly into the audit committee. (H)
... it’s been a struggle because, again, you’re working on a project and trying to remain independent of that project from an audit perspective, but also you do have definite interests in getting the controls going. (P)