iia new zealand stepping up conference - influence relevance and value

STEPPING UP / IIA NZ Conference 2013 STEPPING UP / IIA NZ Conference 2013

Internal Audit andOrganisational Strategy

Increasing the Influence, Relevance and Value of

Internal Audit

David MallardCornerstone Integral

Melbourne

STEPPING UP / IIA NZ Conference 2013

Topic

1 The impact of strategic risk

2 Are we doing enough?

3 Recent research into the profession

4 The standards

5 Three common strategy failure points

6 Auditing strategy development

7 Strategy execution risk

8 Strategy execution audit

9 Insight over the journey

10 Audit people capability

11 Optimising technical with non-technical

12 Implications of auditing strategy

13 Conclusion

WHAT WE WILL SHARE


Strategic risks pose a much more significant threat to companies

than more easily auditable risk areas

Strategic risks cause 68% of severe market capitalisation decline

THE IMPACT OF STRATEGIC RISK

STEPPING UP / IIA NZ Conference 2013STEPPING UP / IIA NZ Conference 2013

Strategic risks account for 68% of severe market

declinesRisk Categories

Strategic

Legal and Compliance

Financial

Operational

68%

7%

12%

13%

Percentage of Risk Failures Leading to Significant Market Decline

6%

13%

49%

32%

Percentage of Time Spent By Audit Departments on these Risk types

Audit departments

report spending only 6% of their

time auditing strategic risks

ARE WE DOING ENOUGH?


RECENT RESEARCH

To deliver real value, audit plan’s must be responsive, flexible

and aligned with company strategy

61% of survey respondents said

Internal Audit did not have a mandate

aligned to business strategy

Top Priority - be more relevant to achieving

the organisation’s objectives


RECENT RESEARCH

# 1 PRIORITY:BE MORE RELEVANT


2130. A1 – The internal audit activity must evaluate the adequacy and effectiveness of controls in responding to risks within the organisation’s governance, operations, and information systems regarding the:

1. Achievement of the organisation’s strategic objectives

2. ..3. ..

INTERNATIONAL STANDARDS OCTOBER 2012


THREE COMMON STRATEGY FAILURE POINTS

Flawed Business Assumptions: Management assumptions may not be rigorously tested resulting in organisational objectives that are inconsistent with the enterprise’s capabilities or the realities of the business environment.

Business Unit Misalignment: Lack of communication or a strategy development framework for business units can result in business unit objectives and operating plans that fail to align to enterprise objectives.

Employee Understanding: Poor communication of strategic priorities throughout the organisation can lead to a lack of understanding and belief in the future direction of the company.


1. Strategic Planning Process Audit: Review the strategic planning process to ensure there is a common framework for the development of business unit strategic plans and assess the alignment between business unit, department, and corporate level strategic plans.

Are enterprise level strategic

objectives documented

and measurable?

Does the company have a documented process for strategic planning? Has the

process been complied with?

Are Business Unit objectives

reasonably related to enterprise objectives?

Is there alignment between

enterprise and business level

strategies?

SIMPLE STEPS TO AUDIT STRATEGY


2. Audit of Assumptions: Identify and validate assumptions about the internal and external

environment made at the enterprise, business unit, and project level.

Are key assumptions underpinning the plan

for achieving objectives documented?

Are key assumptions reasonable given all the

evidence?



3. Strategy Communication and Awareness Audit: Assess the effectiveness of strategy communication to all levels of the organisation.

Do incentives and/or performance criteria link to strategic objectives ?

To what extent do employees believe in the

strategy?

What level of awareness do employees have in

the strategy?



Kaplan and Norton (developers of the balanced scorecard) report

that 90 per cent of organisations fail to execute their strategies

successfully.

STRATEGY EXECUTION IS THE CHALLENGE

Fortune Magazine famously stated that organisations fail to

successfully implement strategy, not because of bad strategy, but because of bad

execution.


Strategy Execution

STRATEGY EXECUTION RISK


In the 2013 State of the Profession study, PwC highlighted that

management is least satisfied with Internal Audit’s contribution in

less-traditional audit areas such as ‘large change program’

assessment.

STRATEGY EXECUTION RISK

This suggest Internal Audit’s approach to large strategic change

programs requires a rethink.


My experience at Australia Post

AUDITING STRATEGY EXECUTION


Regularly polled senior executives and Board members about their perception of Internal

Audit VALUE and effectiveness




Stakeholder feedback resulted in

the question:

How does Internal Audit address

strategic risk more effectively?


1. We viewed the organisation's strategic plan as an ‘inventory’ of organisational change programs

2. Ranked each program by importance to company objectives, complexity, scale etc.

3. Diagnosed history of previous investments, where they had succeeded or failed, and considered organisational capability challenges

HOW WE TACKLED STRATEGIC RISK AUDITING STRATEGY EXECUTION

4. Developed new Audit tactics to assess strategic program investments


FOUNDATIONAL THINKING- THE INTEGRAL FRAMEWORK

INTENTIONAL (I)

Personal Mastery

Attitudes

Engagement

Perspectives

CULTURE (WE)

Cultural Mastery

Relationships

Politics

Leadership

BEHAVIOURAL (IT)

Capability Mastery

Performance

Accountability

Results

SYSTEMS (ITS)

Strategy Mastery

Structures

Policies

Technology

TANGIBLEINTANGIBLE

INDIVIDUAL

COLLECTIVE


The Language of Thoughts &

Feelings

The Language of Relationship & Meaning

The Language of Behaviour &

Action

The language of Systems & Strategy

TANGIBLEINTANGIBLE

INDIVIDUAL

COLLECTIVE

INDIVIDUAL

COLLECTIVE

TANGIBLEINTANGIBLE

FOUNDATIONAL THINKING- THE INTEGRAL FRAMEWORK


2. PIR’s not optimising limited Audit resources. ‘In-Flight’ real time assessment

3. Rapid feedback – ‘Contemporary, Actionable Assurance’

1. A HOLISTIC view – considered typical program management and technical issues in conjunction with humanistic elements – collective and individual

4. Relevant to stakeholder objectives - organisationally and personally

AUDITING STRATEGY EXECUTION- THE AUSTRALIA POST EXPERIENCE



Feedback on more than 50 data points is collected. Depending on project scale/risk, several Health Checks are conducted over the project lifecycle

and/or within significant project phases.



A 360O STRATEGIC PROJECT HEALTH CHECK

Assessments from multiple perspectives


Poll stakeholder perceptions and/or confidence levels

horizontally and vertically



ORGANISATIONAL POLITICS ‘CULTURAL CUL DE SACS’




Triangulate feedback.Deep dive on the ‘hot

spots’ and validate



Integrates the ‘Hard and Soft’ risk issues aligned to

the phase of program development or

implementation, enabling a more holistic assessment

of relative risk to the Strategic program.

Drives close to real time Internal Audit feedback

enabling program course corrections before its too

late.


Internal Audit Headline Conclusion…..

AUDITING STRATEGY EXECUTION- ‘SAYING IT RIGHT’


During the review, each success factor is broken down into its core components.

Internal Audit considers all

information collected from 50 data points

during the assessment and

applies its professional judgment to

determine the final ratings.

AUDITING STRATEGY EXECUTION- ‘SAYING IT RIGHT’


AUDITING STRATEGY EXECUTION- INSIGHT OVER THE JOURNEY

After a series of strategic project assessments, an organisational

capability profile emerged which was adopted as input to inform

people engagement and

development strategies

A PRACTICAL EXAMPLE OF INFLUENCE, RELEVANCE AND VALUE


AUTOMATE THE PROCESS- www.projectaudits.com


A focus on auditing organisational strategy is very important, however is only part of the story to being influential,

relevant and more valuable

AUDITING STRATEGY - ONLY PART OF THE STORY


A September 2013 survey highlighted that 92% of senior executives in the U.S. acknowledge there is a serious gap in workforce skills with the most significant concern relating to ‘non

technical’ capability such as communication and creativity.

AUDIT PEOPLE CAPABILITY


People skills are vitally important to internal audit’s ability to stay

close to company leadership and remain aligned with the key

strategies and priorities of the organisation.


The most effective Internal Auditor possesses a broad range of non-technical attributes in addition to

deep technical expertise.


Leading CAEs stated that the skills necessary for success are effective communication, the ability to build

strong relationships and a capacity to engage internal and external partners.

In a complex, volatile and changing environment the ‘softer’ attributes of Audit performance are increasingly

critical to the success of Internal Audit functions



Attributes of

excellence

Focus on critical risks

Match talent

model to value

proposition

Leverage technology

Enable a client

service culture

Deliver cost effective services

Leverage & manage

relationships

Promote quality and innovation

Align value proposition to customer expectations

ATTRIBUTES OF INTERNAL AUDIT EXCELLENCE


ATTRIBUTES OF INTERNAL AUDIT EXCELLENCE

WE INVESTED HEAVILY OVER A SUSTAINED PERIOD IN ‘PEOPLE’

CAPABILITY ATTRIBUTES

INCLUDING SELF AWARENESS & EQ, NEURO LINGUISTIC

PROGRAMING, PYRAMID THINKING,

AUTHENTIC CONVERSATIONS ETC


PEOPLE DEVELOPMENT RESEARCH & INTERNAL AUDIT

Creative and Relationship Attributes

‘Compliance, Control, Protecting’

Task and Reactive Attributes - often

where Internal Audit is perceived as

‘inhabiting’


Research highlights a high correlation between individual development maturity, ‘creative’ leadership attributes and personal effectiveness, particularly in dealing with the increasing uncertainty,

ambiguity, volatility and complexity of interconnected global business markets.

PEOPLE DEVELOPMENT RESEARCH & INTERNAL AUDIT

Relating, Self Awareness, Authenticity, Systems Awareness, Achieving

This is particularly relevant for the role of Internal Audit.


• D. Goleman, Emotional Intelligence: Why It Can Matter More Than IQ (Bantam Books, 1995)

Requires higher levels of

systems and people thinking

EQ is twice as important as

technical competence*

OPTIMISING TECHNICAL AND NON-TECHNICAL CAPACITY IS THE KEY TO SUSTAINED SUCCESS


THE IMPLICATIONS OF AUDITING STRATEGY

Pres

erve

Val

ueCr

eate

Val

ue

Finance

Compliance

Operational

Strategic

Operational Risk

Compliance Risk

Strategic Risk

Financial Risk

Traditional Audit Skills

ExpandSkills

Enhance Engagement


For Internal Auditors to be perceived as relevant, influential and valuable we must focus on

strategic risks in our organisations. At the same time

we must act to build our non technical capacity. By tackling

these core themes well, we are more likely to be perceived as

‘Trusted Advisors’ by our stakeholders.

HOW TO INCREASE THE INFLUENCE, RELEVANCEAND VALUE OF INTERNAL AUDIT?

STEPPING UP / IIA NZ Conference 2013 STEPPING UP / IIA NZ Conference 2013

THANK YOU !

David Mallard

[email protected]

iia new zealand stepping up conference - influence relevance and value

Business

audit strategy

business strategy

iia nz conference

company strategy

organisational strategy

bad strategy

audit of assumptions

strategy execution riskin