Internal Audit and Organisational Strategy

Increasing the influence, relevance and

value of Internal Audit

David Mallard

Topic

1 The impact of strategic risk

2 Are we doing enough?

3 Recent research into the profession

4 The standards

5 Three common strategy failure points

6 Auditing strategy development

7 Auditing strategy execution

8 The Australia Post experience

9 Saying it right

10 Insight over the journey

11 Implications of auditing strategy

12 Auditing strategy is only part of the story

WHAT WE WILL SHAREWHAT WE WILL SHARE

Strategic risks pose a much more significant threat to companies than more easily auditable risk areas

Strategic risks cause 68% of severe market capitalisation decline

THE IMPACT OF STRATEGIC RISK THE IMPACT OF STRATEGIC RISK

Strategic risks account for 68%

of severe market declines

Strategic risks account for 68%

of severe market declines

Risk Categories

68%68%

7%7%

12%12%

13%13%

Percentage of Risk Failures Leading to Significant Market

Decline

6%6%

13%13%

49%49%

32%32%

Percentage of Time Spent By Audit Departments on

these Risk types

Audit departments

report spending only 6% of their

time auditing strategic risks

Audit departments

report spending only 6% of their

time auditing strategic risks

ARE WE DOING ENOUGH?ARE WE DOING ENOUGH?

RECENT RESEARCHRECENT RESEARCH

To deliver real value, audit plan’s must be responsive, flexible

and aligned with company strategy

To deliver real value, audit plan’s must be responsive, flexible

and aligned with company strategy

61% of survey respondents said

Internal Audit did not have a mandate

aligned to business strategy

61% of survey respondents said

Internal Audit did not have a mandate

aligned to business strategy

Top Priority - be more relevant to achieving

the organisation’s objectives

Top Priority - be more relevant to achieving

the organisation’s objectives

TOP PRIORITY?TOP PRIORITY?BE MORE RELEVANTBE MORE RELEVANT

TOP PRIORITY?TOP PRIORITY?BE MORE RELEVANTBE MORE RELEVANT

RECENT RESEARCHRECENT RESEARCH

2130. A1 – The internal audit activity must evaluate the adequacy and effectiveness of controls in responding to risks within the organisation’s governance, operations, and information systems regarding the:

1.Achievement of the organisation’s strategic objectives2...3...

2130. A1 – The internal audit activity must evaluate the adequacy and effectiveness of controls in responding to risks within the organisation’s governance, operations, and information systems regarding the:

1.Achievement of the organisation’s strategic objectives2...3...

INTERNATIONAL STANDARDS FOR THE INTERNATIONAL STANDARDS FOR THE PROFESSIONAL PRACTICE OF INTERNAL PROFESSIONAL PRACTICE OF INTERNAL AUDITING OCTOBER 2012AUDITING OCTOBER 2012

THREE COMMON STRATEGYTHREE COMMON STRATEGY FAILURE POINTSFAILURE POINTS

Flawed Business Assumptions: Management assumptions may not be rigorously tested resulting in organisational objectives that are inconsistent with the enterprise’s capabilities or the realities of the business environment.

Flawed Business Assumptions: Management assumptions may not be rigorously tested resulting in organisational objectives that are inconsistent with the enterprise’s capabilities or the realities of the business environment.

Business Unit Misalignment: Lack of communication or a strategy development framework for business units can result in business unit objectives and operating plans that fail to align to enterprise objectives.

Business Unit Misalignment: Lack of communication or a strategy development framework for business units can result in business unit objectives and operating plans that fail to align to enterprise objectives.

AUDITING STRATEGY AUDITING STRATEGY DEVELOPMENTDEVELOPMENT

1. Strategic Planning Process Audit: Review the strategic planning process to ensure there is a common framework for the development of business unit strategic plans and assess the alignment between business unit, department, and corporate level strategic plans.

1. Strategic Planning Process Audit: Review the strategic planning process to ensure there is a common framework for the development of business unit strategic plans and assess the alignment between business unit, department, and corporate level strategic plans.

Are enterprise level strategic

objectives documented and

measurable?

Are enterprise level strategic

objectives documented and

measurable?

Does the company have a documented process for strategic

planning? Has the process been

complied with?

Does the company have a documented process for strategic

planning? Has the process been

complied with?

Are Business Unit objectives reasonably related to enterprise objectives?

Are Business Unit objectives reasonably related to enterprise objectives?

Is there alignment between

enterprise and business level

strategies?

Is there alignment between

enterprise and business level

strategies?

2. Audit of Assumptions: Identify and validate assumptions about the internal and external environment made at the enterprise, business unit, and project level.

2. Audit of Assumptions: Identify and validate assumptions about the internal and external environment made at the enterprise, business unit, and project level.

Are key assumptions underpinning the plan

for achieving objectives documented?

Are key assumptions underpinning the plan

for achieving objectives documented?

Are key assumptions reasonable given all the

evidence?

Are key assumptions reasonable given all the

evidence?

AUDITING STRATEGY AUDITING STRATEGY DEVELOPMENTDEVELOPMENT

Do incentives and/or performance criteria

link to strategic objectives ?

Do incentives and/or performance criteria

link to strategic objectives ?

To what extent do employees believe in

the strategy?

To what extent do employees believe in

the strategy?

What level of awareness do employees have in

the strategy?

What level of awareness do employees have in

the strategy?

AUDITING STRATEGY AUDITING STRATEGY DEVELOPMENTDEVELOPMENT

4. Strategic Execution: Evaluate major initiatives at critical points in the project lifecycle against key factors of project success beyond execution and timeline, such as leadership capability, business readiness, sustainability and value investment.

4. Strategic Execution: Evaluate major initiatives at critical points in the project lifecycle against key factors of project success beyond execution and timeline, such as leadership capability, business readiness, sustainability and value investment.

Evaluate confidence levels in the successful

execution of strategy

Evaluate confidence levels in the successful

execution of strategy

Assess project management

capabilities and processes

Assess project management

capabilities and processes

Identify talent or development gaps to meet

execution goals

Identify talent or development gaps to meet

execution goals

Identify gaps between

objectives and strategy

outcomes

Identify gaps between

objectives and strategy

outcomes

AUDITING STRATEGY AUDITING STRATEGY DEVELOPMENTDEVELOPMENT

Test elements of strategy development and communication in regular audit engagements to provide ongoing monitoring of the strategic planning process

Test elements of strategy development and communication in regular audit engagements to provide ongoing monitoring of the strategic planning process

Evaluations of strategy development and communication can be incorporated into every audit to monitor the effectiveness of strategy deployment in between assessments of the strategic planning process

Evaluations of strategy development and communication can be incorporated into every audit to monitor the effectiveness of strategy deployment in between assessments of the strategic planning process

AUDITING STRATEGY AUDITING STRATEGY DEVELOPMENTDEVELOPMENT

AUDITING STRATEGY EXECUTIONAUDITING STRATEGY EXECUTION

My experience at Australia PostMy experience at Australia Post

Strategy Execution

AUDITING STRATEGY EXECUTIONAUDITING STRATEGY EXECUTION

AUDITING STRATEGY EXECUTIONAUDITING STRATEGY EXECUTION

Failures are not for lack of a well-defined strategy but due to the absence of a well-

orchestrated implementation plan bridging the gap to execution.

Failures are not for lack of a well-defined strategy but due to the absence of a well-

orchestrated implementation plan bridging the gap to execution.

Fortune Magazine famously stated that organisations fail to

successfully implement strategy, not because of bad strategy, but because of bad

execution.

Fortune Magazine famously stated that organisations fail to

successfully implement strategy, not because of bad strategy, but because of bad

execution.

AUDITING STRATEGY EXECUTIONAUDITING STRATEGY EXECUTION

‘Large Program’ Risk is in the bottom quartile of ‘well managed’ risk

‘Large Program’ Risk is in the bottom quartile of ‘well managed’ risk

82% of stakeholders regarded Internal

Audit’s role as very important or important

82% of stakeholders regarded Internal

Audit’s role as very important or important

AUDITING STRATEGY EXECUTIONAUDITING STRATEGY EXECUTION

Regularly polled senior Regularly polled senior executives and Board executives and Board members about their members about their perception of Internal perception of Internal

Audit – particularly Audit – particularly their sense of value their sense of value received from Auditreceived from Audit

Regularly polled senior Regularly polled senior executives and Board executives and Board members about their members about their perception of Internal perception of Internal

Audit – particularly Audit – particularly their sense of value their sense of value received from Auditreceived from Audit

AUDITING STRATEGY EXECUTIONAUDITING STRATEGY EXECUTION- THE AUSTRALIA POST - THE AUSTRALIA POST EXPERIENCEEXPERIENCE

Stakeholder Stakeholder feedback resulted in feedback resulted in

the question:the question:

How does Internal How does Internal Audit address Audit address

strategic risk more strategic risk more effectively?effectively?

Stakeholder Stakeholder feedback resulted in feedback resulted in

the question:the question:

How does Internal How does Internal Audit address Audit address

strategic risk more strategic risk more effectively?effectively?

AUDITING STRATEGY EXECUTIONAUDITING STRATEGY EXECUTION- THE AUSTRALIA POST - THE AUSTRALIA POST EXPERIENCEEXPERIENCE

We viewed the organisation's strategic plan as an inventory of organisational change

programs

We viewed the organisation's strategic plan as an inventory of organisational change

programs

Ranked each program by importance to company objectives, complexity, scale etcRanked each program by importance to

company objectives, complexity, scale etc

Diagnosed history of previous investments, where they had struggled and/or been

successful, and understood the organisational capability ‘soft spots’

Diagnosed history of previous investments, where they had struggled and/or been

successful, and understood the organisational capability ‘soft spots’

AUDITING STRATEGY EXECUTIONAUDITING STRATEGY EXECUTION- THE AUSTRALIA POST - THE AUSTRALIA POST EXPERIENCEEXPERIENCE

• In-Flight – Real Time Assessment PIR’s not optimising limited Audit resources and

unhelpful to operating the day to day business

• In-Flight – Real Time Assessment PIR’s not optimising limited Audit resources and

unhelpful to operating the day to day business

• Rapid arms-length feedback – ‘contemporary assurance’ and actionable

• Rapid arms-length feedback – ‘contemporary assurance’ and actionable

• An Integral view – considered typical technical issues in conjunction with humanistic elements – collective and individual

• An Integral view – considered typical technical issues in conjunction with humanistic elements – collective and individual

• Relevant to objectives of stakeholders, both organisationally and personally

• Relevant to objectives of stakeholders, both organisationally and personally

AUDITING STRATEGY EXECUTIONAUDITING STRATEGY EXECUTION- THE AUSTRALIA POST - THE AUSTRALIA POST EXPERIENCEEXPERIENCE

The Integral Framework makes clear that every event or situation may be

understood within the context of interior and exterior dimensions in both the

individual and the collective

The Integral Framework makes clear that every event or situation may be

understood within the context of interior and exterior dimensions in both the

individual and the collective

Regardless of the scope and depth of the organisational situation, by applying the Integral Framework, we are able to

analyse and assess even the most complex issues in a balanced and

comprehensive manner.

Regardless of the scope and depth of the organisational situation, by applying the Integral Framework, we are able to

analyse and assess even the most complex issues in a balanced and

comprehensive manner.

This holistic process is what makes This holistic process is what makes this approach so powerful and this approach so powerful and

leading-edgeleading-edge

This holistic process is what makes This holistic process is what makes this approach so powerful and this approach so powerful and

leading-edgeleading-edge

AUDITING STRATEGY EXECUTIONAUDITING STRATEGY EXECUTION- THE AUSTRALIA POST - THE AUSTRALIA POST EXPERIENCEEXPERIENCE

THE INTEGRAL FRAMEWORKTHE INTEGRAL FRAMEWORK

Project Health Checks include assessments from multiple perspectives in order to provide a balanced evaluation.

Designed to deliver ‘contemporary assurance’ on in- flight strategic project implementation.

A 360 O STRATEGIC PROJECT HEALTH CHECK REVIEW

1. Project Team Members

Direct participants in the project team provide the inside view of the status

of project execution2. Impacted Process

Owners

Future end users provide an outsiders

perspective on execution,

communication and sustainability.

3. Management or other key stakeholders

Key members of the senior management team provide perspective on the value contribution of the project.

4. Internal Audit

Audit offers an independent appraisal of the project including its effect on the risk and control environment.

AUDITING STRATEGY EXECUTIONAUDITING STRATEGY EXECUTION- THE AUSTRALIA POST - THE AUSTRALIA POST EXPERIENCEEXPERIENCE

AUDITING STRATEGY EXECUTIONAUDITING STRATEGY EXECUTION- THE AUSTRALIA POST - THE AUSTRALIA POST EXPERIENCEEXPERIENCE

Online polling of stakeholder

perceptions/confidence levels horizontally and

vertically in the organisation

AUDITING STRATEGY EXECUTIONAUDITING STRATEGY EXECUTION- THE AUSTRALIA POST - THE AUSTRALIA POST EXPERIENCEEXPERIENCE

Triangulate stakeholder feedback - deep dive on the

‘hot spots’

AUDITING STRATEGY EXECUTIONAUDITING STRATEGY EXECUTION- THE AUSTRALIA POST - THE AUSTRALIA POST EXPERIENCEEXPERIENCE

Independent of Project

Management Office – leverage PMO’s

work

AUDITING STRATEGY EXECUTIONAUDITING STRATEGY EXECUTION- THE AUSTRALIA POST - THE AUSTRALIA POST EXPERIENCEEXPERIENCE

KEY SUCCESS FACTORS ASSESSED:

AUDITING STRATEGY EXECUTIONAUDITING STRATEGY EXECUTION- THE AUSTRALIA POST - THE AUSTRALIA POST EXPERIENCEEXPERIENCE

AUDITING STRATEGY EXECUTIONAUDITING STRATEGY EXECUTION- - ‘SAYING IT RIGHT’‘SAYING IT RIGHT’

Audit Headline Conclusion Is HereAudit Headline Conclusion Is Here

AUDITING STRATEGY EXECUTIONAUDITING STRATEGY EXECUTION- - ‘SAYING IT RIGHT’‘SAYING IT RIGHT’

AUDITING STRATEGY EXECUTIONAUDITING STRATEGY EXECUTION- - ‘SAYING IT RIGHT’‘SAYING IT RIGHT’

AUDITING STRATEGY EXECUTIONAUDITING STRATEGY EXECUTION- INSIGHT OVER THE JOURNEY- INSIGHT OVER THE JOURNEY

EXAMPLE OF INFLUENCE, RELEVANCE AND VALUE

AUTOMATE THE PROCESSAUTOMATE THE PROCESS- www.projectaudits.com- www.projectaudits.com

THE IMPLICATIONS OF THE IMPLICATIONS OF AUDITING STRATEGYAUDITING STRATEGY

Finance

Compliance

Operational

Strategic

Operational Risk

Compliance Risk

Strategic Risk

Financial Risk

Traditional Audit Skills

ExpandSkills

Enhance Engagement

A focus on auditing organisational strategy is very important, however is only part of the story to being influential,

relevant and more valuable

A focus on auditing organisational strategy is very important, however is only part of the story to being influential,

relevant and more valuable

AUDITING STRATEGY IS ONLY AUDITING STRATEGY IS ONLY PART OF THE STORYPART OF THE STORY

• D. Goleman, Emotional Intelligence: Why It Can Matter More Than IQ (Bantam Books, 1995)

Requires higher levels of systems and people

thinking

EQ is twice as important as

technical competence*

OPTIMISING TECHNICAL AND OPTIMISING TECHNICAL AND RELATIONAL CAPACITY IS KEYRELATIONAL CAPACITY IS KEY

In my presentation this afternoon I will be discussing a key foundational issue for becoming more relevant, influential and

valuable – addressing non-technical capability development with the aim of achieving ‘Trusted Advisor’ status in your organisation.

david@davidmallard.comdavid@davidmallard.com