2022 Expectations of Internal Audit: An Audit Committee Chair’s view

Expectations of Audit Committee members and Chairs have never been greater. It can be quite overwhelming, and that pressure is only growing. As the AC Chair in the regulated banking sector the sense of responsibility I feel for ensuring the organisation really behaves not only in line with the expectations of the regulator, but also our own values and stated ways of working is significant.

The pandemic has changed the way in which business is conducted, creating new risks and evolving existing ones. Controls and other activities we previously relied on to mitigate those risks such that they were within risk appetite may no longer operate in the way they did previously. And our view as to what tolerable risk is will have changed – in some cases because we have found we can do things we might previously have thought were too risky.

The macro-economic environment at present remains more uncertain than most of us have experienced in recent years. A war in Europe, with the resulting disruption to supply chains, and financial challenges in modelling interest rates, inflation and so forth means we have to identify and stress-test scenarios, and we need to be clear how we remain resilient in the medium to longer term. Risks that in the past were considered to be too remote to be “severe-but-plausible” have materialised.

At the same time there is a drive for increasing accountability. S172 of the Companies Act has shined a light on the importance of company purpose, and the pandemic has acted to underline the need for sustainable business outcomes. BEIS is consulting on enhanced requirements for companies to disclose where directors get their audit and assurance from, how they remain resilient over a longer time frame, and in greater detail their relationships with partners and suppliers. Perhaps most significantly for AC Chairs, there looks likely to be a requirement for an attestation by the company over the significant financial reporting controls, similar to the requirements in place in the US. Alongside this, there are proposals for the accountability for such disclosures to extend beyond those that are financially qualified to all directors, meaning the wider Board will lean further on the AC members.

In facing into this I believe AC Chairs should have a critical ally, their Chief Audit Executive. The CAE is uniquely positioned in the organisation with a direct reporting line to the Board via the Audit Committee (or should be if the organisation complies with the Combined Code and Internal Audit Code of Practice for all Companies). I was recently invited to speak about what this means and how I regard this critical relationship.

The relationship between the CAE and the AC Chair must be two-way. It involves a partnership that needs to develop over time and will be different depending on the backgrounds and experience of both individuals. As AC Chair, I need to know that I can speak openly, be curious and ask the difficult questions. I also need to provide guidance and advice, and sometimes be leant on when there are difficult discussions.

In turn I have expectations of the CAE. The CAE must have the confidence, experience and credibility to act alongside the executive members. They must have strategic vision and be aligned with the wider executive team in relation to the purpose and priorities of the organisation. Their questions and recommendations must be grounded in commercial reality, meaning they are proportionate, risk-based and pragmatic. I am looking for an individual who knows what good looks like and is well networked to pick up on leading practice in other organisations. I am also looking to that person to then use this experience with diplomacy and empathy in order to have the maximum impact, but to have the courage to be rigorous and robust in their interactions with the executive, even the CEO. It’s a pretty tall order!

In reflecting on this, I understand that I must shoulder the burden of creating and protecting the trust that needs to exist between us. My role is to protect, support and promote the CAE. I am passionate about creating organisations that exist to make a difference and about working with the internal audit profession to ensure this can occur from the inside out.