Audit & Risk Awards case study: Agents of change
The ability of internal auditors to react flexibly to rapid change, develop new ways to collaborate with, and improve, assurance across the three lines and offer different types of support and communication to management have been tested during the pandemic crisis. However, before coronavirus struck, the BEIS/DCMS team at the Government Internal Audit Agency (GIAA) were already facing all these challenges as they helped to prepare their customers for the demands of exiting the EU – and what that might mean in future.
Their response to this, and their work to improve staff engagement levels, not only won them an Audit & Risk Award for Outstanding Team Public Sector, but also put them in a strong position to deal with the COVID-19 crisis.
Government is a hugely complex machine. The GIAA team serving the Department for Business, Energy and Industrial Strategy (BEIS) and the Department for Digital, Culture, Media and Sport (DCMS) also provides services for 19 associated arm’s-length bodies. These include two organisations – South Tees Site Company and the Financial Reporting Council (FRC) – that recently needed audit support as they changed their status and became subject to Managing Public Money requirements. Rob Fergus, a senior auditor in the team, played a leading role in helping the clients to adapt.
At the same time, the government’s developing plans for exiting the EU required a different approach to audit planning, assurance and monitoring across all the GIAA’s customers.
At the start of this work, audit team leaders across the agency embarked on an ambitious plan to change the way they work and improve collaboration with customers, expanding the range and value of the support they provide and improving staff engagement. The BEIS/DCMS team and their colleagues learned valuable lessons that they shared across the agency and government.
Preparing for exit
One key challenge was to adapt the way the internal audit teams at the GIAA supported their customers through the fluid and evolving negotiations for exiting the EU. In 2017 the agency’s audit teams began to prepare by reviewing what their current assurance processes offered and how they could move to doing more real-time assurance.
For the BEIS/DCMS team, this involved working in partnership with boards in several government departments and experimenting with more flexible and agile processes – for example, they started providing fortnightly reports to one customer and looked at how they could use the information they gained in audits more flexibly to offer information and identify shared risks across several government bodies. They also helped to support second-line functions to produce more targeted assurance.
The GIAA provides internal audit services to 13 of the 16 major government departments, employing three-quarters of government’s internal auditors, explains Andy Harrold, an audit manager in the team. He was responsible for EU exit assurance across government, and led on providing insights to permanent secretaries and audit committees across all of GIAA’s customers.
“We aimed to create products that could be used in lots of places for different audiences – for example, that would help us to segment the information and present it in, say, bulletins and reports at various levels, so we delivered more value from the same material,” he says.
The team also identified common themes so that they could take an issue that was occurring in one area and highlight this to other relevant customers and departments. Establishing a new flexible macro plan involved negotiating with multiple audit committees to agree an overall number of days. They increased communication with the managers who were responsible for delivering EU exit programmes in all their customer organisations so they could provide quick short assurances whenever necessary.
Members of the team then took part in “Civil Service Live” roadshows to share their experiences and best practice more widely. They also issued a new style of thematic reports that could be used to connect thinking about key risks. Nigel Dawbney-Fisher, head of internal audit for MHCLG, FRC and South Tees Site Company, seconded a member of the team to the Cabinet Office Grants Management Team, who supported the development of an innovative whole-of-government grants framework.
All this cross-entity work stood the team in good stead when the COVID-19 pandemic broke out. Dawbney-Fisher and Rachel Wrathall, a member of the GIAA BEIS/DCMS senior management team and head of internal audit for the Charity Commission, were promptly seconded to the senior management team of The Shielding Programme for England. Dawbney-Fisher and his team were asked to identify risk across all the government departments that worked with the Shielding Programme, and the people in each who should be involved to mitigate these.
He was also responsible for reporting to the Cabinet Office’s COVID-19 oversight team about how key risks were being managed, and how the strategic objectives of the programme were being realised. The Cabinet Office considered his reporting to be an example of best practice and it was then adopted for other COVID-19 programmes. Wrathall, meanwhile, was responsible for ensuring that the programme was employing the right people with the necessary skills.
“Covid and Brexit have thrown up issues that needed greater co-ordination of assurance across organisational boundaries in unprecedented ways,” Dawbney-Fisher says. “We needed to adapt quickly and work in flexible and agile ways in order to best support our customers. I can’t see us ever going back to the way we worked before.”
Own to act
While the team’s work was winning fans among customers and senior managers, its leaders were also making efforts to improve the internal culture, using staff survey results as key indicators. Dawbney-Fisher was asked to bring about improvements and he suggested the idea of a project called “Own to Act” to the team.
“We needed an approach that led to a more collaborative way of working – less top-down and more interactive,” explains Lavina Hinz, a senior auditor in the team.
She and her colleagues on the GIAA’s 360 Group, which responds to teams’ feedback to people surveys and creates action plans for improvement, examined the BEIS/DCMS team’s responses to questions about cultural behaviours and how people worked together. This helped them to devise a work plan aimed at “embedding the GIAA’s values”.
It was important that the programme was inclusive, led by the team itself, rather than by management. They conducted workshops on the survey results, identified what they needed to improve and devised an action plan. Crucially, they were able to hold management to account on the allocated actions. After each survey, the Own to Act team looked afresh at the scheme’s impact and communicated what had changed or improved.
It was essential that “improvements” included behaviour, such as inclusivity and working practices, and actions that resulted in delivering work to customers more effectively. This meant that participants could see the results that any changes made to the quality and impact of their work.
“There was an issue of trust – we formed a working group of auditors to be a constructive forum that could raise concerns and feed these to the leadership team so they could be built into the Own to Act initiative,” says Steve Collins, a member of the GIAA BEIS/DCMS senior management team, and head of internal audit for the Competition and Markets Authority and Insolvency Service. “Everyone had a voice in a safe environment.”
Wrathall agrees. “We needed openness and transparency, because, without that, we wouldn’t understand why people felt the way they did and nothing would change,” she says.
Hinz admits that staff were initially dubious but, once they began to see change, even entrenched sceptics realised that they could make their voices heard.
“We created a more motivated team and that had an impact on our customers because we worked better together and added more value,” Dawbney-Fisher adds. “It’s a virtuous circle: if our people feel more engaged, our customers feel they are getting more value, so they invite us in and ask us to do more types of assurance and work more collaboratively with us.”
As a consequence of the project, the team saw a 20-point increase in overall engagement over two years. Dawbney-Fisher, as the person accountable for improving the staff survey results, received a “Brilliant Civil Service” award in December 2018.
Customers and the GIAA Executive Committee noticed the team’s improved morale and attitude. One even referred to it as “the BEIS happy team”, Dawbney-Fisher notes. He and Wrathall became part of the 360 Group, helping to roll out the principles of Own to Act as a programme across all of the GIAA.
One innovation was an initiative to enable any member of staff, at any grade, to join Executive Committee meetings as an “active observer”, participating in strategic decision-making at the GIAA. This was such a success that there is now a waiting list to attend. The team has also run workshops for other parts of government at Civil Service Live, and they believe this is increasing their team’s impact and value, as well as raising the GIAA’s profile more widely.
These improvements proved particularly invaluable when Covid-19 struck, and the team has continued to evolve and embed new ways of working over the past year. “In addition to providing support to our customers on their Covid response, we have also had to think about how we maintain business as usual and work on ongoing projects such as Net Zero,” Wrathall explains.
“We have needed to balance our priorities. The challenge for the next six months is how we can flex and adapt our plans to meet new demands, and continue to meet the needs of permanent secretaries and audit committees.”
However, she is sure that the team would not have worked as effectively from home during the pandemic if team members had not developed strong and cohesive bonds over the past couple of years.
When it comes to developing stronger relationships with varied customers and strengthening practical auditing skills, “everything we learned from our work on exiting the EU is being used now,” Dawbney-Fisher explains. “At the same time, we’re looking at how we can offer assurance from home and how we can work differently.”
All agree that winning the Audit & Risk award was a huge boost. “It gave us a real buzz and said ‘look at what we did and what we achieved’,” Hinz says.
Dawbney-Fisher explains that the positive publicity began even before their submission won the award. “Writing the nomination involved people across the team and we had to ask for the views of senior managers at our customer departments and organisations, so this spread awareness, which was important for us. It was an external recognition of all the work we had put in and that was amazing.”
The task now, they all agree, is to build on this success to meet the challenges ahead.
This article was first published in January 2021.