Award-winning work at Kingfisher: Doing it themselves

DIY is the core business of Kingfisher, which operates stores across eight European countries, including home improvement brands B&Q and Screwfix. Four years ago, a change in the executive management led to new expectations of, and demands on, the internal audit team. Under a new Director of Audit and Risk, they rose to the challenge and embarked on their own home improvements – with spectacular results.

Like all good improvement projects, the team began by assessing where they were and what they needed to achieve. An external quality assessment (EQA) gave them the initial information they needed to create a “root and branch” two-year change plan, building on solid foundations and recalibrating to align with the IIA Standards. Over the following couple of years, they redefined their ways of working, introduced standardised methodologies and templates, designed and implemented audit workflow and reporting tools, and repositioned the internal audit function in the group.

The changes resulted in faster, more responsive planning, and clearer, dashboard-based reporting that not only pleased the audit committee and executive, but also led to effective action – overdue actions ranked as high priority have been reduced by 72%. Meanwhile, the time taken to prepare reports for the audit committee reduced from up to four weeks to just two days. They also introduced biannual learning and development weeks for the entire team to help all the internal auditors understand emerging and complex issues such as climate change exposure, cyber risks and digital skills, and created tools and datasets that are now being used by second-line controls teams.

Their success has increased internal audit’s reputation throughout the business and has been recognised by the most senior executives, who provided powerful endorsements to support the team’s nomination for the 2023 Audit & Risk Awards. Bernard Bot, Kingfisher’s Chief Financial Officer, said: “Without the insights delivered by internal audit, the company would not have been able to respond as effectively as it has to the various challenges it faced.”

Team development

Kingfisher’s internal audit team – which consists of 35 people based in the UK, France, Poland and Hong Kong, with an additional joint venture in Turkey – traditionally worked in silos. Each area had its own plans and stakeholders. This had to change so that everybody shared a common level of expertise in core areas and could work across borders in flexible teams that made the most efficient use of people and resources.

“We introduced biannual training weeks for all internal auditors and supplemented these with updates by stakeholders on what was happening in their area of the business. More recently we have introduced  monthly “bite-size” learning sessions where a guest speaker from the business discussed relevant topics, such as Market-Place and Retail Media, and answered questions on these new ventures to help the team understand the processes and what risks needed addressing,” explains Katie Timms. She worked with the team on its EQA and more recently took on the Group Audit and Risk Director role, so has been involved with the transformation process from the start.

Data-based

The team’s use of automation and data has enabled it to reduce reporting times and improve the way it communicates with stakeholders, who can now view dashboards, see key issues at a glance and drill down further if they need specifics. However, their ongoing work gathering and using data is continuing to create new opportunities for improvements and fresh insights.

“The more we do, the more we can pull out relevant insights from our audits, and the more we can work with the second line – the data is getting richer all the time,” says Ed Wilton, Audit Director at Kingfisher, who put together the team’s nomination.

Rather than buying in generic or bespoke technology, the team worked with the systems that Kingfisher already owned and developed these to achieve their objectives. “We self-developed the systems and this is what I’m most proud of,” Wilton says. “It means we now have a fantastic toolset that we can all use and improve and the cost was minimal.”

However, the transformation has been about far more than just using technology. Wilton explains that they began by looking for the “north star” – what they wanted to achieve – and then identified what was available and what they could do with it. “It’s the classic triangle of people, process and technology working together,” he says. “The process and people were just as important as the technology. We also built in a data quality report, so we can identify where data is incomplete and improve it.”

“One of the reasons I joined Kingfisher was because I really enjoyed working with the team on the transformation and because of the exceptional talent we have and their enthusiasm about technology. They’ve achieved so much in such a short time,” Timms adds.

Looking ahead

The team currently assesses the quality of its audits on a quarterly basis. The process is aligned to IIA Standards and they use this as a training exercise to see where they could improve. “The next step will be to automate this so it’s in real-time and we will continually assess all our audit work, not just a sample,” Timms says.

Internal audit planning has moved from an annual plan for each of the individual market silos, to an integrated risk-based rolling plan based on a nine-month horizon that can be changed rapidly. The situation is reported quarterly to the audit committee, along with a “radar” scan of the most important issues coming up in the following six months.

“All plans come with a caveat that life changes and we need the ability and confidence to adapt rapidly if something new comes up,” Timms says. “Now that the whole team works as one, we can redeploy people with specific experience across borders at short notice if necessary.”

One indication of internal audit’s increased status within the organisation is that it is now invited to lead various management projects, for example on assessing the impact of generative artificial intelligence on the business.

Another is that it is successfully recruiting new team members from the business – and promoting internal auditors into operational roles. “We recently brought in someone from the business, which brings us vital inside knowledge of the organisation, but we have also put internal auditors into operational roles where they can educate people about what we do, so it’s a win-win for us,” Timms says.

The internal audit function is currently taking part in a two-year finance graduate training scheme and plans to become more involved in the Kingfisher apprenticeship scheme in future.

Picture perfect

Winning the A&R Award was a great experience for everyone in the team. “A picture of us holding the award with the CEO went viral inside Kingfisher,”
Wilton recalls. However, he adds that, for him, the reward started when he was writing up the nomination. “I had to look back at what the team had achieved and ask management for the necessary endorsements. It sounds corny, but this was a career highlight; it really showed how much they valued what we had done,” he says.

“The event itself was great and we began getting excited when they read out the things that the judges had liked about the winning team and we realised that it sounded like us – it was a magic moment,” he adds.

Everybody in the team uses their award-winners’ header on their correspondence, so they (and their auditees) are constantly reminded of it. “What made it most exciting was the support we got from stakeholders,” Wilton recalls. “So many people said such good things – I couldn’t fit them all on the nomination form.”

And their success hasn’t been forgotten. Timms points out that it was mentioned at an audit committee meeting recently. “It shows that what we do really matters and our stakeholders are confident that we are dealing with their concerns,” Wilton says. “Which, in the end, is what it’s all about.”

This article was published in November 2023.