Brave for Scotland: Award-winning work at Scottish Enterprise

"Be brave” is one of Scottish Enterprise’s values and its internal audit team has more than lived up to this over the past couple of years. The COVID-19 pandemic struck while the team was expanding into offering shared internal audit provision to four other Scottish public-sector organisations: Skills Development Scotland, the Scottish Funding Council, South of Scotland Enterprise and Clyde Gateway. When the pandemic struck, it went ahead with plans to expand the shared service and recruit four new members, enlarging the team to 10. It achieved its planned audit schedule and delivered new work, in new ways, to offer rapid assurance and critical information to management at this most difficult time. Its work won it the Audit & Risk award for Outstanding Team – Public Sector.

The team started from a strong base and an external quality assessment (EQA), carried out by the Chartered IIA, had reinforced its confidence and ambition. However, rapid expansion and restructuring in a time of Covid, plus the retirement of two experienced internal auditors, meant that those remaining had to recruit and induct new members without meeting them in person. At the same time, they had to get to know the new management teams and organisational structures, which were at different stages of assurance maturity, without face-to-face contact.

The positive review by the EQA assessors helped this process significantly by providing practical suggestions for developments, which the team had begun to implement immediately, and an independent endorsement of its work. This helped both to secure the new organisations and build trust with its new stakeholders, explains Alan Browne, director of audit at the internal audit shared service body. It also helped it to recruit the team it needed to tackle the challenges it faced.

“The EQA was one of the best things we ever did, not only because we came out of it well, but even more importantly because it gave us so many practical recommendations for our further development,” he says. “When we approached new organisations, we could point to independent evidence that we were doing good work, and when we started recruiting it meant we had a positive story to tell candidates. This helped us to attract excellent applications.”

The new shared service team is hosted by Scottish Enterprise, but members from each of its customer organisations sit on its partnership board. Browne adds that, although the different bodies have separate structures and internal audit histories, their work is interconnected and focused on developing business, investment and skills for Scotland. They are also accustomed to working closely with private sector organisations and distributing funding, which helped in the early days of the pandemic when the government swiftly started distributing emergency grants.

“The fact that the bodies already have a real connection with private sector organisations across Scotland meant that things could happen very fast when the first Covid lockdown began,” Browne says. “In internal audit, it meant that we could move people with previous experience to work on the highest risk areas even as the government was developing the Covid grant scheme and its criteria and systems. We could work in real time to help management spot risks and potential issues they may not have considered.”

The team drew on some early trials using agile techniques at Scottish Enterprise to offer real-time assurance across all the bodies. “We had to explain to our new stakeholders what this involved and why it added to the value that internal audit could bring – but this meant that they really understood the value of what we were doing and appreciated it,” Browne says. “When the pandemic began, it was easier for us to move fast at Scottish Enterprise because we already knew the business well. It was more challenging at some of the other bodies since we’d only just taken them on board and didn’t yet know their businesses as well as we wanted to.”

The assurance work was backed up by new rapid reports in the form of “observation logs” on the new grants. These were targeted to help management understand the critical risks and what was happening on the ground during the crisis.

Compare and share

The team went on to conduct general audits examining how each organisation had responded to the pandemic and the lessons learnt. Not only did they provide the audit committees with assurance that processes were in place and risks mitigated, but the new structure enabled them to compare how the organisations were reacting and treating their employees. They then shared these innovations and best practice with management across the group. “We were the common factor,” Browne points out. 

Beyond the Covid crisis and lockdowns, Browne can see long-term potential to help these Scottish public sector bodies learn from each other and share best practice. “Much of their work is interconnected – internal audit is the only function that sees and can compare what’s going on across all these organisations, so we are in an ideal place to encourage stakeholders to learn from each other.”

The team’s experiences over the past couple of years have necessitated huge changes and given it much to consolidate and build on in future. “We will continue to have an annual plan, but we will reassess this at every audit committee meeting and continually ask whether we’re using resources effectively, what new risks are appearing, how internal audit can add more value, etc,” Browne says.

Hear what they say

He believes that internal audit’s success today is far more driven by its relationships within organisations than it was in the past – and these are all different. “It’s also crucial to get feedback and communications right within the team – everyone’s been through a lot recently and we need a channel to ensure that internal audit leaders hear what team members have liked or not liked, what they are struggling with and what they want from their jobs and their career. We need people to enjoy their work,” he adds.

The team is geographically dispersed and the new shared service structure means that its internal auditors will be working across Scotland. “Covid has actually helped us to communicate more, and to communicate more openly and interact better at a personal level,” Browne says. “It’s made us see where we can be more productive using Teams and the full value of being flexible and offering people options about how they work. We always tried to be flexible, but this has accelerated greatly.”

He adds that internal audit leaders and managers must practice what they preach. “The issue is about productivity and output, not the time you spend at your computer – and it’s about recruiting the right people and then trusting them.”

Winning the award was a great endorsement and gave the team a tremendous boost – both individually and in terms of their reputation with stakeholders, he adds. Everyone in the team uses the awards banner on their emails to build trust even before they have met some of the people they are auditing.

“There aren’t many opportunities to gain recognition in internal audit and this creates a really good first impression,” Browne says. After such a difficult and testing year, he says the news spread fast across all the organisations they work with.

“I like change – it’s good and I sometimes wonder why it takes external disruption to make us alter the way we do things and accelerate our progress,” he says. “The changes we’ve been through recently forced us to make changes and improvements as we went along. Would we have been as brave if circumstances had been different? And would our stakeholders have been as happy with us changing our processes?”

Courage depends both on an internal auditor’s confidence in their own intuition and experience, and on having built up trust with their internal audit stakeholders, he adds. “They need to trust you to use your intuition without necessarily always having hard evidence to back you up.” 

This article was first published in January 2022.