EQA at ARA Gloucestershire: Time to talk

When Theresa Mortimer asked the Chartered IIA to undertake an external quality assessment (EQA) on Audit Risk Assurance (ARA) Gloucestershire, the shared service organisation that provides internal audit and risk assurance to Stroud District Council, Gloucester City Council and Gloucestershire County Council, she wanted far more than a simple affirmation that their internal audit provision met the required standards.

While not complacent, she was confident that they were providing a good service, however she was also keen to seize other opportunities from the EQA. She planned to retire at Christmas, so she needed to ensure that she was leaving her team in a strong position with a clear sense of direction. She also wanted to talk about best practice and innovations in internal audit with experienced professionals who could tell her how her peers across the country in different sectors were developing the function. Standing back to view the internal audit landscape from multiple perspectives is often recommended, but it can be difficult to find the time or the opportunity. Mortimer had no intention of wasting this one.

“The Chartered IIA EQA wasn’t the cheapest option, so I had to do some persuading, but I’m a CMIIA and I see the Chartered IIA as the standard setters. They have a modern view of internal audit and that was important to me,” she explains. “We wanted the most thorough form of assessment, not the cheapest and shortest. We wanted to make sure that we put the function in the best place to progress in the future and we wanted constructive and useful feedback.”

Mortimer had used the Chartered IIA to do the function’s previous assessment in 2015, when ARA Gloucestershire was first formed by amalgamating internal audit in three district councils. The process had inspired ideas for many improvements. “They came on site and really took the time to see exactly what I was doing and suggest ways we could progress,” she says.

She particularly valued the way in which the assessor could reference the wider picture and gave her an overview of best practice in many sectors.

This was important, because internal auditing in local authorities is wide-ranging and risk decisions have serious consequences. The role includes auditing everything from highways and waste management to fostering and safeguarding children and provisions for homeless people, so the auditors’ judgments make a real difference to people’s lives, often at times of crisis.

“If we miss things, situations can go seriously wrong,” Mortimer points out. This is why she is keen that her team can compare the way in which different clients carry out processes, such as procurement, and share best practice between councils and from outside. Conversations with external peers, including EQA assessors, can help them to spot new ways to improve the overall control environment across all their clients.

“I always wanted to employ people with a range of different skills and experience so we could bid for other types of business and keep our options open,” she says. “We have three trainees as well and I wanted them to see the full range of options for internal auditors today. When I started out in internal audit, it was all about accountancy. That’s no longer true and much of this change is down to the IIA.”

Her previous positive EQA experience meant that she was pleased but not surprised that the assessors made no formal recommendations. For her, the most important element was the conversations and the ideas that emerged from these. She was particularly pleased to receive positive feedback about ARA Gloucestershire’s trainee programme and its stakeholder engagement.

Talking points

“Stakeholder engagement is one of my main priorities. I always tell trainees that you can learn the technical audit skills, but if you can’t communicate effectively, they won’t be any use,” she says. “That’s one reason I was keen to develop our own trainee scheme. I wanted to get the best young auditors in and help them to develop their softer skills by, for example, shadowing senior internal auditors who can demonstrate how to act in meetings, how to influence people and how to add value in meetings.”

In addition, she believes that all auditors can benefit from developing negotiation skills and learning how to have “courageous conversations” without alienating the other party. Tips on things like avoiding negative words and focusing on the opportunities for improvement are important, and she advises trainees to remember how they would like people to speak to them if the situation were reversed – a lesson that is particularly relevant when auditors go through an EQA.

Mortimer was also keen to discuss the best ways to further raise the profile of internal audit and add more value in all types of organisation. She wanted to find out what leading organisations in other sectors are doing to help design the risk process from the inside and offer more consultancy services that improve the overall management of risk across the business.

“I work in the bubble of the public sector and there’s always something new or surprising happening somewhere. I wanted an independent overview and to meet someone who could give me a robust opinion along with fresh ideas and a wider perspective,” she says. “The Chartered IIA looks at the strategic running of the whole operation when it does an EQA. It doesn’t nitpick about a minor issue with a document.”

One subject that Mortimer wanted to discuss was the amount of time that elapsed between completing the audit and issuing a report. She was aware that others had reduced this significantly and wanted to find out how she could apply it in her own team.

“John Chesshire was a brilliant assessor – he was consultative, he listened and he contributed lots of ideas and suggestions about how we could develop faster, more efficient ways of working,” she says. “It’s so important to tell your assessor everything, warts and all. If you want to improve, you need to talk about everything that is bothering you. There’s no point plastering over cracks.”

Being a head of internal audit can be quite an isolated job, Mortimer adds. There are some things you can’t ask your clients and are difficult to raise within your team. When you talk to an EQA assessor, you’re talking to someone who understands the context and the issues and who has seen it all before.

“It’s a great opportunity to think deeply about all the bigger concerns that are daunting or hard to change,” she says. “I got some really good suggestions about things such as mentoring.”

The COVID-19 crisis has made the team work innovatively and offer advice and suggestions to support clients who were introducing changes, such as pandemic-related payments to local businesses. Working remotely has its challenges, but Mortimer points to ways in which it has made them more creative and speeded processes up, and is keen to hold on to these improvements.

One key issue she wanted to discuss in the EQA was the best way to source more in-house ICT expertise – which she currently gains through a co-sourcing arrangement. Suggestions included upskilling the entire team to deal with general ICT risks and ensuring that all the auditors were aware of the latest risks and could offer support to clients at a general level. The assessor also recommended that the auditors should shadow the co-sourced ICT auditors and engage in joint audits to gain experience.

“All our auditors now need to be IT-savvy and have experience in this area,” Mortimer says. “For us, this is now as important as fraud – and we have three fraud investigators on our team, including a former police officer. We need to bring awareness of the IT issues into our team and into every audit we do.”

ARA Gloucestershire emerged with a positive EQA report, but the true value of its investment lies in the ideas and inspiration it has provided for the organisation’s future development. 

Training at ARA Gloucestershire

The EQA assessors were particularly impressed with the trainee programme Mortimer has introduced at ARA Gloucestershire. The impetus for the scheme came after adverts for new recruits repeatedly failed to attract enough high-quality candidates. Mortimer therefore decided to start from scratch.

She advertised three trainee auditor posts offering support during the qualification and a variety of internal audit experience. At the end of the traineeship, if the candidates were judged ready for it, they would be offered a senior auditor role. Each trainee has an experienced mentor who is responsible for ensuring they get a good professional grounding.

“Every time we’ve advertised a trainee role we’ve had 100 or more applicants,” Mortimer says. “One of our former trainees is now going on to do their CMIIA qualification.” She says that they don’t look for any previous experience in internal audit or any particular degree subject, but focus instead on personality – how will they fit into the team and relate to clients.

“We need people who can stand up to clients in a constructive way. If an applicant is excellent at desk work, but lacks confidence and the ability to challenge people politely and constructively then it’s not the job for them,” Mortimer says. “Similarly, we don’t want someone with all the qualifications and skills, who seems arrogant and who I can’t imagine talking to executives – our reputation is at risk.”

A further bonus has been that the trainees have brought in fresh ideas and suggestions from their studies and their conversations with tutors. “I’m inspired by our trainees,” Mortimer admits. “They come up with better ways to do things and that’s what I want everyone in our team to do. We all need to audit at the speed of risk in future.”

As she approached retirement, Mortimer was keen to pass on to trainees her own enthusiasm for internal audit as a profession. “This is a fantastic opportunity – you’ll never get a better chance to see everything that’s going on, to talk to people right at the top and to contribute to top-level debates. You can add value to the whole organisation and make a real difference to people’s lives,” she says. “It’s so rewarding to be credible and see how your advice is valued and used.” 

This article was first published in January 2021.