View from the top: Inclusion – socioeconomic status matters

I’m often asked what it’s like working in a small audit team in a small bank, after so many years of working in some of the world’s largest. I sense a leading question – these people are hinting at lower quality processes, smaller budgets and an inability to attract top talent, which affects internal audit as much as the business.

However, I can proudly report that smaller financial services firms offer some of the most rewarding experiences, deploy the most cutting-edge tech, and have some of the sharpest, most innovative people out there. Moreover, opportunities within internal audit are equally fulfilling and diverse and offer a platform for driving transformational change in the business in a way I’ve not seen elsewhere. And that’s why we’re all here, right?

In such an environment, internal audit can truly partner with the business and provide pragmatic, commercial, hands-on assurance, tailored to the business’s needs, while at the same time ensuring independence is preserved. I’d like to share my musings about how we’ve done this at ClearBank, which was founded in 2016 as the UK’s fifth clearing bank and the first in 250 years.

First, we’ve curated a team with the right combination of skills and capabilities to address the top risks the firm faces. We’re not a team of banking generalists, nor have we attempted to hire in skills covering every risk type. We’ve deliberately selected the best candidates with the precise combination of technical, audit methodological and interpersonal skills that complement each other and the business. We have nine unique, talented, passionate internal auditors who each bring something different yet critical. This approach ensures we can really increase the value we add to our audit outcomes, as well as making the team less reliant on external co-source support, which is one of the perennial financial challenges when running a small team.

A logical corollary of having the right people with the right skills leads to my second observation – the ability to leverage this to build deep, trusted relationships with the business. Independence comes from not designing or operating the controls we audit, but this doesn’t mean we can’t partner with our stakeholders to jointly take the business to the next level. We do this by undertaking meaningful audits and a programme of monitoring that allows us to understand the business and provide feedback in real time. This embodies the spirit of 2020’s updated “Three Lines” model, which encourages internal audit to seize opportunities proactively to help the organisation achieve its objectives, rather than acting purely “defensively” to avoid risk. It also underpins the forthcoming refresh of the IPPF and Standards.

A third critical element of our model is working alongside second-line managers in a complementary way to ensure we have greater coverage of risk-based assurance, rather than competing for profile. We’ve put in place a programme of combined assurance, whereby our plans are developed independently, but are then compared to remove duplications and address material gaps. The Board Audit and Risk Committees take comfort from this approach and it provides ClearBank with a more effective E2E assurance programme that considers controls as well as customer outcomes. And, of course, the ongoing open dialogue with members of the Board Audit and Risk Committees – outside our formal quarterly meetings – facilitates buy-in and feedback and is what makes the model so effective.

Lastly, we collectively use tech to enhance our approach. We use Azure cloud technology across all three lines and leverage it for collaboration on audits and other external attestations to drive efficiency. This enables us to test large populations through the manipulation and interrogation of data, and also to interact with the business in real time. We use this tech in a scalable way, while at the same time it enables us to monitor risks across the audit universe. This is a clear advantage of our cloud-native tech platform – there’s none of the cumbersome legacy tech that often blights banks, so we have a cleaner, more efficient process.

In summary, we have a number of levers that we pull to make our small team so effective. It’s all about integrating ourselves within the fabric of the business, being a critical part of the daily running of the firm, while ensuring we don’t lose our independence. I think there’s something here for everyone to learn to maximise the impact of our wonderful, and critical, profession. 

This article was published in May 2023.