Internal audit in a war zone – how a CAE is supporting vital services in Ukraine
Professional courage is a requirement in the new Global Internal Audit Standards, but the situations in which it is needed vary widely. When Andrzej Nowiczenko took on the role of Chief Audit Executive at Ukraine’s PrivatBank in October 2020 he expected to face many challenges – however, full scale war with Russia was not on the agenda.
The bank is Ukraine’s largest in terms of assets and has the country’s second largest branch network. It has more than 19 million customers and was nationalised in 2016. Nowiczenko’s task was to restructure and develop the internal audit function, introduce modern internal audit methodology and tools, and help it to implement recommendations from the National Bank of Ukraine and an independent audit function review. One significant extra challenge was that he joined in the middle of the Covid pandemic.
However, everything changed in February 2022 when Russia invaded Ukraine. As a Polish national, Nowiczenko could have returned to Warsaw and found another job. He chose to leave Ukraine temporarily but remained in post. He went back as soon as he was able to, all the time helping the bank continue to function effectively in wartime.
Working in wartime
Since then, he has divided his time between Warsaw and Kiev. Although not on the frontline, Kiev and Dnipro, where the bank is headquartered, are constantly under attack from rockets and sirens punctuate each night, making a sound sleep impossible, he says. “When they go off, you wonder if you should go down to the shelter and you often hear explosions, indicating that something has got past the defences. Sometimes you see smoke rising on the horizon as soon as its light,” he says.
Power cuts are frequent and sometimes prolonged, so systems must be resilient and bank branches can be cut off for hours. Staff must be equally resilient and flexible, often working at night to catch up when the power comes back on. Nowiczenko recalls seeing video footage of two physically slight women in one branch wrestling to set up a power generator with the help of customers.
Planning is a constant challenge, because it is impossible to predict power outages and staffing levels can fluctuate at short notice. Women make up most of the workforce, because there is huge pressure for men to join the army. Audits must be planned in the knowledge that auditors or bank staff may be conscripted.
Employees (and customers) are also living with immense day-to-day stress. Most are sleep-deprived and many have family who have gone abroad or who continue to live in areas close to the frontline. Many more have close family members fighting in the army and so are constantly anxious about their safety. Nowiczenko says he has been amazed and impressed by their resilience.
First impressions
The irony was that when he was approached by the bank, Nowiczenko had been planning to move west, not east. He had worked in multinational financial services firms and is a member of the Polish Institute of Internal Auditors. He took on the PrivatBank job because he saw there was lots to do and thought it would be interesting – especially at a time when the economy was doing well, and business was booming.
He expected it to be a tough job – within a week of joining he had to speak to the public prosecutor – but he knew he had the full support of the supervisory board and freedom to shape the audit function’s new methodology.
He had also been told he could increase the internal audit headcount, but he soon found that hiring staff was less easy than he expected – no one responded to his job adverts. “I realised we had to start sending better messages to the market,” he says. He commissioned a series of short videos showing the work of internal audit and posting these on LinkedIn and social media and attracted over 100 applications. Work was therefore going well when the war started.
Preparing for an invasion
Although with hindsight it’s easy to assume that everyone expected Russia to invade, Nowiczenko says that is not his recollection. “There was tension because the Russians had moved military forces to the Belarus and Russian borders with Ukraine, but we had seen these manoeuvres the previous year,” he says. “We were reviewing our business continuity plans, but there were no clear messages from the embassies or the Ukrainian government.”
His team did their best to prepare the bank for every eventuality – which was made more difficult because many people were still working remotely following Covid restrictions. Others had left the cities to join their parents in the country or move further away from the borders.
“We drew up a list of all the audit team members’ private contact details in case of emergencies. We also took advice from those who had experienced war zones and advised everyone to have a ‘tactical backpack’ of things that would enable them to survive on the run for a few days, such as water, medicines and cash,” he says.
When the invasion began, people immediately started trying to move their families across the borders. “This was a real issue and we hadn’t prepared adequately for it,” Nowiczenko recalls.
“I hadn’t got advance authorisation to let people take bank equipment and data over the border or set up offices overseas. But human lives mattered most, so the priority was to enable them to take equipment out of the country and then set up systems so they could work from wherever they ended up. We also had to get computers to those who left home without them.”
The Kiev office was empty, so he went to Warsaw to watch how the situation developed. He now divides his time between cities, but hopes to return to Ukraine full time when the war stops.
Personal risk
As a foreign national, Nowiczenko could have left for good, instead of risking his life to help maintain the banking system in a war-torn country. Although Kiev is not on the frontline, the dangers are considerable. On one occasion two supersonic bombs exploded directly outside his hotel, damaging the façade and blowing out windows. He was unhurt, but surrounded by people who were seriously injured by flying glass.
“Being woken by sirens every night gets into your bones,” he says. “About 10% of my team now work from abroad, but most are in Kiev or another major town. They deal with this every day, along with the electricity outages, which not only affect their work, but create further problems, such as stopping lifts in Soviet era tower blocks, so they have to walk down 24 floors just to buy food or take children to school.”
“Stress is everywhere all the time,” he adds. “The bank has hired psychologists to help, but most people are being incredibly strong and adaptable."
Wartime decision-making
Every business decision is affected by the war. Banks are an essential service and need to fulfil their obligations to customers, but cyber attacks from both Russian sources and opportunist criminals are rife and investment costs must stay low to support the war effort.
“Some of these challenges have necessitated innovative solutions – for example, the vulnerability of our data centres meant that we had to move all our data to the cloud,” he says. “This would normally have taken about two years, but we had to do it in weeks.”
The war completely changed the bank’s audit universe, its evaluation of risks and its audit plans. “In the first weeks we paused all our audits and helped wherever we could just to keep the bank functioning,” Nowiczenko says. “We then focused on supporting the bank’s operations with consultancy services. We looked at what we could do with limited controls, helped staff who had moved abroad and established new processes for overseas working. We had to get involved directly with managing processes at first, but then moved back to our normal role and ensured that those who had run processes did not later audit them.”
Nowiczenko got in touch with other CAEs across Ukraine and overseas – including contacts at the Polish and Chartered IIA – to discuss ideas and ask how others were coping. This helped him to produce a new risk assessment and audit plan and resume “normal” internal audit work by May 2022.
The supervisory board and audit committee were hugely important and supportive, he says – about half of the committee members were overseas and all were actively involved with approving audit activity and innovations. Some had previous experience in war zones and all helped provide perspective and advice.
Since then, Nowiczenko has used his IIA contacts to benchmark his team’s activities and provide advice and support over issues such as implementing the new Global Internal Audit Standards. It’s essential to maintain strong and effective internal audit because the war has led to revised rules for finance governance – from cash liquidity requirements to government guarantees for loans to keep essential agricultural businesses afloat.
Furthermore, PrivatBank supports multiple charities and hospitals and also funds military equipment. “GDP plummeted 30% when the war started, but lots of businesses managed to move their operations or stocks to the west or across borders and have managed to keep trading,” Nowiczenko says. “Most Ukrainians are trying to live as normally as possible.”
Team spirit
So why did he choose to stay? “I am responsible for my team and I have to show that I am in Kiev as well and share their danger,” he says. “I understand what they’re going through – I’m not ‘hiding’ in Warsaw.”
Nowiczenko is perhaps not typical of CAEs in that he left home at 15 to go to military school and became a fighter pilot. “My appetite for risk is probably different from other people’s,” he admits. “I can deal with this type of stress. But, above all, I like the people and the country and I want to help all I can.”
He believes that when the war ends the bank is in a much more advanced technological position than previously and could teach other financial institutions lessons in resilience and governance. In particular, they know about managing rapidly changing risks, being agile and seeing opportunities to improve.
“I am optimistic and I think that Ukraine will bloom again,” he says. “And for that I have to give credit to our people for being calm, mature, flexible and prepared for everything, while showing constant determination to keep the bank going.”