Interview: David Hill, CEO of SWAP Internal Audit Services, on the new normal

Earlier this year David Hill, chief executive of SWAP Internal Audit Services, was juggling the competing demands of increasing requests for assurance against national recruitment challenges. Since becoming chief executive last year, he has worked hard to raise the organisation’s profile nationally and to increase the speed of innovation in areas such as data analytics and agile practices. He has doubled the organisation’s training budget and restructured the business by giving people specific portfolio responsibility for key business activities areas such as IT audit and quality performance.

However, despite these healthy business prospects, the emergence of Covid-19 and lockdown across the UK and Ireland meant that SWAP, like most businesses, suddenly faced a whole new set of challenges.

Fortunately, Hill points out, the changes already in progress at least put SWAP in a stronger position to weather the storm. The business is a not-for-profit shared services internal audit provider owned by 24 local authority and police partners. In addition, it also has customers (charities, local authorities and fire and rescue authorities) who pay direct fees.

“Contract renewals and tender activity has slowed for the time being, but we anticipate a return to business as usual later in the year,” Hill says. “For now, we are refocusing on how we help our partners through this crisis and how we ensure that SWAP not only survives, but emerges stronger.”

During the crisis, Hill says his team of 72 internal auditors will be working on continuous assurance projects using data to spot control weaknesses, fraud and other losses. “All our audit plans have been refocused and redesigned, of course. We see this as a real opportunity to instigate and promote the value of data analytics at our partners,” he explains. “We’ve been offering advisory work and identifying which controls our clients can relax and which need to be maintained. We are working closely with our partners’ financial directors so that everyone remains vigilant and on the look out for lapses and shortcuts, and on their guard against potential malicious cyber attacks. We’re offering support with their controls and IT security if they want this.”

Although he has paused all new recruitment for the moment, there has been no need to furlough any staff as yet. “The audit planning cycle has been disrupted, but our staff are adaptable and are supporting local authorities in many ways, such as helping to administer grant payments to small businesses. Fortunately, we have enough people to separate those who help in operational roles now from those doing the audits later,” he says. A survey was used to identify staff with key skills (such as care experience) and they are encouraged to offer whatever help they can to their local communities.

Much of the audit-related work that SWAP’s team can do at the moment depends on working remotely and on being able to access data – both areas that Hill says they’ve been improving and developing over the past year. “Data is crucial here – if we can get hold of the data we can do a lot behind the scenes without clients being involved on a day-to-day basis,” he explains. “That’s a key part of my plan at the moment, but it’s not new. I was a fan of data analytics 30 years ago and we’ve been working hard over the past year to ensure our clients and partners collect the data we need and that we can access it.”

Data drive

Before the pandemic, Hill had set up a specialist team to be responsible for data analytics, but he already knew that in the longer term he wanted the whole company to be competent with analytics tools. “We need all the available data in front of us before we begin the first audit meeting,” he says. “The best way is to get all this automatically, but that depends on what data the client collects and the reliability of that information.”

Previous concerns over the General Data Protection Regulation (GDPR) and data security are rapidly dissipating as the pandemic is bringing the value of collecting, monitoring and using data responsibly into focus. “This is a wake-up call for lots of internal audit teams,” Hill says. “We need to use and access data far more effectively and we need to move quickly. All internal auditors have to be data and IT savvy today.”

This is challenging enough in a large organisation with big budgets and sophisticated technology. It’s far harder when you’re dealing with multiple organisations each with their own systems and processes. However, Hill says that clients have been asking more questions about what else internal audit can offer them and this can open up conversations about data and what could be done with it.

“We have to demonstrate a more innovative approach to audit. We need to get assurance out much faster – Richard Chambers’ book The Speed of Risk is a great read on this,” he says. “We need to ask clients are you collecting the right data and are you using it to make the right decisions?”

Too often, Hill adds, he’s asked these questions, only to be told that the auditors can have the data, but that it’s “not very good”.  When this happens, he asks what they are doing to improve the quality of the data, what they are collecting, whether they have identified what they need and what they already have and how they are collecting it. “Some councils are using it brilliantly and others almost not at all.”

This mattered to him before the Covid-19 outbreak, because he saw the lack of accessible data as something that worked against his ambitions to improve the speed and quality of the assurance that SWAP provides. “We have to tell clients that if we can’t access good quality data, then we can’t be a mature internal audit function – we can’t perform at our best for them,” he says.

To get this message across, it’s important that SWAP’s internal auditors are perceived as an in-house internal audit service and not as an external business. The aim is to benefit from the shared services model by having a larger team with broader experience that can share knowledge, best practice and emerging risks across organisations, but also to maintain the close relationship that developed from staff who were originally in-house.

“It’s particularly important that we keep communicating with all our clients, asking what we can do to help and what they need,” Hill says. “We had been working on this before the current crisis and were pleased that more partners had started coming to us and asking for advice. Now, of course, it’s critical for us to be there if they need us.”

Opportunities from crisis

One positive outcome may be that the current challenges will prompt internal auditors to make necessary and desirable changes faster than they would have done otherwise. Hill had already reorganised the management structure of the team and put in place an 18-month plan, but he believes the pandemic crisis has enabled him to push changes through faster. For one thing, the entire team is now working remotely using Microsoft Teams and they have begun introducing Agile techniques. It’s also given him some “head room” to think about marketing projects and a chance to roll out training on areas such as IT auditing to all staff.

“Some things are quite simple improvements – for example, after a normal meeting we’d go away and edit notes and then send across the written-up version. If we do it on Teams, we can edit notes together during the meeting and it’s done immediately,” he says. “We can also access training videos individually or together.”

Staff training is an important part of Hill’s plans. Not only has he doubled the training budget, but 33 members of staff have been promoted in the past two years. He says he is keen to make SWAP an “outstanding place to work” and has recently rolled out a wellbeing package for staff. This was well timed and means that a support framework is in place to assist staff isolated at home.

For a start, each member of staff has been given a £50 “wellbeing” budget to use on something that will promote their health. One person, for example, bought a pair of running shoes. In addition, SWAP has appointed and trained two mental health first aiders, who, Hill adds, are particularly important during the lockdown.

Efforts to promote team cohesion include a weekly quiz, French club, virtual Pictionary club and a weekly lunchtime chat with the CEO. “We are our staff – we don’t make a product,” Hill points out. It exciting to see teams bond as they share experiences and support one another.

Increasing transparency has helped change the organisation’s culture for the better, he says. Staff use Yammer for internal communication and to share news and this is now showing good levels of engagement, he adds, because staff have a voice.

He’s also started to write a CEO blog for staff. “I was worried I’d start and then fail to keep it up or, worse, realise it was really boring, but I’ve found that there’s always something to write about, from decisions by the board of directors to the Internal Audit Ambition Model or how we’re doing on an external quality assessment. Recently, it’s been more about the coronavirus and our response,” he explains.

A new perspective

He hopes that the pandemic will prompt clients as well as auditors to appreciate the need to do things faster and more efficiently – to work differently. “When we come out the other side of this pandemic, I think the existing style of audit plan will be dead in the water. We’re going to have to entirely refocus,” he says. “We’re going to have to talk to audit committees about this, because they’re not used to us working in an Agile way and not presenting them with a plan, but this is where we’ve got to go. We need to be a trusted resource and that means that we have to be able to do the most important thing at that time and get the results out as quickly and efficiently as possible.”

Much of this comes down to trust. “Heads of internal audit are qualified professionals and need to be trusted to use their professional judgment about what resources they need to use where and when. We need systems that will tell us what is most critical right now, and then be able to act on it immediately. As we have seen recently, when a crisis happens things can change very fast. Covid-19 has given us lots of opportunities to change our perspective about what we should be doing and how we should be doing it. We need to learn from this experience, focus on the future and update the way we work.”

This article was first published in May 2020.