Lessons in advocacy: what did Bupa GIA do to win the Audit & Risk Awards for Internal Audit Advocate in 2024?
Bupa Group Internal Audit (GIA) began its initiative to “relentlessly and passionately advocate for effective internal controls” with a stated ambition to win hearts and minds and create a lasting impact on the business. It saw its campaign as a basis for evolving and automating these controls to support the organisation’s ongoing “change journey”. Its success won it the Audit & Risk Award for Internal Audit Advocate in 2024.
Bupa is an international healthcare company serving over 60 million customers worldwide. Having been established in the UK for over 75 years, it now has businesses around the world: principally in Australia, the UK, Spain, Poland, Chile, Hong Kong SAR, India, Türkiye, Brazil, Mexico and New Zealand, and with associate businesses in Saudi Arabia. Bupa’s ambition is to become the world’s most customer-centric healthcare company. The sector is rapidly evolving so the company requires an equally responsive and adaptable internal audit function.
GIA’s initial aim was to raise the profile and understanding of internal audit and internal controls across the organisation. The internal audit strategy included a purpose of “Faster, more effective, and sustainable improvements in internal controls”. “We set ourselves the ambitious goal of evolving this to further define, and measure, what a leading, future-focused audit function in Bupa should look like,” its nomination stated. Specifically, they wanted internal audit work to reflect innovative processes and capabilities, including embracing digitalised capabilities and enhancing their use of analytics, while always keeping advocacy at the heart of the function’s stakeholder engagement approach.
“Winning the award could not have come at a better time for us,” says Darren Pearce, Director of Internal Audit, Global Operations, at Bupa. “We have KPIs for “ambition” on our balanced scorecard and winning underpinned our quest to build a better and different understanding of what internal audit does and how it can support the business. We saw a fast-emerging opportunity for the business to use us in different ways from the traditional image they may have had of internal audit and, to achieve that, we saw an opportunity to evolve ourselves as advocates, educators and advisers.”
Bupa's GIA approach developed from a “stakeholder engagement” model but, when they read the awards categories, they realised that advocacy lay at the heart of what they had been doing in this space. "Changing the way internal audit was perceived in the business involved more than simply doing good internal audit work, and winning new advocates within the business was key to that", he adds.
“It was also about us going out to educate managers. How do you get invited to join a team meeting to explain what good internal controls look like? We were excited to see this category because it chimed so well with the work we’d been doing over the past few years.”
Winning the award has helped the team to share its messages and extend its reach further. “The award acts as a springboard which is so useful when our whole quest is about changing people’s attitudes towards controls and assurance, and their perceptions of what GIA does,” Pearce says. “It’s a great marketing tool for spreading the word about what we’ve done. It also starts conversations in new places about what we want to do next – we can say ‘you’ve seen our award win in our email signature, let me tell you more about it’.”
How did they do it?
Realising that newly defined internal audit ambitions required new measures of success, the team created four new “ambition KPIs”: advocacy; digital; analytics; and innovation. They agreed these with the audit committee because they wanted the KPIs to have senior sponsorship, to ensure they were visible and that progress against them was tracked.
They also focused explicitly on embedding their role in the organisation as internal control experts and educators. Within Bupa’s overall risk management framework and internal audit methodology, they developed a new framework defining the company’s internal control environment. The point was to make internal controls easy to communicate to the business and for the business to understand, embrace, implement and sustain.
GIA followed this up with engagement activities to increase understanding of controls and how they can be applied, with an overall focus on how controls work together to help Bupa achieve its wider objectives. Every member of the internal audit team is responsible for “bringing this to life” for stakeholders. This project helped reposition internal audit from being seen as an assurance provider to also being a function that “advocates, provides, promotes and educates” about controls.
Education and advocacy work to support this included proactive functional speaking, launching a guest auditor programme, participating in Bupa’s graduate scheme and piloting a new GIA Audit Graduate programme. They also introduced an annual training “GIA Expo” which encourages connectivity and collaboration between internal auditors and the business. Speakers from senior management and from outside the business are invited to share their views (which in turn increases their involvement with, and understanding of, internal audit). The Expo is supported by a global “Stakeholder Portal” containing resources and information that stakeholders can access to learn more about GIA, internal controls and assurance processes.
What was the result?
Shifting and progressing the organisation’s view of internal audit, and its understanding of the role and benefit of controls, has done more than enhance the reputation and value of the internal audit team. It has also contributed to positive culture change throughout the business. Employee and stakeholder survey results have improved, and management requests for assurance work from GIA doubled in a year.
By increasing its use of analytics technology, GIA has delivered more insights and provided earlier warnings of risks. They have used this information to demonstrate to stakeholders across the business how these applications can help them to build better, more sustainable controls. In some cases, they have provided data and tools to areas of the business to help managers enhance capability and take better ownership of their first-line controls responsibilities.
In the awards nomination, Bupa’s Director of Controls and Governance commented that: “The management information suite developed by GIA draws together data from various sources providing a view previously unavailable to senior/operational management. First Line is now actively using this data to gain insights that we hope will be the foundation of better root-cause analysis and a core part of our Consumer Duty preparations.”
The guest auditor programme had attracted 22 people into temporary assignments with internal audit by the time the award nomination was completed. Of these, three people had switched to permanent roles in GIA. The programme is now global and continues to grow.
GIA’s participation in Bupa’s Graduate Programme also had positive results. The Early Careers and Capability Team wrote: “Internal audit gives our graduates a different perspective on Bupa and a wider view of the business which is crucial for their development within their careers.”
Above all, the advocacy campaign has shifted the way the whole organisation views, understands and uses controls. This is a cultural change and continues to make internal audit better understood and appreciated – and more effective.
“Stakeholders recognise our controls advocacy alongside our independent assurance services, and are being influenced to act because they also learn. This matters because it means that GIA plays a role in building the culture of the organisation,” Pearce explains.
What next?
Pearce stresses that the team must maintain strong “bread and butter” assurance work, but the fact that managers are requesting more support from internal audit means that GIA is looking to see what further products and services it can develop and offer. “We’re looking at formalising our education and advisory work, for example, by putting together a training course on good internal controls,” he says.
GIA is continuing to move away from telling stakeholders what has gone right or wrong following an audit, to being involved in processes and initiatives from the start. “We all know that it is far more valuable to provide an independent view when things can be changed than after a project is completed,” Pearce points out.
“Jeremy Eagles, Bupa Group’s Chief Audit Officer, and all the members of his senior team have seats at the various management tables so we can offer independent views on new projects and strategy at each level,” Pearce says. “We’re saying ‘let us help to build the foundations from the start, rather than turning up too late’.”
Eagles has also been involved with the Chartered IIA, engaging with the development of the revised Internal Audit Code of Practice last autumn and sharing Bupa’s experiences of advocacy. He is keen to see advocacy explicitly recognised as a function of good internal audit teams.
Future success depends on GIA’s continued ability to source relevant information to share with the business. Data is vital for this and Bupa GIA is thinking creatively about the expertise it will need. It is also sharing what it learns about data with the business and encouraging other teams to develop more analytical skills and dashboards. This boosts internal audit’s credibility while providing further data for more insightful audit activities.
Organisational culture is another key element. “We work in healthcare so every employee knows we are focused on providing excellent service and experience to Bupa’s customers. We need people to recognise the role that internal audit has in delivering the strategy of the whole company,” Pearce says. “We are here to help the business succeed and part of this is about helping the business to take informed risks. Our approach must be aligned with, and help improve, the organisation’s culture.”
By identifying internal auditors as “internal control experts”, GIA has raised awareness of internal controls and linked these explicitly to the success of the business. “We need everybody to realise that it’s not just internal audit’s job to talk about controls – controls need to permeate the fabric of the entire organisation,” he adds.
What did winning mean for the team?
Winning the award was crucially important because it meant that internal audit’s work was recognised across the business, Pearce explains. “We’ve lost no opportunities to say we are an award-winning function.”
Their success prompted teams in other locations to enter awards – the Bupa internal audit team in Australia recently won an award from the Australian IIA. “This is great for the function and for talent attraction. People know when they join us that they are joining an award-winning team,” Pearce says.
However, he adds that it was particularly important that they were recognised for their advocacy work, because success feeds back into this campaign. The award was in the papers that went to the audit committee and to the CEO and was publicised on the company intranet.
“We’ve told people that this is the Oscars of our profession and that even being shortlisted is a huge accolade. Being recognised by your peers is such a privilege,” Pearce says. “This is the second time we’ve won an award, and it’s a fantastic endorsement for us. I’m repeatedly blown away by how much appetite there is in internal audit to learn from and recognise each other.”
What the judges said:
- “I particularly liked the advocacy element of what Bupa has done and the way it has moved the needle in their organisation was exceptional.”
- “Bupa shows that innovation and change can be incremental as well as revolutionary.”
- “The results they’ve achieved are exceptional and this is an all-round good story that is achievable in many organisations.”
- “Bupa’s story is inspirational in terms of its all-round impact.”
Tickets are available for the 2025 Audit & Risk Awards, which take place on 19 June at Park Plaza Westminster Bridge hotel.