Minds matter – the psychology of internal auditing strategies

Few events bring geopolitics and their many associated risks into sharper focus than the tragedy of war. It goes without saying that the human cost on the ground in Ukraine is where the pain has been felt most acutely. But the ricocheting effects of Russia’s invasion will have a lasting impact on all types of businesses over the coming months, whether they are multinationals or smaller organisations operating solely in their domestic markets, with no obvious ties to either of the countries directly involved in combat.

Banks had to take urgent direct action almost immediately. In March, both the Financial Conduct Authority and the European Banking Authority urged financial institutions to implement and comply with the sweeping restrictive measures adopted in response to the crisis. The West turned up sanctions on Russia, including excluding lenders from the SWIFT payments system in order to isolate the country economically. Banks were asked to assess the adequacy and effectiveness of their internal controls and governance to ensure they complied with these measures and to adapt or enhance systems and processes as appropriate.

At Standard Chartered, Paul Day, group head of internal audit, says a priority for group internal audit has been to use its normal business monitoring activities to look at how the bank has responded with reviews of the war’s impact on its operations and counterparty exposures. “The bank looked for any direct exposure – it has no subsidiaries or operations in Ukraine or Russia, but has reviewed direct credit exposure, such as counterparties in Ukraine or Russia, or indirect impact, for example, UK counterparties that have trading relationships with impacted areas and may therefore be less creditworthy.

“Then there is the sanctions element,” he adds. “The bank should look for business counterparties that have themselves been included in the sanctions lists, or are indirectly impacted because they trade significantly with sanctioned parties.”

Day is now considering what his team could do next. He hopes to use data analytics to identify possible direct and indirect impacts independently and compare these to observations by first-line management.

Priced to imperfection

Financial institutions are not the only ones having to parry and pivot. The ramifications of the Ukraine war go far and wide, in many cases amplifying risks across industries already brought to the fore by the pandemic.

“Geopolitical risk has tentacles that reach into almost every other risk that organisations face. You don't have to be a global bank or multinational company to feel the impact,” says Richard Chambers, former president of IIA Global and now senior internal audit adviser at Auditboard. 

“You must think not only about the immediate risks created by a geopolitical event, but the second- and third-order effects as well. If energy prices surge, that is likely to further fuel inflation and increase the costs of other goods and services, including those vital to your supply chain. Internal auditors have an obligation to keep our audit plans and attention focused on where the risks lie.”

Rising inflation compresses profit margins and has the potential to reduce demand for goods and services. Companies that sell high-end or discretionary products may see revenues fall as consumers limit their spending, which increases the risk of economic recession. In April, Fitch Ratings warned of the effects of “stagflation” (economic stagnation plus inflation), particularly for some financial institutions in emerging markets and related sectors, such as aircraft lessors.

“No one has dealt with this level of price increases in decades, therefore businesses have little experience to help them navigate these conditions,” warns Chambers. “It is unlikely that organisations have financial managers with the experience to budget and forecast when there is so much uncertainty, prices are rising rapidly and there’s so much pressure on the bottom line.”

The weakest link

The war has also put supply chains back in the news – just when companies thought that crippling logjams were easing. “If Covid showed us how fragile modern supply chains are to big macro shocks, the crisis in Ukraine has reinforced that message,” says James Crask, managing director and head of resilience at Marsh. His team has been tracking possible scenarios and how they might drive contagion risk, and supply chain issues are the common thread that ties these scenarios together.

“It’s inevitable that raw materials will become more expensive and that supplies will be reduced. Single points of failure will be brought into sharp focus – for example, the availability of nickel, which is critical for battery evolution and is heavily sourced from Russia – and we’ll see knock-on impacts arising,” he says.

Businesses should already be identifying suppliers who are most likely to be vulnerable to disruption, including current and potential sanctions on trade with Russia, soaring costs of materials and energy, problems sourcing essential materials (such as wheat for food manufacturing) and interrupted or rationed energy provision. Supply chain managers should be contacting those identified as being most at risk and asking how they are being affected, what they are doing about it and what could trigger a further deterioration in the situation.

And they must question the information they are given – suppliers may be over-optimistic, badly informed or too anxious to sound positive. “Organisations need to source credible sources of information to validate what they are told by suppliers. In a situation like this there is a significant risk that misinformation could influence some very big and important decisions,” says Crask.

He adds that it is incumbent on businesses to have a response plan in place for each of their critical suppliers and trading relationships. This should set out the options that are available to help recover products and services that may face further disruption.

Internal audit, in turn, should be checking that the business is as prepared and well-informed as it believes it is – that it is identifying the full range of interrelated risks, thinking broadly enough about how risks can ripple outwards and communicating effectively with key suppliers, as well as having adequate contingency plans. These are all things that internal audit has been doing in the pandemic, but they now require a new focus and may involve sourcing independent information and contacts.

What’s more, the war increases the risk of state-sponsored malicious cyber attacks, just at a time when many organisations may be vulnerable with staff working remotely and transitioning to new working styles. An organisation may not be targeted directly, but internal audit should be considering the potential for an attack to take down key operational tools, such as banking systems, information sources or energy supplies.

The long view

The war has undoubtedly increased business risks and, while it might be tempting to view this as unpredictable, as far back as 1994 Ted Galen Carpenter, senior fellow for defence and foreign policy studies at the Cato Institute, wrote that the expansion of Nato “would constitute a needless provocation of Russia”. Putin himself has repeatedly stated his belief that Ukraine should be part of Russia and a westward land grab has been a possibility since his annexation of Crimea in 2014.

Just as the risk of a pandemic was always on the table, so too were warnings about Putin’s territorial ambitions. Organisations need to pay attention to potential conflict hotspots and assess how events could unravel if they occur – consider, for example, China’s view on the status of Taiwan and its military presence in the South China Sea.

Organisations operating in high-risk countries can take out insurance policies, however, war exclusions mean that events such as the Ukraine invasion are not covered. Organisations therefore need to understand the probability of such events and whether the rewards they gain are worth the trade-off. Management is responsible for making these calculations, but internal audit should challenge the underlying information and how this fits the business’s risk appetite.

“Internal audit doesn’t have all the answers, but we need to be asking the right questions. And, most certainly, the right questions today are geopolitical,” says Jim DeLoach, a managing director with Protiviti. “One fundamental question is: at the very highest level, what kind of planning is the organisation doing with respect to different geopolitical scenarios?”

DeLoach adds that this should include assessments of longer term challenges. “This latest shock is going to cause companies to revisit their assumptions about the global economy, their position in it and certainly where they choose to invest. Withdrawing from Russia has become a reputation issue. If peace were declared tomorrow, would companies such as McDonald’s and Apple reopen and go back to the way things were? The hurdles have risen significantly.

”One view is that globalisation has begun to, and will continue to, reverse – with the pandemic as a major catalyst for this change. The Economist Intelligence Unit noted in 2020 that, following China’s acceptance into the World Trade Organization in 2001, which boosted globalisation as companies exploited low production costs and growing demand in the Far East, many are now regionalising their supply chains.

This trend developed during the trade wars between the US and China in the Trump administration and has accelerated since Covid lockdowns began.

Larry Fink, the CEO of BlackRock, the world’s largest asset manager, has pointed out that the Ukraine conflict has dealt a further blow to globalisation, as companies rebuild their supply chains and bring production closer to home. In January, for example, Intel announced that it will invest up to $100bn to build what may be the world's largest chip-making plant in Ohio, in response to the global shortage of semiconductors that is affecting all kinds of manufacturing industries.

This is where long-term scenario planning is vital and why it is essential that internal audit asks questions, not just about how management is preparing for the company’s future 12 months from now, but years ahead.

“Where is China on the board?” asks DeLoach, as an example. “If China were to take action to support Russia and sanctions were imposed in response, what would that mean for China and Taiwan? Taiwan is a world-class provider of semiconductor chips. Think about what that could that mean for supply chains and the ability of organisations to meet demand in future.” 

This article was first published in May 2022.