Out of the comfort zone – award-winning internal audit at DFS

Internal auditors in the retail sector are used to rapid change. They must respond quickly to fashion, shifts in long-distance supply chains and emerging issues around sustainability, as well as the logistics of running shops and warehouses. The internal audit and risk team at DFS Furniture Group was created anew when the company merged four brands, including two former rivals, DFS and Sofology, in July 2019. A few months later, the Covid pandemic struck, closing stores and sending markets into turmoil. The way in which the team weathered the storms and emerged stronger and more united won it the Audit & Risk Award for Outstanding Team – Private Sector.

“We were the first teams in the business to merge – we were the guinea pigs. The organisation wanted to use our experiences to learn what to do elsewhere,” explains Maxine Grainger, who was at that time head of audit, risk, compliance at Sofology. She was given the task of creating the new group team. “DFS and Sofology had historically had an internal audit team, and risk was part of the audit function. There was a need for risk to be given more focus, with a team of risk professionals dedicated to driving risk management across our brands.”

Neither organisation had a model that Grainger wanted to develop further. Now group head of audit and risk, she took the opportunity to remodel the function to make it fit for the needs of the enlarged business. “We decided to create a separate risk function and a merged internal audit team and introduced a new methodology to bring it into line with Chartered IIA best practice,” she explains.

The merged team had a new internal structure, which included an additional junior role and two more senior positions. These recruits had to get to know the business and their colleagues, while those who had been in the original teams had to adapt to the new methodology and overcome rivalries between the brands.

Many people who had been in the business for years felt as if they were working for a different organisation. On the plus side, the changes “created a fantastic opportunity for the team to develop, progress and to train,” Grainger says. “It was exciting.”

She had previous experience building teams, so was aware of the pitfalls and the rewards. “People needed to gain each other’s trust, but it was a wonderful journey. At the same time, I was setting up a separate risk function and risk methodology, which was a new experience in this business. I had to explain to management why they needed it and how this would work, and I had to build and develop a relationship and trust with the board.”

Grainger and the internal audit and risk team had no idea at the time how important the relationship and the trust they were developing would prove to be a few months later.

“We were educating the business about the benefits of good risk management and we had to overcome barriers by explaining how we could help them to make better decisions,” Grainger says. “Initially we were doing it all through spreadsheets, because we were gathering risk data and building our risk tools from scratch.”

Meanwhile, the internal auditors were transitioning to more modern ways of working that proved a culture shock to some. They used the work of the new risk team to introduce risk-based audit processes and this provided a whole new focus.

“Scanning for operational and landscape changes is now part of the terms of reference for every audit. We talk to the risk team and capture all the key risks they’ve identified in order to test the quality of the controls we have in place,” Grainger explains. “We then feed our findings back to the risk team and ask them to reassess that area if necessary. None of this was happening in the past.”

Pause button

Just as the team was gaining momentum and beginning to see results from months of hard work, the pandemic struck. “We were all in the process of cross-training and learning our new roles. There was a real buzz and we were starting to get to know each other and then it stopped as if a switch flicked off. The world changed instantly,” Grainger says.

Most of the team had to drop everything and were put on furlough. Grainger says that the company prioritised the wellbeing of its colleagues and worked hard to ensure that everyone was informed weekly about changing government guidelines and the organisation’s situation in relation to Covid. There were online social events and small gifts sent to people at home.

“We created a buddy list so that people could check in and have a virtual coffee together if they wanted to. In some ways the experience made the team closer,” Grainger says. “It was essential to keep everyone informed about what was going on, because people had so many questions and fears.”

DFS Furniture Group was fortunate, because, although its stores were closed and it had logistics challenges, demand for furniture remained high. “The business was doing well financially and it kept colleagues informed about this,” Grainger says. “The team therefore felt confident about the business’s future and there was a sense that we were all in the same boat. This was important.”

Instant feedback

Once the team returned to work, they paused the audit plan and began a series of independent Covid reviews. Some donned full PPE and embarked on a programme of Covid reviews and compliance assessments at all the business’s warehouses and stores. They then conducted follow-up reviews where necessary to ensure that the business could continue to trade and operate safely.

“These weren’t formal audit findings and reports, but they were all about supporting the business at a difficult time and highlighting weaknesses,” Grainger explains.

“We gave instant verbal feedback to the health and safety and retail teams and to senior management, and then followed up with a slide deck to provide greater detail and common findings, as well as plans to revisit sites where necessary.”

The internal audit team worked in partnership with the risk team so that any new risks could be linked to audits and assessed as they were identified.

“Lockdowns provided quiet time during which we worked with the retail side of the business and engaged with management – we reviewed the retail working programme and looked at whether changes in procedures and processes altered the way we used our retail premises and their risks and what the business needed now,” Grainger adds. “We showed management that internal audit and risk was there to support them.”

Grainger believes a diverse team is essential to achieve the necessary relationship with management to ensure they understand that risk is part of business as usual, not an extra chore – and that this work helps them.

“Managers are telling us that they’ve never had this kind of support before and that we made it easy for them,” she says. “They don’t want to read pages of reports. It’s all about making sure that what we provide is useful and accessible and shows that we know and understand the business and its concerns.”

Forward to 2022

Hybrid working is likely to remain normal in future, depending on the needs of different people in the team, and Grainger, who is now group internal audit and risk director, is keen to minimise unnecessary travel.

The team has continued to change and develop. “We’re bringing back team days and people have started studying for qualifications and attending internal training courses again,” she adds.

At a practical level, embedding risk management into the business has been so successful that the organisation has had to implement a new risk-management tool with further capabilities that Grainger hopes will enable them to expand what they do. This should increase internal audit’s ability to use data analytics and Power BI in all their audits.

At the same time, internal audit has successfully won its case to have its own platform on the systems used by the retail divisions of the business, so it can promote what it does and interact more directly with auditees through their own systems.

“They can see the tasks that need to be completed after an audit on a daily basis and can also see how other stores are doing in their audits, so they can share best practice,” Grainger says.

The internal audit team uses the platform to post news and bulletins to explain what they’re working on. It provides a connection with new store managers and the internal auditors can highlight common audit themes – for example, if they identify similar weaknesses in several audits or if regulations change.

Reports have become shorter. Appendices are now posted online, but are not included in the report itself. Most recently, the team has been experimenting with delivering an introduction to their reports in a five-minute video. The aim is to make the lead internal auditors recognisable human faces, as well as to make managers aware of the key “where, what and why” of the audit.

“Retail is a visual, fast-moving business, so we’re looking for the best way to engage with people directly,” Grainger says. “We also have a presence on our internal version of Facebook, called Workplace, and do a quarterly ‘Risky Business’ post offering horizon scanning and a view of what we see coming up, as well as an ‘Audit4All’ bulletin sharing good news and offering things like a ‘get to know audit’ quiz to increase our presence.”

The team has come a long way in a short time under difficult conditions, and Grainger admits that the journey has been tough. However, she says that winning the Audit & Risk Award was hugely exciting and has made them all even more proud of their achievements.

“Our group CFO immediately texted ‘well done’ to us and in July we were given flowers and a card in our end of year audit committee meeting. The board is really pleased because it’s good for the reputation of the business,” Grainger says. “We all have the award logo on our email sign-offs and got lots of messages from senior management individually and to the team.”

She adds that it was hard, but useful, to put down everything they’d been through on the nomination form. The team is still “buzzing”, but they won’t rest on their laurels. “You can’t stay still – you have to be constantly looking for the next thing,” she says. 

This article was published in March 2022.