Q&A: You asked us - September 2023

Q: I have been asked to consider a nine-month secondment, but am a Head of Internal Audit (HIA) with only two internal auditors. Do you think it’s possible for me to do a first- or second-line role and return to the HIA role with my objectivity and independence intact?

A: Secondments are a great opportunity not only to develop your own skills, but also to improve risk maturity in another area of the business. You are right to be concerned as any operational responsibilities for an HIA or chief audit executive (CAE) represent a risk to operating in accordance with the Code of Ethics.

Standard 1130 is clear that if an internal auditor has been responsible for an operation, they must not audit that operation in the following 12 months. Additionally, an HIA cannot oversee engagements for any function for which they are responsible.

You also need to consider the broader impact that an interim operational role may have on your involvement in decision-making – would the role involve a seat on the board or a project steering committee or similar? The scope of your operational activity would need to be clearly defined so that it could be mirrored on your return.

A co-source arrangement for engagements in relation to your secondment scope could be a useful way to manage this. Delegating supervision to one of your team would also provide them with good experience.

Aside from these formal points, independence and objectivity is also about mindset. Take time to consider your own interpersonal skills, your preferred ways of working and the culture of the organisation – will these be an advantage or a challenge during and after a secondment? Discussing the situation with the chair of the audit committee could be a pragmatic first step – play out different scenarios and identify and work through possible risks to ensure you are both happy with the process.

In summary, yes, an HIA can undertake a secondment, but it requires more forethought than a straightforward operational-to-operational move.

Q: My line manager has said I need to think more about global issues, but I’m not sure it’s relevant since I work in a relatively small council. I think it will be a distraction. Am I missing something?

A: Internal auditors need to be aware of the environment in which their organisation operates. If you think about a SWOT analysis – the Strengths/Weaknesses are internal to the organisation and the Opportunities/Threats are typically external. The council will be affected by a variety of external factors.

As you work in the public sector, you’ll already be aware of the impact of central government and politics on council funding and services. The same is true of global issues – geopolitics  also have a huge impact on the UK and filter down to local issues. For example, the relocation of displaced refugees, the reduction in migrant workers in some locations post-Brexit and increasing state-sponsored cyber threats.

Take a look at the examples in the Chartered IIA’s latest research report “Navigating Geopolitical Risk”. This shows how, for example, tensions between China and Taiwan may be distant in terms of geography, but, as with the war in Ukraine, the impact close to home in terms of supply chain disruption, costs and economic growth could be significant.

Q: Our internal audit function recently had an EQA. One of the recommendations was to make the internal audit report impactful. As a team, although we find the current format a bit boring to write, we are comfortable with it and so is the audit committee. How can we move forward with this?

A: Resistance to change is a normal reaction. Internal auditors are human too!

Here is a simple four-step approach:

1  Read our guidance on effective report writing.

2 Arrange a team discussion to walk through the writing process. Be objective, be your own critical friend and set a ground rule that everyone must come up with at least one constructive criticism.

3 Produce a report a quarter of the length of your existing reports.

4 Ask for feedback, learn and refine.

Another option is to ask an expert to facilitate the change through a series of workshops.

It’s often said that report writing is more art than science, although some formats tend to work better than others to create impact. Sara I James has written extensively on this and you may find her work insightful.

Q: I have been given responsibility for planning a payroll audit. It feels a bit daunting as I’m an apprentice and it’s not something I’ve done before. Is there an audit programme I can use?

A: Daunting is a great description! A new engagement is always daunting, but our guidance on approaching unfamiliar areas of work should help you to get started on this and future engagements.

We do not provide audit programmes as each organisation is unique – it is important that an internal auditor takes into account risk appetite, control maturity and risk awareness when scoping an engagement.

Our payroll guidance provides an overview that you can use as a starting point to develop your own audit programme.

Got a question? Contact the Chartered IIA technical helpline on 0845 883 4739 or email technical@iia.org.uk

This article was published in September 2023.