View from the institute: Resilience – people and culture are key

We talk about returning to a new “normal”, but that is beginning to sound like wishful thinking. We’re living through a period of shifting sands – certainties that we have held for decades are being torn down, or slipping away under our feet. How can organisations put down the roots and tap the supplies they need to grow in such an unstable environment? How can risk professionals monitor and advise on emerging risks when the fundamentals constantly change?

Just as we start to feel we may have achieved a degree of understanding about the impact of Covid on our lives and how we will learn to live with it in future – and this is still an early and fragile optimism – we enter a period of intense geopolitical uncertainty. War in Ukraine, rising tensions between western democracies and Russia and displacement of millions of people matched by anxieties about soaring inflation and, in particular, fuel supplies and costs. Meanwhile, rising Covid cases in China have caused new lockdowns and further supply disruption.

World peace may be beyond internal audit’s remit, but the risks thrown up by conflict and its consequences certainly fall within it. However, just as our businesses operate in a global market, so our risks increasingly overlap and interrelate to a point where it is impossible to view them individually. Scenarios are ever more complex to plan and scope because there are
no boundaries.

What effect will war, economic sanctions, supply chain disruption and a crisis in power supplies mean for organisational budgets, suppliers and their products and logistics? What effect will it have on employees who must eat, stay warm and are just beginning to return to travelling to work? What effect will it have on staffing policies, remuneration and perks? Is it better to offer a percentage pay rise or a cost-of-living bonus, to pay staff travel costs, offer a subsidised café and a cosy office, or to encourage people to work remotely again and save the cost of travel?

How will these decisions impact your organisation’s carbon footprint, and will fears about power security mean we return to fossil fuels, build more nuclear power stations or drive a rapid switch to renewables? How will an influx of Ukrainian refugees affect the current staffing crisis and pressure on affordable housing? Some companies are stating that they have jobs to offer refugees, but will this disadvantage other potential applicants and could it be perceived as discrimination?

Gartner has identified the four key areas of risk for all organisations in the wake of the Russian invasion of Ukraine as talent, cyber security, financial and supply chain risks – but these four rapidly spiral out to touch on pretty much every organisational risk from physical security and health and safety (for example, via cyber attacks on physical plants or medical facilities) to escalating fraud, interest rate rises and power failures.

So many questions and, as yet, so few answers. Yet businesses must survive and they will need internal audit to help them make sense of risk and governance now more than ever. CAEs need to scan risks further afield and further ahead. They need to source reliable information in every place their business operates, and monitor the reactions across many sectors.

They should ask crucial questions about how agile their organisation can be and what choices it has if trouble strikes. A global pandemic has long been on the risk radar, and President Putin has spoken publicly about his views on Ukraine and the west for over ten years. These things were not wholly unpredictable.

As we learnt from Covid, organisations need deep tap roots that secure them even as the ground shifts around them. Strong governance and a well-understood, confident and supportive culture are crucial here.

When managers and staff have to respond quickly to emerging issues they need to know the business’s long-term goals and the behaviours and values most prized across the business and espoused by senior management. As we saw in the pandemic, if you ask people to take on extra responsibilities or respond to a crisis, you need to trust them and empower them – which, conversely, means setting clear controls and guidelines that are cultural, rather than detailed and prescriptive.

It is therefore not surprising that our new report on Cultivating a Healthy Culture has been picked up and circulated by the Financial Times and the Wall Street Journal and was the top item on the NEDonBoard newsletter. “Culture is a risk and is fundamental to the success of every organisation” it states, but 52.4% of respondents had not been asked by either the board or audit committee to provide reports on culture and/or inclusion, equality and diversity initiatives.

Internal audit should be driving organisational awareness of the critical role of culture and the way in which a strong culture underpins so many of the elements that make a business resilient
and strong in the face of constant disruption.

It is, of course, the people in an organisation who embody its culture and who, supported by the culture, are the repository of the business’s knowledge and skills and make the decisions that steer it through turbulent times. Internal auditors ensure that management has the assurance and controls it needs to make decisions and trust staff in times of crisis.

Our next publication is an overview of Human Capital, Diversity and Talent Management published jointly with the ECIIA and 11 institutes of internal audit across Europe. It looks at the challenges for organisations trying to attract and retain talent and how this is affecting internal audit teams and their businesses.

The year ahead will be bumpy. However, organisations that focus on their culture and on their people, and an internal audit function that supports management and provides insights into rapidly evolving risks, as well as the organisation’s ability to cope with these, are likely to prove more resilient.

The Chartered IIA will continue to provide guidance and support to internal auditors in all types of organisations. We are currently embarking on our Risk in Focus 2023 report and in June we will announce the winners of our Audit & Risk Awards, which showcase outstanding and innovative internal audit performance.

Meanwhile, our new Audit Committee Service will extend our support to those on audit committees, who must understand the role of internal audit and how they can best use and challenge this valuable resource. Internal auditors can, of course, find information, inspiration and advice on our community hub and forums, at our conferences and on our training courses. So as risks escalate and evolve at speed, use all the help the institute offers, collaborate with peers across sectors and ensure you are well informed and offering the best support to your organisation. Your work has never been more necessary. 

This article was first published in May 2022.