The pace of innovation - keeping up

Technological innovation has rapidly transformed our daily lives in ways that were previously unimaginable. And how does internal audit provide assurance over the risks that arise? 

Computing power has increased exponentially over the last 50 years, doubling every 18 to 24 months, as predicted by Moore’s Law, resulting in more advanced and smaller devices, the most recent popular culmination being the smartphone. 

Such advances are not only a convenience for end users, they represent a significant threat but also opportunity for businesses, depending on where they sit in the competitive landscape. For instance, Apple was the clear winner of its introduction of the iPhone, while Nokia, Motorola and Blackberry were the obvious losers. More than that, the widespread adoption of handheld internet-connected devices over the last ten years has had unforeseen consequences for a number of sectors.

For example, the taxi industry has been upended by Uber and this example of innovation would not have been possible without the widespread adoption of smartphones (although it is worth noting that the company's recent corporate governance and cultural missteps are arguably the product of its desire to rapidly disrupt the established taxi industry). Similarly, music industry revenues returned to growth in 2015 for the first time in 15 years, according to the International Federation of the Phonographic Industry, having lost 40% of aggregate sales. These losses are directly linked to innovation, namely increasingly fast internet connections combined with a rise in online piracy, the introduction of iTunes and other digital download services and, latterly, streaming platforms such as Spotify, which owe some of their popularity to the fact they can be used on the move with, once again, smartphones.

Smartphones are just one example of technology that has had a profound disruptive domino effect. Advances in computing power, big data analytics, artificial intelligence, machine learning, the Internet of Things, 3D printing and other technologies are already reshaping established industries in different ways. For instance, as discussed in our artificial intelligence briefing, autonomous driving is imminently expected to become commercially available, which will have a profound impact on sectors such as transport and logistics.

Organisations’ willingness and ability to successfully exploit such technologies will be one factor that determines which will thrive and which will decline and, in some cases, obsolesce.

The challenge for many large, well-established businesses is that they are often not positioned to innovate or disrupt in the same way that nimble start-ups are. Big businesses quite rightly dedicate much of their resources to managing the core business that has driven revenues to date. The aim is to minimise risk and maximise profits in the short term, be it on a quarterly or annual basis. At the same time, the risk management processes and controls that help global organisations to run smoothly and protect value can also make them risk-averse. Any organisational change that does occur is often measured and incremental by design, and consequently may lack the impact required to significantly disrupt.

By contrast, start-ups, which are at the other end of the scale, succeed because they take more risks than established businesses. It is in boldly moving into uncharted territory that these companies scale up apace and become the Amazons and Facebooks of today, forcing competitors out of the market. At the same time, anywhere between 50% and 80% (the data on this topic vary wildly) of start-ups fail for this very same reason.

Well-adapted risk management, however, can ensure that established businesses take on appropriate levels of risk to gain a competitive edge, and internal audit has a valuable role to play in assessing the effectiveness of these risk frameworks, as well as the efficacy of innovation projects and investments in achieving the organisation’s longer-term strategic goals.

Methods of innovation

Broadly, there are three ways in which organisations can innovate:

Build - Companies can invest in internal research and development (R&D) programmes that may lead to new products, patents and other intellectual property (IP) that can be commercialised.

Acquire - Companies can buy other businesses in order to access technology, IP and other assets that enhance their existing business or give them access to new markets.

Partner - The most forward-looking companies have more recently pursued open innovation strategies. By partnering with other businesses and their own customers, companies can crowdsource expertise, products and routes to market.

Building

Most, if not all, companies of scale have internal R&D programmes for the improvement of their existing products and operations, and the development of new products and processes. Ten years ago, the pharmaceuticals industry led R&D, but today the biggest investors are in the technology sector. Amazon spent an estimated $17.4bn on R&D in 2017, followed by Volkswagen, Alphabet (Google’s parent company), Intel and Samsung. One example of Amazon's expenditure is an undisclosed investment in a new R&D site at Cambridge University, where researchers will work on the development of its drone delivery effort, Prime Air, as well as its AI voice assistant, Alexa.

R&D expenditure does not necessarily equate to innovation and market disruption. Investment into research may result in the development of products or services that simply don't work or are not commercially viable, either because they don’t effectively meet customers’ or clients’ needs or because there is no business model to support their sale. For example, Prime Air may revolutionise the delivery of retail products; alternatively, consumers may prefer traditional postal delivery over having products parachuted into their gardens.

It is therefore vital that organisations have processes in place to manage their R&D investments and align them with longer-term strategic goals. Internal audit can add value in this respect, by seeking evidence that projects are effectively managed, that performance measurements are in place and working, that the organisation understands the purpose of the investments, and knows when to reduce or cut off funding for certain projects.

Dedicated R&D functions will typically have ownership of such investment, but experimentation should not necessarily be exclusive to such functions. For instance, Scott Cook, the CEO of Intuit, a software company with a $45bn market capitalisation, has stressed the importance of fostering a culture of experimentation. If an Intuit employee is passionate about an idea and wants to prove an assumption, they are allowed to run a fast and inexpensive experiment at short notice and report on what they have found. A culture of experimentation starts with senior management.

Acquiring

The fastest way for a company to exploit innovation is to identify another company that excels in a desired product category, technology or other domain and acquire it. Merger and acquisition (M&A) strategies are common and have increased in volume and value over time. In 2017, there were circa 50,600 M&A transactions globally, according to the Institute of Mergers, Acquisitions and Alliances, the highest number on record.

This is not to say that M&A is solely motivated by the desire to innovate and disrupt industries. In the majority of cases competitors with similar business models merge, the value being created from cost synergies and solidifying the acquirer’s market position.

Microsoft’s $26bn acquisition of B2B social media platform LinkedIn, two seemingly very different organisations, is an example of leveraging another company’s innovation and disruptive might. Microsoft has long been seen as innovation-shy. Having cornered the enterprise software market years ago with its Windows PC operating system and Office suite, there was no incentive to disrupt a market over which it held a de facto monopoly. In recent years it has successfully repositioned itself as a provider of cloud-based software on a subscription basis. Further to that aim, its LinkedIn acquisition gained Microsoft access to 433 million members’ data and it is now integrating the social platform into its sales software, Dynamics 365 for Sales.

M&A is an incredibly risky process, however, and various estimates put the failure rate of unrealised benefits at between 70% and 90%, according to the Harvard Business Review, with Microsoft having struggled to make a success of its Nokia acquisition in 2014 in a bid to crack the smartphone market. This is because the handsets developed by Microsoft and Nokia did not successfully compete against Apple and Samsung's devices. Reasons for M&A failure tend to be that management overestimates the benefits of the acquisition or the two companies do not integrate effectively, often because of cultural incompatibility.

Internal audit may play a role in the M&A strategy and process, for instance, by highlighting gaps in the integration project management plan or reporting on the efficacy of previous M&A and how these transactions impacted the internal controls structure of the organisation, or negatively affected other parts of the business in unforeseen ways.

Partnering

More recently corporates are looking outwards in order to innovate. There is a recognition that rather than competing with fast-moving competitors in multiple business areas, it can be beneficial to share resources. This may involve sourcing freely available knowledge to use in internal R&D, acquiring knowledge and IP through licensing arrangements or sharing knowhow on an outbound basis so that others can innovate, and the business can benefit indirectly from this external innovation at a later date. It may also involve running competitions that invite customers to submit their best ideas to be developed and potentially put into production.

One example of open innovation at work is GE Appliances FirstBuild co-creation space. The online forum and physical microfactory allows designers to rapidly prototype new home appliances, with the best ideas made available for purchase. This crowdsourcing model gives the company access to new ideas and designs, directly feeding into its product pipeline.

Such approaches are now common in Europe. Data from the Economist Intelligence Unit show that only 17% of businesses are entirely self-reliant for innovation. In the UK 89% of businesses have adopted open innovation either fully or to have opened up their innovation process to a limited number of partners. Further, 50% of European businesses have built a product or service using open data, 29% have published open data themselves, 49% have used an open application programming interface (API) from a third party in a product or service, while 37% have published their own open API.

Auditing innovation

However, a company chooses to innovate, it must be aligned with strategic imperatives. Internal and open initiatives need a large degree of autonomy so that ideas and experimentation are not stifled, but ultimately these developments need, whether directly or indirectly, to meet the longer-term goals of the organisation if they are to add value. This is where internal audit can assist the organisation.

First, internal audit should assess whether senior management thinking is informed by the potential disruption the organisation’s industry faces. For instance, how is the sector already being disrupted, how is it likely to be disrupted, and what is the organisation doing to respond to that? Is there an awareness at senior management level of the risks associated with failing to innovate? Where does the organisation see itself in ten years and to what extent is innovation enabling this and how?

After addressing these fundamental questions, internal audit can begin to look more specifically at innovation and R&D programmes and seek to answer the following:

• Is there a clearly defined innovation risk appetite agreed at the board and senior management level? Is this reflected in reality?
• Is the goal to innovate incrementally, i.e. by improving the existing business model or honing current product channels, or to truly disrupt the industry? Do the organisation’s innovation activities support the achievement of this goal?
• If the organisation aims to encourage innovation, is there a culture of experimentation within the organisation that allows for inevitable and necessary failure? Is the tone for this culture set from the top?
• Is there an inventory of innovation initiatives, including internal R&D, M&A and open innovation?
• Are value-adding projects prioritised and are performance measurements in place so that investment is not wasted on initiatives that are not delivering results? Does the R&D function act on past observations and lessons to optimise future projects?
• Is there an M&A strategy and does senior management understand the risks associated with failing to effectively integrate acquisitions and technology assets? What lessons have been learned from past M&A?
• If the organisation is harnessing open innovation, are the risks associated with sharing knowledge and opening up to third parties well understood? How are risks shared and managed among partners?