What did IntegraFin do to win the Audit & Risk Award for Outstanding Team Financial Services in 2024?
In 2022 IntegraFin’s new Group Head of Internal Audit was given a remit to advance the internal audit function to a full-service, highly valued, modern third line. Its success and extent of evolution, in just under two years, was judged as excellent and led to it winning the 2024 Audit & Risk Award for Outstanding Team – Financial Services. How did it do it?
It's easy to assume that all financial services companies have well-resourced internal audit teams, with healthy financial budgets, and clearly demarcated three lines. This facilitates continual development, attracts talent and creates freedom to experiment with technology and audit projects. Many do, but IntegraFin Holdings plc, holding company of UK investment platform Transact, is a FTSE 250 firm that had many challenges to navigate: a small less-experienced in-house internal audit team, modest budgets, blurred lines of risk governance, and a long-standing senior management team that was used to internal audit maintaining a low profile.
Until 2022, the team consisted of just three audit staff, who typically focused only on providing essential assurance to the Group’s Audit and Risk Committees. While it met its regulatory requirements and an EQA in 2021 found that it conformed with the 2017 Standards, it was time to change if the function was to avoid complacency or irrelevancy.
This was the situation when Rav Purewal took on the role of Group Head of Internal Audit in 2022 after roles in large internal audit teams in insurance and asset management. He arrived with an immediate plan to establish an aspirational strategy to develop the team and demonstrate to senior management the quality of the services and advice internal audit can provide if performed with an ambitious and continuous improvement mindset.
Following discussions with senior stakeholders, he identified what mattered most and what needed to be done. He established a clear vision to “champion continuous improvement in a pragmatic, collaborative and constructive way, driving positive business change and creating value”. This encapsulated key behaviours that he believed were crucial to success, focusing on practical solutions, working well with others and offering timely advice to improve controls against strategic objectives.
“I brought in a new strategy and vision because the audit and risk committee chairs wanted internal audit to extend its boundaries and produce more insights with a fresh approach. They said ‘the work internal audit provides us is critical – show us what you can do and where you can take this function’,” he explains. “One big thing was to change the perception of what internal audit is – I needed to show the business the value that a passionate and enthusiastic internal audit team can bring, and that this is much more than conforming to regulations and standards."
A new vision
The new vision was underpinned by three main components comprising 25 actions.
The first was execution – how could work be done better. This included: revamped, shorter and more visual reports; more focused audit and risk committee reports; dynamic audit plans that were connected to the Group’s risks and strategic objectives; agile audit techniques to boost efficiency; embedded data analytics throughout the internal audit process; and the development of the Group’s first assurance map to identify gaps and improve coordination across the three lines.
The second was quality – doing work well consistently. Changes included establishing frequent stakeholder meetings to gather better intelligence, and enhancing and refreshing audit methodology. This covered every aspect of internal audit practices, but examples included aligning with the group’s risk assessment rating methodology, identifying root causes more specifically, broadening culture considerations, refreshing key performance indicators, introducing risk-based validation for management actions, and commencing more measurable and insightful feedback processes.
The third component concerned people and talent. Having the right people to carry out work was critical to Purewal’s aims. He hired a new Senior Audit Manager and IT Audit Manager to add to the existing team, and established a 12-month programme for secondees from the business to embed deeper knowledge from the first and second lines.
“Hiring an experienced Senior Internal Audit Manager to focus on the quality of our work allowed me to focus on our strategy, vision and methodology. I could be more active during executive committee meetings, listening and talking to the business and helping to manage real challenges through assurance,” he says. “It made sense to have a dedicated IT Audit Manager, given that our core business is a tech platform and the prevalence of tech-related risks we are all exposed to.”
It wasn’t all plain sailing. The first advert for secondments attracted no applicants. “People still didn’t know enough about what we did. The feedback showed that many potential applicants thought the role was only for mathematical or analytical people,” Purewal recalls. He went on a charm offensive, talking to departmental heads and explaining the benefits they would get from having people who understood internal audit better. He asked them to approach possible volunteers and explained the broad range of skills needed.
It worked. “We’re now on the third round of secondments and word has spread so we get plenty of applicants. Some want to join our team permanently – we don’t have vacancies for them all and it’s important to pass on the expertise they learn, but it’s good to know,” he says. “They gain new experience and space to think about what the business does, why it does it that way, and how it works. One of our secondees has since moved into a first-line risk and control role because of his experience with us and another subsequently embarked on the CIA exams.”
In turn, they bring important skills into the internal audit team. They are good at talking to people and having tough conversations, he adds. This complements the skills of the internal auditors, who have strong technical auditing skills, but are less confident using interpersonal skills to present their opinions.
“Our secondees are brilliant at close-out meetings and delivering difficult messages and this is a huge learning opportunity for us, especially given the new requirement to act with courage in the Global Standards,” Purewal says.
Another focus was to train and develop existing team members. Purewal strongly believes everyone should aim to master their trade. “It provides fulfilment and purpose and enables you to enjoy the work you do more. In a small team, all members need to be high-calibre and confident independent auditors with broad skillsets.”
A competency assessment tool helped to tailor individual learning plans and set personal objectives and the team established a knowledge library for reference. Everyone in the team can schedule personal growth days each month to encourage them to undertake self-development. Team members present their new learning and how they plan to apply it in weekly meetings to counteract the “forgetting curve”, which shows that 75% of information is generally forgotten after six days. "We never ignore the fundamentals of good internal auditing, continually developing core audit skills,” he adds.
Confidence and self-belief
One of the biggest challenges was to instil the confidence that team members needed to provide more direct opinions. This is now an essential part of the job.
“You can put a better methodology in place and improve practices, but how do you transform people into independent thinkers with the confidence to do things themselves and defend unpopular opinions?” Purewal asks.
To achieve this, he adapted his own behaviour and began to intervene less. Instead of reading reports and making changes and suggestions, he now asks questions, provides guidance and leaves it to the team member to work out what needs to change.
“I want everyone in the team to feel confident about what they find and the more I question whether they think the scope is right, or the recommendation is actionable, or whether they can think of any way to improve the test or report, the better they become,” he says. “People in the business now ask to talk to one of the team, not always to me. They know anyone here can answer their questions and provide great advice.”
Because it’s a small team, he can also ensure that all the auditors meet senior business managers and non-executive directors. He wants everyone in the team to have the confidence and experience to develop their careers, but also knows this is an attraction for future job applicants.
“We may not have a globally recognised name, the biggest, swankiest office or the poshest coffee in the FS sector, but what I can promise any applicant to our team is dedication to self-development and real personal growth, lots of exposure and opportunities and some great fun along the way,” he says. “Even the most junior member in my team speaks to our C-suite regularly and has met many members of the audit and risk committees. People write better reports if they have experience talking to the people who read them – they learn what their jobs are like and what they need to know from us.”
The awards
Winning the Audit & Risk Award for Outstanding Team, Financial Services, was a huge boost to self-belief, as well as promoting the team’s reputation in the wider business,” Purewal says. They knew they had done fantastic work, but were not sure whether a small team stood a chance against the largest FS firms.
“Making the shortlist, in the company of well-known internal audit teams, was great. To actually win was amazing,” he says. “The award proved that people believe we’re great at what we do and we add value. I saw a further increase in confidence after the awards, and it showed the CEO, audit and risk committees and EXCO that we are doing well.”
The future
Purewal is currently working on the team’s next three-year strategy. “We’re already good at data analytics, but I would like us to lead the way further on this in the business, especially on use cases for AI,” he says. “We constantly challenge each other and our practices in the team, so we will find great uses for AI in and out of internal audit over the next year or so."
A second initiative is to provide deeper insights on culture – including tone from the top, decision making and how it is embedded throughout the business, customer focus and behaviours at every level. “This will take us into more complex areas and will require more advanced internal audit work, especially around testing, forming opinions and delivering sensitive messages,” he says.
There is also an ongoing project to increase coordination across the three lines. Purewal believes they do this well, “but we could improve the way we coordinate with other assurance providers in the Group and the way we use other lines’ work in audits. We’re currently sharing what we do and helping to spread best practice. It’s relatively easy to create an assurance map, but harder to be confident using assurance provided by other teams. As the risk landscape evolves, it’s vital that we make the best use of all sources of assurance.”
Internal audit budgets will always be closely monitored and it’s hard to specify exactly when benefits will materialise, or to put a value on what management will receive. Too much success can actually weaken arguments for more, he adds, half joking. “If I asked for £50,000 investment now, senior management could say to me, but you’re already an award-winning team. What can you do with more money?”