The changing face of audit

As more companies operate across the globe, like ANZ in 33 countries, it is crucial that internal audit staff can deal with different regulatory regimes and cultures and be agile in their approach.

Audit functions have global reach – they work across the longitude and latitude of any organisation. There are opportunities for the business to exploit this advantage and use audit functions to help them drive better outcomes – for staff, customers, shareholders and all stakeholders. 

Unlocking the benefits of sound risk-management practices has seen businesses reap rewards that may have previously been untapped. Having a sound risk culture is fast becoming ‘just the way we do things’. 

Senior leaders who can talk to and live these principles and most importantly those who are engaged in the process set the right example for their teams. 

ANZ Executive and Senior Management understand this and actively promote it. At ANZ, while the internal audit function’s reporting line has always been directly to the Chair of the Audit Committee, internally it is directly into the Group CEO. The impact this has had culturally in terms of promoting the importance of being well-controlled cannot be underestimated. 

While internal audit may not yet have fully mastered the croon of Perry Como, they are well on track. If the business knows how to work with the function correctly, auditors can create win/win for them and the organisation. By embracing the ethos of the song, there can be much greater confidence when it comes to running a well-managed bank, everyone is in tune.

At ANZ, there are the three key ways internal audit is changing and how business and staff can benefit.

• Rewarding managers
  
  

Traditionally internal audit has been seen as a reactive function: a problem emerges, audit is called in and then the spotlight is cast on defensive managers who dread long audit workouts.

Being told you are going to be audited can often be a manager’s worst nightmare. But what if the audit created an opportunity that allowed managers to showcase their knowledge of their business and the quality of their actions through self-disclosure, and reward them accordingly? That would be a game changer.

Leading internal auditors are educating business managers about the type of issues that need to be put on the table early so they can demonstrate that they own those issues and are addressing their remediation in a timely manner.

At ANZ the percentage of self-disclosures has grown each year from five per cent a few years ago, to over 40 per cent today. Concurrently there has been a significant improvement in timely remediation of audit issues. Long-outstanding audit issues are a thing of the past.

This means the function can spend more time helping the business fix issues rather than expending energy on identification. Through getting the business to become more self-aware the unit cost of an audit to ANZ has reduced, as has the investment of time required of the business during the audit process, while simultaneously improving the control environment.

Importantly this cultural change has been driven by the increasing prominence given to the audit rating applied to management awareness and action. This has been a very effective way of rewarding those who demonstrate that they are not only aware of the issues but are addressing them in a timely manner, not only in their business but often organisation wide. It has also proven a valuable tool in preparation of business cases.

This approach speaks volumes for how ANZ values corporate assurance and their understanding of the importance of business-led risk management practices.

• Getting it right – accentuating the positive
  
  

The emphasis on doing the right thing is an important message across any organisation and echoes loudly throughout the ANZ corridors. 

‘Tone from the top’ is rightly talked about as being a key ingredient to developing a good culture. However ‘tone from the middle’ is where the rubber hits the road.

Internal Audit teams spend 80 per cent of their time interacting with middle managers and their teams. The people doing the doing have to want to do the right thing too. The best way to make this happen is to upskill staff – within audit.

Seconding people into audit means they not only get the opportunity to upskill on risk and control management but the opportunity to work across the entire bank, work in different teams and businesses practically on a monthly basis and the ability to interact with senior stakeholders across the bank. Think about it. Where else does that opportunity exist? The staff can then take these skills back to the business and become ambassadors for a strong risk culture management as well as share what they have learnt.  

In some global financial institutions it is mandatory for high-performing staff to spend time in audit before proceeding to senior roles. The experience is held in very high regard and used almost as an accreditation tool which enables staff with high potential to fast-track through the ranks of the organisation.

At ANZ, the Generalist Banker Program, which is developing the future leaders of the bank, requires that participants spend at least 18 months in audit. This has proven very successful not only in fast-tracking their knowledge of the bank but in equipping them with the ability to quickly risk assess businesses and determine where to focus their energies.

• The value in looking ahead
  
  

The world is moving at a fast pace. The merry-go-round isn’t stopping and the roller-coaster dips are getting deeper and more frequent. 

In order to better prepare for those dips and fast corners, internal auditors need to prepare in advance and take an extended view into the future. There’s no point looking back at the fast corner we just skidded round and applauding our fine judgement skills if there is an even tighter corner immediately ahead.

The past is history and the danger lies in the future and these days the future is coming at us with accelerating speed. Internal Audit increasingly has a role to play in helping businesses anticipate the future and manoeuvre through the ongoing challenges. 

In a global business like ANZ, what works well is just as important as what doesn’t. Internal Audit is spending more time assessing and analysing what worked well, and then sharing that with businesses.

Being a truly global function provides rich picking for best practice examples which can become embedded in the culture, if they are shared. Someone, somewhere will probably have already tackled your problem and the likelihood is that audit will have come across this, so why reinvent the wheel? 

With all the best intentions in the world, sometimes people just need to know and see ‘what good looks like’. Making a point of sharing good practices is a necessity – it’s not optional.

Internal audit functions traditionally have spent the bulk of their time looking back at what has already happened. This is changing. Audit increasingly has a role to play in helping businesses manoeuvre and find a way through future challenges. It’s about anticipating and looking forward to avoid major bumps in the road. After all, no one wants to be caught out by nasty surprises. 

No going back

The dreaded call from audit is a thing of the past. It is an opportunity to engage early, to validate their view of their business, to highlight the actions they are taking and to prepare their businesses for challenges yet to come. 

Internal audit has gone from being the arm wrestler that comes in late in the action to a function with a forward looking wide-angle lens who is involved upfront. The traditional role of the auditor has changed. 

The function is fast becoming an incubator for future talent of the bank, helping to develop the best and brightest future leaders in the organisation, and instilling them with the right behavioural and cultural values that are vital in protecting the reputation and integrity of the bank.

Michael Liarakos is Group General Manager Global Internal Audit at ANZ.