Linking Internal Audit to Business Strategy

Summary:

In this episode of The Corporate Director Podcast, Sherry Williams, Chief Audit Executive, and Don Bouffard, Audit Committee Chair at Amalgamated Bank give us insight into how internal audit can serve as an important link between business operations and strategy.

In This Episode:

1. Inside an Audit Background: Williams discusses her audit background and how it prepared her for her current role. Bouffard gives his take on the need to move audit functions in-house.
2. The Internal Audit Evolution: Williams and Bouffard share their opinion on the changing landscape of internal audit as it connects to regulatory changes.
3. Internal Audit and the Board: Both guests talk about the role of internal audit in boardroom conversations and strategy.

Inside an Audit Background

Williams gives some background on her own career: “I’ve been the Chief Audit Executive at Amalgamated Bank for three years now. I joined with over 30 years of experience in financial services and in the IT domain, focusing on IT audit, risk, operations and financial audit. I’ve also spent some time teaching accounting and information systems at the undergraduate level in college.”

She continues: “The experience that I bring as both an external and internal auditor really helps the bank on its growth journey. My reporting structure is directly to the audit committee of the board with a dotted line to the CEO so that I can advise them on the areas that are of greatest concern. Frankly, that’s my primary role.”

Bouffard then provides some backstory: “When I joined the Amalgamated Bank board in 2012, the internal audit function was completely outsourced to a CPA firm. The bank had one staff person who committed about 1,200 hours a year to internal audit, spending most of his time doing branch audits around the bank. After three years, we decided that it would be a good idea to bring a function in-house. We hired a Chief Audit Executive, and he hired some staff who continued to use Crow for subject matter expertise.”

He provides the reason for this shift: “The bank wanted to grow. We were trying to think strategically about how the internal audit could bridge the gap between the assurance function and more of an advisory role.” Enter Williams: “Sherry is very much a strategic thinker. She has been able to provide the advisory services we wanted, and she’s able to show the management team the real value of internal audit, above and beyond the old paradigm of just being an assurance function. It’s been rewarding to see that happen.”

The Internal Audit Evolution

Williams shares her opinion on the how the internal audit role is evolving: “Over the last two years in particular, the velocity of change in both the industry and at the bank has been so significant that we can no longer ignore the imperative for internal audit. Recognizing that the traditional model that we discussed, which was primarily focused on assurance, needed to be supplemented with more of the forward-looking advisory role became abundantly clear.”

She continues: “The model for successful internal audit functions suggest that the value proposition really begins with input to strategy. That’s what we’re talking about here, how internal audit can better inform strategy. So upfront, audit needs to have a seat at the table when executive management is in the process of developing that strategy by providing input to strategic direction and staying abreast of any changes in the risks. Of course, that includes regulatory and control developments as well as environment considerations for the industry. The key there is we’re able to do that upfront where the benefit is greatest and the cost is least. Historically, providing that rear view mirror angle is costly overall and of little value at that point in the process.”

Bouffard adds: “There are so many more demands on companies today outside of their normal business routine, things like climate change, diversity, data privacy, and more. Particularly for public companies, there are many watchdog agencies keeping an eye. Therefore, it’s up to internal audit to keep pace with that and make sure that the data we put out to the public is correct. That’s another evolution that we’re going to see in internal audit. How do we audit those things? Just a couple of weeks ago, I participated at a conference in AICPA, ESG recording. I was blown away at what these watchdog agencies are looking for now. It has the potential to put an intense burden on the board, on management, on internal audit, and throughout the company.”

“The goal of a Chief Audit Executive is to provide both assurance and advisory services. Historically, it’s been very much focused on assurance. But I think one of the things that we’ve been able to do and continue to try to do is carve out more of our time in commitment to advising management (where possible) while remaining independent.” - Sherry Williams, Chief Audit Executive, Amalgamated Bank

Internal Audit and the Board

Williams gives her opinion on why internal audit needs to have a seat at the board level given the evolution in audit’s role: “There’s a persistent lack of understanding about internal audit’s value proposition in certain circles. Audit teams often has to fight to justify their existence, rather than being viewed as the knowledge basis that can contribute to the organization’s risk management and ultimately, to the bottom line. That feeds into a general lack of investment in audit teams historically, resulting in a lack of tools and talent which make their jobs more efficient.”

Bouffard chimes in: “The barriers at the board level or the senior management level is where these problems start. If you don’t have a board or a CEO who sees the value proposition and is willing to translate that insight to his/her management team, then internal audit is going to struggle.”

Williams build on that barrier: “One of the better models to address that gap is establishing a mini colony industry that I call 1B function. That is a team of risk professionals who are distributed to the first line to ensure that controls are properly identified, risk is properly mitigated, and then they’ll have the dotted line reporting structure to the second line. That way, you know it’s there in the first line, and you’re able to evaluate and ultimately, the third line can get some reliance in that model.”

Bouffard goes on: “Internal audit in general needs exposure to the board. I try to make sure that Sherry can present reports to the applicable committee of the board so that they understand the value that internal auditors bring.”

Williams advises her fellow Chief Audit Officers on how to strengthen their relationship with the board and other strategy-setters: “It’s really important for me to fully understand our audience, and that audience is the board of directors. To the extent, the better we understand the expectations of the board and their perspectives, the better we can deliver. It’s also vital for Chief Auditing Executives to have their finger on the pulse of their talent. We must understand what each of our team members is looking for in their careers, how we can offer it, how we can help develop it, or frankly, encourage and support them of any desires they may have in terms of their careers. It’s critical for the effectiveness of the team, and it ultimately factors in to how well we perform as Chief Auditors.”

“Clearly, we serve the bank’s board of directors. I would encourage my fellow Chief Audit Executives to do the same. It is a point where I try to drive home to my team, when I’m preparing reports and encouraging them to think about the audience.” -Sherry Williams, Chief Audit Executive, Amalgamated Bank

Also in this episode…

Bouffard and Williams predict what will be the biggest differences between boardrooms today and in the future: “In the next 1-3 years,” says Bouffard, “I believe that expertise around climate change, diversity, and data privacy will have to sit in the boardroom.”

Sherry adds: “I’d like to see more of a real-time flow of information that the board finds most important. In other words, they’ll have it at the palm of their hands, even more easily than they do now.”