Change management in Internal Audit Change management in Internal Audit

Faced with an increasingly competitive environment, the banking sector is currently being forced to adapt their business models and product mix in order to meet evolving customer demand. Therefore, Internal Audit (IA) functions of European banks are similarly impacted by such business changes – they must continue to work hard to maintain their audit quality, recruit and retain skilled staff, monitor risks and respond to on-site inspections. As a result, change management is becoming an increasingly core skill for Heads of IA.

The IA functions of European banks find themselves in an increasingly prominent - and pressurised - situation. IA teams face challenges from supervisory scrutiny, the rapid evolution of technology and the difficulty in adapting to the changing product offerings by banks driven by shifting commercial demands.

It was against this background that KMPG ECB Office recently hosted its second European Internal Audit roundtable. These events aim to provide Heads of IA with a forum in which to share the challenges facing their functions, and to discuss potential strategies or solutions in response to this changing environment.

On this occasion, the key challenges discussed included the scarcity of talent, the pressure for cost effectiveness, the intensity of supervision by the ECB and national authorities, and new risks emerging from innovation and digitalisation. The debate centred on the following four themes:

• The need to maintain a strong third line of defence at a time of increasingly agile development. In an environment of competition with Fintechs, the commercial need for banks to innovate and bring new concepts to market quickly is posing challenges for IA functions. Ideally, IA teams should be involved throughout any initiative's development process, from design right through to implementation - enabling them to raise concerns when required and contribute to efficient pre-approval. Even so, IA teams still need to give robust, independent opinions on deliverables once a project is completed. These two imperatives are becoming increasingly hard to reconcile.
• The problems of recruitment and retention. Achieving the desired size and skills of IA teams is a major challenge for Heads of IA. Joint supervisory teams (JSTs) are increasingly focused on the human resources of IA functions, and some are seeking to enforce a suggested ECB target for IA staff to account for 1% of institutional headcount  - a target that many banks may find difficult to achieve. More specifically, the need for technology-skilled IA staff is another major challenge, given the difficulty of recruiting and retaining experts in areas such as cyber security, modelling and data analytics in the current market.
• The increasing intensity of on-site inspections. JST's on-site inspections of IA functions are becoming increasingly demanding. Some deep dives on internal audit have even seen JSTs requesting details of the skills, education and training of individual IA staff members.
• The growing use of, and supervisory emphasis on outsourcing. Banks are under pressure to modernise their core IT infrastructure in order to reduce costs, meaning that more banks than ever are outsourcing elements of their operations to third party providers. This presents a number of IA challenges, and many banks now run Supplier Assurance teams within their IA function. When it comes to meeting contractual provisions on whose responsibility it is to audit external service providers, Heads of IA often feel that the first and second lines of defence should take the lead. However, they also agree that IA teams must be prepared to review their work when required, to dig deeper into material risks and to respond to specific requests from JSTs.

Overall, the message is clear. Despite the challenges of recruitment and resourcing, the ECB expects more rigorous and intense remediation of their findings. In short, IA functions are facing greater challenges than ever when it comes to balancing the competing requirements of maintaining a diligent third line of defence, responding to supervisory remediation demands, as well as retaining enough talent to perform all these activities. Change management and strategic thinking are becoming vital disciplines for Heads of IA.