This document discusses how internal audit can increase its influence, relevance and value by focusing more on strategic risks and auditing an organization's strategy. It highlights that strategic risks account for most market value declines but internal audit departments only spend 6% of their time on strategic risks. The document provides examples of auditing an organization's strategy development and execution processes. It also describes Australia Post's experience enhancing strategic risk oversight through real-time project reviews and stakeholder surveys. The implications are that internal audit must expand beyond traditional financial and compliance roles to address strategic risks through building relationships and communication skills.

1. Internal Audit and
Organisational Strategy
Increasing the influence,
relevance and
value of Internal Audit
David Mallard

2. WHAT WE WILL SHARE
Topic
1 The impact of strategic risk
2 Are we doing enough?
3 Recent research into the profession
4 The standards
5 Three common strategy failure points
6 Auditing strategy development
7 Auditing strategy execution
8 The Australia Post experience
9 Saying it right
10 Insight over the journey
11 Implications of auditing strategy
12 Auditing strategy is only part of the story

3. THE IMPACT OF STRATEGIC RISK
Strategic risks pose a
much more significant
threat to companies
than more easily
auditable risk areas
Strategic risks cause
68% of severe market
capitalisation decline

4. ARE WE DOING ENOUGH?
Percentage of Risk Percentage of Time Spent
Strategic risks
Strategic risks Failures Leading to By Audit Departments on
account for 68%
account for 68% Significant Market these Risk types
of severe
of severe Decline Risk Categories
market declines
market declines
68%
68% 6%
6%
7%
7% 13%
13%
Audit
Audit
departments
departments 12%
12% 49%
49%
report spending
report spending
only 6% of their
only 6% of their
time auditing
time auditing
strategic risks
strategic risks 13%
13% 32%
32%

5. RECENT RESEARCH
To deliver real value,
To deliver real value,
audit plan’s must be
audit plan’s must be
responsive, flexible
responsive, flexible
and aligned with
and aligned with
company strategy
company strategy
61% of survey
61% of survey
respondents said
respondents said
Internal Audit did not
Internal Audit did not
have a mandate
have a mandate
aligned to business
aligned to business
strategy
strategy
Top Priority -- be more
Top Priority be more
relevant to achieving
relevant to achieving
the organisation’s
the organisation’s
objectives
objectives

6. RECENT RESEARCH
TOP PRIORITY?
BE MORE RELEVANT

7. INTERNATIONAL STANDARDS FOR THE
PROFESSIONAL PRACTICE OF INTERNAL
AUDITING OCTOBER 2012
2130. A1 – The internal audit activity must evaluate
the adequacy and effectiveness of controls in
responding to risks within the organisation’s
governance, operations, and information systems
regarding the:
1.Achievement of the organisation’s strategic
objectives
2...
3...

8. THREE COMMON STRATEGY
FAILURE POINTS
Flawed Business Assumptions: Management assumptions may not be
Flawed Business Assumptions: Management assumptions may not be
rigorously tested resulting in organisational objectives that are
rigorously tested resulting in organisational objectives that are
inconsistent with the enterprise’s capabilities or the realities of the
inconsistent with the enterprise’s capabilities or the realities of the
business environment.
business environment.
Business Unit Misalignment: Lack of communication or a strategy
Business Unit Misalignment: Lack of communication or a strategy
development framework for business units can result in business
development framework for business units can in business
unit objectives and operating plans that fail to align to enterprise
unit objectives and operating plans that fail to align to enterprise
objectives.
objectives.

9. AUDITING STRATEGY
DEVELOPMENT
1. Strategic Planning Process Audit: Review the
strategic planning process to ensure there is a
common framework for the development of
business unit strategic plans and assess the
alignment between business unit, department, and
corporate level strategic plans.
Does the company
Does the company Are enterprise
Are enterprise Are Business Unit
Are Business Unit Is there alignment
Is there alignment
have a documented
have a documented level strategic
level strategic objectives
objectives between
between
process for strategic
process for strategic objectives
objectives reasonably
reasonably enterprise and
enterprise and
planning? Has the
planning? Has the documented and
documented and related to
related to business level
business level
process been
process been measurable?
measurable? enterprise
enterprise strategies?
strategies?
complied with?
complied with? objectives?
objectives?

10. AUDITING STRATEGY
DEVELOPMENT
2. Audit of Assumptions: Identify and validate
assumptions about the internal and external
environment made at the enterprise, business unit,
and project level.
Are key assumptions
Are key assumptions Are key assumptions
Are key assumptions
underpinning the plan
underpinning the plan reasonable given all the
reasonable given all the
for achieving objectives
for achieving objectives evidence?
evidence?
documented?
documented?

11. AUDITING STRATEGY
DEVELOPMENT
What level of awareness
What level of awareness To what extent do
To what extent do Do incentives and/or
Do incentives and/or
do employees have in
do employees have in employees believe in
employees believe in performance criteria
performance criteria
the strategy?
the strategy? the strategy?
the strategy? link to strategic
link to strategic
objectives ?
objectives ?

12. AUDITING STRATEGY
DEVELOPMENT
4. Strategic Execution: Evaluate major initiatives at
critical points in the project lifecycle against key
factors of project success beyond execution and
timeline, such as leadership capability, business
readiness, sustainability and value investment.
Assess project
Assess project Identify talent
Identify talent Evaluate
Evaluate Identify gaps
Identify gaps
management
management or development
or development confidence levels
confidence levels between
between
capabilities and
capabilities and gaps to meet
gaps to meet in the successful
in the successful objectives and
objectives and
processes
processes execution goals
execution goals execution of
execution of strategy
strategy
strategy
strategy outcomes
outcomes

13. AUDITING STRATEGY
DEVELOPMENT
Test elements of strategy development and
communication in regular audit engagements to
provide ongoing monitoring of the strategic
planning process
Evaluations of strategy development and
communication can be incorporated into every
audit to monitor the effectiveness of strategy
deployment in between assessments of the
strategic planning process

14. AUDITING STRATEGY EXECUTION
My experience at Australia Post
My experience at Australia Post

15. AUDITING STRATEGY EXECUTION
Strategy Execution

16. AUDITING STRATEGY EXECUTION

17. AUDITING STRATEGY EXECUTION
Fortune Magazine famously
stated that organisations fail to
successfully implement
strategy, not because of bad
strategy, but because of bad
execution.
Failures are not for lack of a well-defined
strategy but due to the absence of a well-
orchestrated implementation plan
bridging the gap to execution.

18. AUDITING STRATEGY EXECUTION
‘Large Program’ Risk
‘Large Program’ Risk
is in the bottom
is in the bottom
quartile of ‘well
quartile of ‘well
managed’ risk
managed’ risk
82% of stakeholders
82% of stakeholders
regarded Internal
regarded Internal
Audit’s role as very
Audit’s role as very
important or
important or
important
important

19. AUDITING STRATEGY EXECUTION
- THE AUSTRALIA POST
EXPERIENCE
Regularly polled senior
Regularly polled senior
executives and Board
executives and Board
members about their
members about their
perception of Internal
perception of Internal
Audit – particularly
Audit – particularly
their sense of value
their sense of value
received from Audit
received from Audit

20. AUDITING STRATEGY EXECUTION
- THE AUSTRALIA POST
EXPERIENCE
Stakeholder
Stakeholder
feedback resulted in
feedback resulted in
the question:
the question:
How does Internal
How does Internal
Audit address
Audit address
strategic risk more
strategic risk more
effectively?
effectively?

21. AUDITING STRATEGY EXECUTION
- THE AUSTRALIA POST
EXPERIENCE
We viewed the organisation's strategic plan as
We viewed the organisation's strategic plan as
an inventory of organisational change
an inventory of organisational change
programs
programs
Ranked each program by importance to
Ranked each program by importance to
company objectives, complexity, scale etc
company objectives, complexity, scale etc
Diagnosed history of previous investments,
Diagnosed history of previous investments,
where they had struggled and/or been
where they had struggled and/or been
successful, and understood the organisational
successful, and understood the organisational
capability ‘soft spots’
capability ‘soft spots’

22. AUDITING STRATEGY EXECUTION
- THE AUSTRALIA POST
EXPERIENCE
• In-Flight – Real Time Assessment
• In-Flight – Real Time Assessment
 PIR’s not optimising limited Audit resources and
 PIR’s not optimising limited Audit resources and
unhelpful to operating the day to day business
unhelpful to operating the day to day business
• Rapid arms-length feedback – ‘contemporary
• Rapid arms-length feedback – ‘contemporary
assurance’ and actionable
assurance’ and actionable
• An Integral view – considered typical technical
• An Integral view – considered typical technical
issues in conjunction with humanistic elements
issues in conjunction with humanistic elements
– collective and individual
– collective and individual
• Relevant to objectives of stakeholders, both
• Relevant to objectives of stakeholders, both
organisationally and personally
organisationally and personally

23. AUDITING STRATEGY EXECUTION
- THE AUSTRALIA POST
EXPERIENCE
THE INTEGRAL FRAMEWORK
The Integral Framework makes clear
The Integral Framework makes clear
that every event or situation may be
that every event or situation may be
understood within the context of interior
understood within the context of interior
and exterior dimensions in both the
and exterior dimensions in both the
individual and the collective
individual and the collective
Regardless of the scope and depth of
Regardless of the scope and depth of
the organisational situation, by applying
the organisational situation, by applying
the Integral Framework, we are able to
the Integral Framework, we are able to
analyse and assess even the most
analyse and assess even the most
complex issues in a balanced and
complex issues in a balanced and
comprehensive manner.
comprehensive manner.
This holistic process is what makes
This holistic process is what makes
this approach so powerful and
this approach so powerful and
leading-edge
leading-edge

24. AUDITING STRATEGY EXECUTION
- THE AUSTRALIA POST
EXPERIENCE
Project Health A 360 O STRATEGIC PROJECT HEALTH CHECK REVIEW
Checks include
assessments
from multiple 1. Project Team Members
perspectives in
order to provide Direct participants in the
a balanced project team provide the
evaluation. inside view of the status
of project execution
2. Impacted Process
Designed to 4. Internal Audit Owners
deliver Future end users
‘contemporary Audit offers an provide an outsiders
assurance’ on in- independent appraisal of perspective on
flight strategic the project including its execution,
effect on the risk and 3. Management or other
project communication and
key stakeholders
implementation. control environment. sustainability.
Key members of the senior
management team provide
perspective on the value
contribution of the project.

25. AUDITING STRATEGY EXECUTION
- THE AUSTRALIA POST
EXPERIENCE

26. AUDITING STRATEGY EXECUTION
- THE AUSTRALIA POST
EXPERIENCE
 Online polling of
stakeholder
perceptions/confidence
levels horizontally and
vertically in the
organisation

27. AUDITING STRATEGY EXECUTION
- THE AUSTRALIA POST
EXPERIENCE
 Triangulate stakeholder
feedback - deep dive on the
‘hot spots’

28. AUDITING STRATEGY EXECUTION
- THE AUSTRALIA POST
EXPERIENCE
 Independent of
Project
Management Office
– leverage PMO’s
work

29. AUDITING STRATEGY EXECUTION
- THE AUSTRALIA POST
EXPERIENCE
KEY SUCCESS FACTORS ASSESSED:

30. AUDITING STRATEGY EXECUTION
- ‘SAYING IT RIGHT’

31. AUDITING STRATEGY EXECUTION
- ‘SAYING IT RIGHT’
Audit Headline Conclusion Is Here
Audit Headline Conclusion Is Here

32. AUDITING STRATEGY EXECUTION
- ‘SAYING IT RIGHT’

33. AUDITING STRATEGY EXECUTION
- INSIGHT OVER THE JOURNEY
EXAMPLE OF INFLUENCE, RELEVANCE AND VALUE

34. AUTOMATE THE PROCESS
- www.projectaudits.com

35. THE IMPLICATIONS OF
AUDITING STRATEGY
Strategic
Operational Strategic Risk
Expand
Skills
Operational
Risk
Compliance Traditional Audit Skills
Compliance
Risk
Enhance
Finance Engagement
Financial Risk

36. AUDITING STRATEGY IS ONLY
PART OF THE STORY
A focus on auditing
organisational strategy is very
important, however is only part
of the story to being influential,
relevant and more valuable

37. OPTIMISING TECHNICAL AND
RELATIONAL CAPACITY IS KEY
Requires
higher levels
of systems
and people
thinking
EQ is twice as
important as
technical
competence *
• D. Goleman, Emotional Intelligence: Why It Can Matter More Than IQ (Bantam Books, 1995)

38. INTEGRATING THE TECHNICAL
WITH THE CREATIVE

39. EVELOPMENT RESEARCH
Creative and
Relationship
Attributes
Task and Reactive
Attributes - often
perceived as
where Internal
Audit lives

40. EVELOPMENT RESEARCH
There is a high correlation between personal development maturity, creative
leadership behaviours and downstream leadership effectiveness, particularly in
dealing with ambiguity & complexity and resultant organisational performance.

41. CONCLUSION
For Internal Auditors to be
perceived as relevant, influential
and valuable we must focus on
strategic risks in our
organisations.
At the same time we must ensure
that we build our relationship and
communication capacity in the
service of our customers.
Talk to me about how I may be
able to can help you and your
team.

42. www.projectaudits.com
david@davidmallard.co