Auditing your organisation’s strategy and
strategic plans
22 July 2014
Martin Robinson, IIA
Dr Keith Blacker, Non-executive Director and Independent Consultant
Papiya Chatterjee, Senior Policy Officer, IIA
Agenda
13:00-14:00
Registration and buffet lunch
14:00-14:10
Welcome and introduction
14:10-15:00
Auditing your organisation’s strategy and strategic plans
15:00-15:15
Q&A
15:15-15:30
Tea break
15:30-15:45
Update on IIA policy and technical issues
15:45-16:25
Facilitated discussion
16:25-16:30
Feedback, summary and close
Heads of Internal Audit
Auditing Organisation’s
Strategy
& Strategic Plans
Keith Blacker (blacker.keith@btinternet.com)
22nd July 2014
Background Information
•
•
Chartered Accountant - 30 + years in insurance/financial services
MBA & DBA (Henley Management College) – operational risk management in
UK retail banks
previously
• Simplyhealth (Health Insurance) …… Finance Director
• Carivita (Bancassurance), Italy …… Operations Director
• LloydsTSB …… various roles
• Former Chairman IIA UK Council member
currently
• Chairman of an IFA business
• Chairman of a Health & Leisure business
• Consultant and Trainer
plus
• “People Risk Management’ (March 2015) co-authored with Pat McConnell
• “Strategic Risk Management: A Tale of Two Strategies”
https://www.novapublishers.com/catalog/product_info.php?products_id=50282
HIA 22/7/2014
Auditing Organisationa's Strategy & Strategic Plans
Slide 4
Agenda
•
The basics of strategy
•
Why is auditing strategy so difficult?
•
Case studies in strategic errors
•
Providing assurance (providing advice?)
HIA 22/7/2014
Auditing Organisationa's Strategy & Strategic Plans
Slide 5
The Basics of Strategy
HIA 22/7/2014
Auditing Organisationa's Strategy & Strategic Plans
Slide 6
Strategy versus Tactics?
“Strategy is buying a fine bottle of wine when you take a lady
out for dinner. Tactics is getting her to drink it.”
Frank Muir
HIA 22/7/2014
Auditing Organisationa's Strategy & Strategic Plans
Slide 7
Strategy Definition
“The direction and scope of an organisation over the long-term”
Johnson & Scholes (2002)
“The setting of long-term goals and objectives, the determination
of a course of action, and the allocation of resources to achieve
the objectives”
Alfred Chandler (1962)
HIA 22/7/2014
Auditing Organisationa's Strategy & Strategic Plans
Slide 8
Strategy is about:
• Moving the organisation from where it is now (markets, products, services,
etc..) to where it wants to be (markets, products, services, etc..)
• Being better than the competition
• Being aware of the environment around you
• Obtaining and allocating resources
• Satisfying stakeholder needs
• Taking risks……and managing (strategic) risks……within the risk
HIAappetite
22/7/2014
Auditing Organisationa's Strategy & Strategic Plans
Slide 9
Strategy is about:
• Strategy Development
The analysis stage which provides background information which will enable
decisions to be taken on what the strategy and strategic objectives will be and
the plans and actions that need to be in place to make it happen
• Strategy Execution
Making it happen
HIA 22/7/2014
Auditing Organisationa's Strategy & Strategic Plans
Slide 10
The role of the Board
“Reviewing and guiding corporate strategy, major plans of
action, risk policy, annual budgets and business plans; setting
performance objectives; monitoring implementation and
corporate performance; and overseeing major capital
expenditures, acquisitions and divestitures”
OECD (2004)
HIA 22/7/2014
Auditing Organisationa's Strategy & Strategic Plans
Slide 11
The role of the Board
“The Board has overall responsibility for the bank, including
approving and overseeing the implementation of the
bank’s strategic objectives, risk strategy, corporate
goverance, and coporate values……. Approve and monitor
the overall business strategy of the bank taking into account
the bank’s long term financial interests…..”
Basel (2010)
HIA 22/7/2014
Auditing Organisationa's Strategy & Strategic Plans
Slide 12
The role of the Board
“Reviewing and guiding corporate strategy, major plans of
action, risk policy, annual budgets and business plans; setting
performance objectives; monitoring implementation and
corporate performance; and overseeing major capital
expenditures, acquisitions and divestitures”
OECD (2004)
HIA 22/7/2014
Auditing Organisationa's Strategy & Strategic Plans
Slide 13
The role of the Board
“The Board determines the strategic direction, governance
culture, risk appetite and procedures, which are designed to
generate a return for the owners, while ensuring prudence at
all times”
Nyberg (2011)
HIA 22/7/2014
Auditing Organisationa's Strategy & Strategic Plans
Slide 14
The role of the Board
So the Board is responsible for……….
• ……. determining and directing strategy
• ……. guiding strategy
• ……. approving strategy
• ……. reviewing and monitoring strategy
……… in practice much of this is delegated
But there is a still a real risk of a conflict of interest
HIA 22/7/2014
Auditing Organisationa's Strategy & Strategic Plans
Slide 15
The strategic planning process … at a glance
Values
Vision/
Mission/
Purpose
BOARD
LEADERSHIP
Internal/externa
l analysis
Strategic
direction
Strategic
objective
s
Annual
budget
Performance
related
reward
Performance
management
HIA 22/7/2014
Business
plans
BU/personal
objectives
Delegation
Auditing Organisationa's Strategy & Strategic Plans
Communicatio
n
Slide 16
Why is Auditing Strategy so Difficult?
HIA 22/7/2014
Auditing Organisationa's Strategy & Strategic Plans
Slide 17
The difficulties of planning
“You can’t predict anymore but that doesn’t matter; what’s
important is you must be able to adapt and exploit - be agile
enough to guess where the value is going and position
yourself to exploit it.”
Jack Welch
HIA 22/7/2014
Auditing Organisationa's Strategy & Strategic Plans
Slide 18
The Internal Audit dimension
Board
Strategic
matters
Management
Staff
HIA 22/7/2014
Operational
matters
Auditing Organisationa's Strategy & Strategic Plans
Area of
most
risk??
Audit
Comfort
Zone??
Slide 19
Potential Barriers
• Resistance from the Board/CEO
• That’s why we have NEDs
• Planning for planning’s sake – commitment to the plan?
• Do Internal Auditors have the right skill set?
• …….plus the conflict of interest
• …….and then there’s strategic risk
HIA 22/7/2014
Auditing Organisationa's Strategy & Strategic Plans
Slide 20
Strategic Risk
“Those threats and opportunities that materially affect the
ability of the organization to survive”
Allan & Beer (2006)
“The most fundamental of business risks – the risks associated
with an entity’s business model and how it wants to position
itself strategically”
APRA (2012)
HIA 22/7/2014
Auditing Organisationa's Strategy & Strategic Plans
Slide 21
Strategic Risk considerations
• Impact of the strategy
• Affect on resources (financial, human, etc..) properly assessed?
• Competitor reaction?
• Strategy development
• Overly aggressive objectives (or the opposite)
• Changing business environment
• Strategic positioning
• Supporting initiatives are poorly conceived
• Potential impact on culture not considered
• Strategy execution
• Poor ongoing risk management
• Insufficient (poor MIS) ongoing monitoring (particularly external
environment)
HIA 22/7/2014
Auditing Organisationa's Strategy & Strategic Plans
Slide 22
Case Studies in Strategic Errors
HIA 22/7/2014
Auditing Organisationa's Strategy & Strategic Plans
Slide 23
RBS
“It suits many people at or near the scene of the disaster to make the British end
of the financial crisis all about Fred Goodwin. Astonishingly, many who were
most intimately involved have barely featured in the coverage of the crisis, or
have been mentioned only fleetingly and gone on to continue their careers
quietly. But Fred Goodwin at RBS did not operate alone, like some deluded
young rogue City trader trying to make his first millions. Although his
monumental management errors and dud decisions produced an end result that
was catastrophic both for the bank he ran and for the rest of us, others shared
his ambitions and collaborated each and every step of the way”
“Iain Martin: Making it Happen”
• RBS ticked the strategic planning boxes but were too ambitious
• ABN Amro – “high strategy execution risk” (Strategy Director)
• But still went ahead – groupthink?
HIA 22/7/2014
Auditing Organisationa's Strategy & Strategic Plans
Slide 24
RIM
• Early 2000 – the Blackberry…. the must have gadget
• 2007 – 10 million users…. the undisputed leader
• 2007 – the Iphone arrived…. a new competitor on the block
• 2013 – acquired by one of its investors and broken up
• Technicians didn’t believe the Iphone was that good
• Blinded by success, didn’t see the looming changes in the
market
• Head in the sand, moved too late
HIA 22/7/2014
Auditing Organisationa's Strategy & Strategic Plans
Slide 25
Tesco
• 2007 – ‘ become a successful international retailer’
• 2007 – ‘Fresh and Easy’ chain, Southern California
• 2007 – sub-prime hit, not a good start
• 2008 – lost £62m, 2010 – lost £165m, 2012 – lost £153m
• 2013 – Fresh and Easy ‘simply did not offer the prospect of
acceptable returns in an appropriate time frame".
• Unexpected change in the external environment
• Reporting remained upbeat throughout, despite losses (top line
focus?)
22/7/2014
& Strategic
• HIARight
strategy, Auditing
poor Organisationa's
executionStrategy
– when
doPlans
you pull out? Slide 26
Providing assurance (providing advice?)
HIA 22/7/2014
Auditing Organisationa's Strategy & Strategic Plans
Slide 27
The role of Regulator
“Supervisors need to undertake a detailed analysis,
assessment and challenge of a firm’s business strategy, to
confirm that all risks had been identified and adequate
mitgation put in place. Where the Boards of high impact firms
could not demonstrate that they have adequately
considered risks when setting their strategy, supervisors
need to subject the firm to additional supervisory scrutiny and
challenge”
FSA (2011)
HIA 22/7/2014
Auditing Organisationa's Strategy & Strategic Plans
Slide 28
The role of Regulator…..or Auditor?
“Auditors need to undertake a detailed analysis,
assessment and challenge of a firm’s business strategy, to
confirm that all risks had been identified and adequate
mitgation put in place. Where the Boards of high impact firms
could not demonstrate that they have adequately
considered risks when setting their strategy, auditors need
to subject the firm to additional audit scrutiny and challenge”
HIA 22/7/2014
Auditing Organisationa's Strategy & Strategic Plans
Slide 29
Auditing strategy: a checklist approach
Strategy Development
• How much of your organisation’s strategy is driven by the
ambitions of your CEO?
• Who is involved in strategy development?
• When developing strategy and strategic objectives how weak
or strong are your organisations “street wise” instincts about
what is going on in your market? How good is your corporate
intelligence gathering?
• How realistic are the key assumptions about the ‘world’ that
underpin the strategy?
• How much scenario planning is done when selecting strategic
alternatives?
• How robust is the assessment of your organisation’s strategic
capacity (finance, people, infrastructure) and how will
capacity gaps be filled?
HIA 22/7/2014
Auditing Organisationa's Strategy & Strategic Plans
Slide 30
Auditing strategy: a checklist approach
Strategy Development
• Were there any dissenters about the strategic direction and what
were their concerns?
• What strategic alternatives were rejected and why?
• Are strategic objectives:
– Desirable…from the perspective of the shareholders of your
organisation
– Achievable…within the timeframe, costs, risk appetite
– Measurable
– Non-trivial…will make a real difference to your organisation
– Sustainable…long lasting but capable of being…
– Adaptable…if conditions change
• Etc…
HIA 22/7/2014
Auditing Organisationa's Strategy & Strategic Plans
Slide 31
Auditing strategy: a checklist approach
Strategy Execution
• Is the strategic plan long on analysis and short on capabilities
– all words, no action?
• Are all the Executive team committed to the details of the
strategy?
• How have strategic risks been identified, assessed and treated?
• Is the strategy (and underlying objectives) effectively
communicated throughout your organisation?
• Do failures of strategy in other organisations stimulate your
management into learning from that experience in relation to
your own organisation?
• Are budgets and incentive plans linked to the strategy?
• Does the strategy create a common sense of responsibility and
purpose?
22/7/2014
Auditing Organisationa's Strategy & Strategic Plans
Slide 32
• HIAEtc..
And a closing thought………
is your organisation like Columbus?
• When he left he didn’t know where he was going
• When he got there, he didn’t know where he was
• When he got back, he couldn’t tell where he had been!
……and yet Columbus had courage, vision and a sense of
destiny
HIA 22/7/2014
Auditing Organisationa's Strategy & Strategic Plans
Slide 33