Providing assurance on change programmes

Kami Nuttall, Associate Director

Agenda

• Why change?

• Root cause for change failure

• A look at strategy

• Providing assurance

Why change?

Change?

• Who do you want to change?

• What do you want to change?

• Where do you want to change?

• When do you want to change?

• Why do you want to change?

• How do you implement change?

The importance of change

• To respond to market pressures

• To maintain their market position

• To respond to changes in competition

• To improve performance, quality, services and products

• To respond to external issues – for example, environmental or legislative.

Change is key to innovation

• Change is inevitable and necessary for organisations to survive and prosper • Adaptive and ‘future proofing’

• Change at strategic level • Transformation of culture, behaviours and values

• Change at operational level • Projects, systems and processes

Root cause for change failure

Root cause of change failure

• Why do change initiatives fail?

• What are the consequences of failure?

• LEGO began, in 1916 and in the century which followed, LEGO transitioned from family leadership to external leaders, and found itself in need of a turnaround.

• In part the reason for the turnaround relates to the business moving too far from the core values which it had built up since the inception of the firm.

Lego (1/3)

Lego (2/3)

The core values are: The challenge

• The number of LEGO-branded items grew during the 1990’s, but sales did not, and in 1998 the company suffered its first financial loss. The top-line growth was slowing down but LEGO costs were accelerating, so they were starting to lose some significant money.

• Very high quality products

• Cautious, slow, steady growth

• Focus on narrow, interchangeable product set

• Informed innovation, not unconstrained creativity

Lego (3/3)

Poul Plougmann (A turnaround expert) was hired to reassemble

LEGO and staunch losses. He did things by the book. He laid

workers off, he streamlined some things, he globalized. Yet the

financial picture grew worse. He was basically going by the

turnaround book, but it didn’t work.

This was because he hadn’t understood the core values and

behaviours of the company’s original success and the company's

growing complexity was choking it. Adding more bricks made

products harder to assemble, forecasts harder to determine, and

inventory harder to manage. The multiplier effect of added

complexity went through the entire supply chain. There was

innovation but it was taking LEGO away from Core Values.

Why do change initiatives fail?

1. Strategy is unclear

2. Poor planning to support implementation

3. Ineffective governance arrangements

4. Failure to understand when operating outside of risk appetite

5. Failure to understand and mitigate risks

6. Failing to obtain buy in and commitment

7. A lack of real time, effective assurance

Consequences of failure

• Did not meet aspirations

• Spend $bn instead of $m

• Waste or inefficiency

• Low staff morale

• Loss of skillset

• Reputational damage with customers and regulators

• Change is not sustainable

• …..even a threat to the ongoing existence of the organisation

A look at strategy about change

What is the point of strategy when implementing change?

Desired outcome/ Future

Status quo/ Now

• To enable sustainable operationalisation of change

What is the purpose of a change strategy? To…

…define

target future

…define business case

…define a set of changes to realise target future

Push vs pull

• The push approach is predicated on the assumption that successful implementation is achieved through the execution of a series of steps – essentially, implementation of a pre-defined plan; where the completion of each step takes the organisation closer to its target state.

• The pull approach takes a different perspective and aims to create a context where people can exercise their judgement, apply their experience and use their expertise to pull the organisation from the present into its target (improved) future.

Conditions for operationalising strategy

Understand your starting point: • Past winning strategies

• Macro-economic climate

• Regulation

• Legacy IT systems

• Structures

• Processes

• Organisational capabilities

• Complexity

• Leadership

E.g. organisational capability

Having the right organisational capabilities in place is important as they help to pull the organisation into its target future

• Innovation

• Customer experience

• Cost control

• Acquisition integration

• Organisational agility

• Horizontal integration

• Vendor relationship management

• Health and safety management

Providing assurance

A role in change management is an opportunity for IA

• Raises the profile through high profile, mission critical projects

• Visibility in Board level discussions

• Supports the move beyond retrospective reporting to involvement from the start of a new initiative

• Helps us to demonstrate softer skills such as relationship management, negotiation and building trust

• Enables us to provide insight

How can internal audit help?

• Working with management to identify risks and potential solutions

• Advising on proposed changes to processes

• Facilitation the process of helping people to accept and work with change

Acknowledging effective change management

• Relies on people

• Understands culture

• Acknowledges the potential pitfalls

• Embraces the opportunities

Providing assurance on…

• the strategy / business case for change • is direction defined?

• is it macro or micro change?

• impact assessment

• is the strategy push or pull?

• Does the organisation understand its trajectory?

• does the strategy align to core values?

• are the operating principles clear on how to achieve their goals? • Organic growth or acquisition?

• does the organisation have the capability (eg resources – skills and $s) to achieve their strategy? Have capabilities been assessed?

Providing assurance on…

• Definition of key elements of the process • Objectives

• People

• Deliverables

• Deadlines

• Scope

• Risk appetite, risk identification and assessment, risk management

PMO Portfolio A

• Project A1

• Project A2

• Project A3

Portfolio B

• Project B1

• Project B2

• Project B3

Portfolio C

• Project C1

• Project C2

• Project C3

Providing assurance on…

• Mechanism for delivery: • PMO approach (not business as usual)

• Portfolio, Programme management and project approach

• Agile, Prince2, P3O

• Other?

Providing assurance on…

• Data Collection • Effective assessment of issues/problems

• Consultation with key people

• Objective and

• subjective

• Statistical analysis • Six sigma techniques

Providing assurance on…

• Diagnosis & Problem Solving • What are the major issues and problems – or

opportunities

• Impact on performance?

• Measurement of impact – ROI

Providing assurance on

• Implementation – Monitoring • How will changes be implemented?

• By whom?

• Implementation plan- is length of time important? • Discrete tasks/ projects which can be implemented within

6 weeks?

• Timetable

• Assessment of readiness and resistance • When do we know we are business as usual?

• Assessment of progress

Providing assurance on…

• Continuous Improvement & Review • Methods to ensure progress continues to be

assessed/measured

• Ongoing reporting

• Lessons learnt – how to exploit in future processes etc..

• Adaptive organisation – developing or existing capability

• Future proofing – sustained change

Auditing Change Projects – Case Study

A typical approach to project management reviews is for IA to join a Project Board or team with the inclusion of time in the audit plan for meetings. Anyone who has done this will know that it involves a considerable time commitment.

Advantages of approach

• IA can be at the heart of what is happening and have the opportunity to influence decisions by providing insight.

• If done well it raises the standing of internal audit within the business as a trusted advisor.

• You can “ensure” appropriate controls are installed.

Auditing Change Projects – Case Study

Disadvantages of this approach

• Internal audit involvement may compromise independence in the future. This could apply when internal audit assess project management or controls and then audit that process or activity.

• Internal audit attendance can also be interpreted as 'audit approval' or audit sign-off'. The implication being that everything has been seen and is satisfactory and on course.

• Project meetings often include detailed discussion about adequacy of risk responses and the nature of specific controls which could compromise IA

Auditing Change Projects – Case Study

Some of the Key Lessons

• One page reporting, with attached catalogue of errors, omissions, admissions and “sound bites”

• Business case assumptions and risk assessments should be dynamic – someone has to track and ensure within risk appetite

• Oversight of external parties need internal control as well as contractual review

• Project Board members need education as to their individual and collective roles

• IA can add so much value through objective (and timely) challenge

Things to think about when providing assurance over change

• Clear definition of target future, the business case and the steps required to get there

• The process for integrating change within the business and alignment with values

• Understanding the impact of change on the organisation’s people

• Operating within risk appetite

• Board visibility of progress and risks and the adequacy of reporting

• Plans to transition to readiness and to business as usual

• Management, leadership, buy in and commitment to the change

Sources

• Phil Atkinson: http://www.philipatkinson.com/

• Formicio Insight: http://formicio.com/index.php/archives/6299

• Harvard Business Review http://hbswk.hbs.edu/item/hbs-cases-lego

Contact

Kami Nuttall Associate Director Governance Risk & Assurance Moore Stephens LLP T +44 (0)20 7334 9191 M +44 (0)7919 552 332