Few people get the chance to design their internal audit function from scratch, and this opportunity brings with it challenges, as well as advantages. Paul Hamill joined Sova Capital (‘the group’ and ‘the firm’) in January 2020 to set up a new best in class internal audit function and one of his initial tasks was to choose the software that would support the work of his team of three.
Standing start
Sova Capital is a diverse, niche brokerage and trading group with a small investment banking operation, a Russian research function, and asset management and venture capital offerings. It is based in London, Moscow, and Cyprus, providing access to more than 40 markets with a mix of institutional and corporate clients. Subject to regulatory approval, the firm will soon also complete its acquisition of a small European retail bank.
Before Hamill arrived, its internal audit services had been outsourced. The firm is regulated, and Hamill also had to be approved by the regulator under the Senior Managers & Certification Regime.
Hamill’s previous roles in a multinational investment bank and financial services group, and a consulting firm meant that he had experience with different internal audit software offerings, including ‘TeamMate AM’, so he arrived with a clear view of what he wanted to achieve. He was also keen to have the full buy-in of the team on the selected audit management software.
Red, amber, green
One of his first tasks was to create the firm’s audit universe and mapping its various risk management frameworks whether credit, market, liquidity, compliance, operational, tax, etc. Each of these risks were rated as very high, high, medium or low to determine the frequency of the audit coverage within the audit cycle. The audit universe also serves as a live and clear “heatmap” of the net risks shaded red, amber, pale green and dark green reflecting the expected audit ratings if the area were audited at any moment in time. The heat map is updated for the results of each audit as it is completed and other continuous auditing inputs.
The process is complicated by the fact that the firm is still acquiring new businesses, which need to be risk-mapped and added to the universe and the heatmap.
Hamill was also acutely aware of the importance of robust quality assurance and consistent audit standards. “Past roles included auditing global banking & markets, hedge funds, asset management, finance & tax; several years as Head of Governance and Methodology for a large global bank, working to ensure consistency across the bank 700 auditors, providing direct practitioner insights combined with in-depth knowledge of business and risk management function and controls,” he explains.
Hamill began by creating the firm’s audit universe and mapping its various risks whether credit, market, liquidity, compliance, operational, tax, etc. Each of these risks were rated as very high, high, medium or low to determine the frequency of the audit coverage within the audit cycle. The audit universe also serves as a live “heatmap” of the net risks shaded red, amber, pale green and dark green reflecting the expected audit ratings if the area were audited at that time. The heat map is updated for the results of each audit as it is completed and other continuous auditing inputs.
Hamill is a strong believer that a successful audit function plays an integral role in the continuing enhancement in a firm’s control environment where the heatmap trending should improve with each audit cycle.
The heatmap also allows him to chart who owns each risk, where it is based and the resources required to audit it, as well as the frequency with which it should be audited. He can then match auditors, audit days and budget to the risks according to their priority.
The TeamMate+ documentation trail also makes the system ideal for quality assurance purposes and allows myself to track the progress of all ongoing audits at any moment in time.
Strong foundations
This clear and detailed roadmap for a successful new internal audit team made it essential for Hamill and his team to find the right software to underpin it. “I knew what I wanted to achieve, but I needed the right software to make it possible,” Hamill says.
Initially, they considered four systems and quickly ruled out two. They then put the remaining two to the test.