Interim Chief Audit Executive — Value Agenda

An auditor who will make a call

Years in assurance should have shown you where audit stops being useful. Audit can describe an exposure with great precision and still leave an organisation no nearer to deciding what to do about it. You have moved past that. In earlier roles you named whoever bore the economic cost of an exception before letting it stand, and you accepted that your first visible result might be something closed down instead of something new, then defended that choice with evidence.

You have done this in organisations that each had revenue of at least $610 million, 1,000 or more people and a presence in four countries. The bank will test your record in buy-side M&A, joint ventures and professionalisation. Acquisitions and partnerships are where exposures are inherited without anyone fully choosing them, and professionalising an assurance function is how you make sure they are found next time. It wants risk judgement at level 4, and regulatory engagement, assurance testing and risk appetite at level 3. When something is still unresolved you say so to a chief executive and keep moving, and a commitment can stop without a sign-off from each market's head.

Sorting each exposure

The core of the appointment is a sorting exercise with consequences. For each material exposure the question is whether the bank should treat it, by strengthening controls, changing process or investing; transfer it, through insurance, contract, partner or hedge; or exit it, by stopping the product, the relationship or the activity. Audit supplies the evidence. This interim role also carries the authority to drive the answer.

You will draw up how risk decisions are allocated and confirm the thresholds local leaders hold. You will select the evidence by which the bank governs its use of capital, its capacity and its controls across markets. You will determine which commitments carry on, which pause and which close. You will block proposals that hand on cost or risk without saying who owns it, decline investment where the value case leaves out adoption, operating dependencies or the downside, and approve the route by which the resulting issues reach the executive and the board.

Independence remains the discipline of the role even with executive authority. A recommendation to treat, transfer or exit is only as strong as the audit work beneath it, and that work has to be beyond reproach.

Exposures decided, not just described

By day ninety, a risk-based audit plan should be agreed and each material exposure assessed against the three options. Around month nine, audit findings on the priority exposures should have been reported, owners agreed and the transfer and exit decisions actually taken, not merely recommended. By month 12, residual exposures and open audit actions should be evidenced to the board, and next year's assurance plan should be in a state that whoever leads audit next can pick up and run.

Four conversations, one recommendation tested

Selection starts in the first week, when the Group Chief Executive Officer talks with you privately by video. The Board Chair then gives you, in week three, a treat, transfer or exit recommendation that the business resists and asks how you would present it. A fortnight later, in week five, comes an in-person panel of executive leaders from each function; the board's directors as a whole follow in week 7. Every stage is followed within two working days by a note from us on how it went.