Interim Chief Audit Executive — Control Remediation

Not another audit plan

An audit plan lists what will be examined. A remediation agenda decides what will be fixed, in what order and by whom, and then proves that each fix held. The interim Chief Audit Executive is being appointed for the second job. Nor is it an advisory brief: the board is giving this executive the authority to shape the sequence and to hold management to it, reporting directly to the Board of Directors.

It is not a role for someone who wants to own the controls, either. Audit's value rests on independence, and a good interim keeps a clean line between setting and testing the remediation agenda on one side and management doing the remediation on the other. Holding executive authority while protecting that line is the most delicate part of the seat.

Turning findings into an order of work

Control findings in an insurer arrive from many directions: internal audit, external auditors, actuarial review, supervisors and management's own testing. Left alone they remain a long list with competing severities and no sequence. The work is to turn them into one ordered agenda in which the findings that matter most for policyholders, capital and regulatory standing come first, and each has an accountable owner.

Within that, you will agree the limits below which business-unit heads resolve findings themselves and which issues must come to the centre. You will define what counts as proof when directors decide where capital goes, how much capacity is committed and whether controls are adequate. You will determine which inherited audit and remediation commitments carry on and which close, halt proposals that drop cost or risk on someone who has not taken it on, and reject value cases that are silent on whether the change will be used, what it relies on and how it could fail. You will approve how leadership is arranged and how issues rise, and help the board and operating leaders resolve their differences before money changes hands.

The executive the board has in mind

You have led risk or audit work across four countries or more, in an organisation with revenue of $650 million or above and 1,100 or more people, and you can tell a local difference a market truly requires from one that survives only because nobody challenged it. Experience of scale-up, platform pivots and joint ventures is weighed because each tends to open control gaps at the seams: between old and new systems, between partners, between a growing book and governance built for a smaller one. The board wants risk judgement at level 4, plus level 3 in assurance testing, in regulatory engagement and in framing risk appetite.

Expect to be asked about a time when evidence was incomplete and you made a reversible call, then tightened it as findings were retested. You develop successors while you work, so that the assurance function you leave does not depend on you being there.

Two years of remediation, and the route in

The first ninety days produce an agreed, sequenced remediation plan, an audit baseline and an accountable person for each control finding. By month nine the priority findings should be closed and independently retested, with inherited audit commitments confirmed, deferred or closed. By month 24 the agenda should be complete, with assurance reporting built into the board's routine and a successor able to carry it forward.

The conversations follow a similar order of seriousness. The Board of Directors talks with you first, confidentially and on screen, in week one. In the third week you work through the remediation sequence with the Board Chair. Week five puts you in a room with executives who each run a different function, and in week seven the directors meet you as one body. You will hear our assessment in writing within two working days of each.