The Post Office Horizon system, Birmingham City Council’s financial management and the well-documented failings at companies like BHS and Carillion are all examples of governance not working effectively. The tangible impact is felt by people from all walks of life, whether as employees, suppliers, customers or even investors.

As recently as 19 July, Civil Service World reported that Pat McFadden told the Post Office Horizon IT Inquiry that there was “no independent information” on operational matters within the Post Office, other than what the company told it.

However, we also have failures in the regulators whose primary purpose is to protect the public. The Care Quality Commission (CQC) was the most recent to hit the headlines, with reports of some hospitals not being inspected for ten years and the inspection regime being fundamentally flawed. But this is its core purpose, so why wasn’t this failure identified and addressed before the situation escalated to such an extent?

So where can organisations seek the independent assurance they need for their risk and governance processes?

Internal audit: a vital voice

Independent assurance is a key pillar of good governance. Such assurance is given so as to evaluate independently whether risks are being well managed and issues are being dealt with effectively. It allows those on boards and committees and in senior management positions to take action where things are not going well. One key provider of independent assurance is internal audit—independent from organisation responsibilities or deliverables and accountable to the audit committee, it is a vital voice that needs to be heard.

But consider this: what if a regulator’s internal audit function is poorly resourced, so that the assurance is undermined? What if the regulator itself is unable to deliver the inspection regime needed, and what if the regulated organisations’ own internal audit functions are also under resourced or haven’t been given the appropriate authority and credibility? There is a risk that this then begins to add up to a perfect storm of corporate governance failure.

Some may question whether this could ever be the case, but our recent research, An Evaluation of the Health of Internal Audit in Local Authorities, found exactly that. It revealed that internal audit functions are stretched and unable to complete their work due to financial pressures, not only on them but also their internal audit clients, who are too busy dealing with significant pressures on their services to be able to engage in the assurance activities.

Energy crisis

And there are the 30 or so energy suppliers that have gone bust over the past few years, including Bulb, which was the seventh biggest energy provider when it went bankrupt and had no internal audit function. Or, as we highlighted, the case of some regulated water suppliers where there is no internal audit function at all. Where is the independent voice for those responsible for governance to hear and act upon, and to ultimately protect employees, customers, and the public?

There is a glimmer of hope, though. The King’s Speech announced the draft audit reform and corporate governance bill, with powers for a new regulator—the Audit, Reporting and Governance Authority (ARGA)—replacing the existing Financial Reporting Council (FRC).

There is also the updated best practice framework of the UK Corporate Governance Code and Provision 29, with the requirement for publicly listed companies to report on the effectiveness of material controls. Both will feature assurance and it is vital that it is independent, effective, valued and acted upon.

Couple this with the new Global Internal Audit Standards launched in January of this year, and the publication this September of the Chartered IIA’s updated Internal Audit Code of Practice, and the expectations around improved independent assurance are clearly still being debated and defined.

As the Post Office Horizon Inquiry continues, we will have the opportunity in the autumn to evaluate the current assurance practices and structures in place, but there are also calls for change to the governance of arms-length government organisations.

This is something which could resonate well with the new government and its plan for Great British Energy in particular, along with the transfer of rail to public ownership—both of which will potentially need oversight similar to that of the Post Office.

Ann Brook is head of technical and research at the Chartered Institute of Internal Auditors