Technology in the day-to-day operations of the internal auditor

Bank of Cyprus’ Internal Audit Director George Zornas highlights the importance of technology and of adopting an internal audit management system. The interview of Mr. George Zornas follows in regards to the aforementioned subject.

How did the need for adoption of technology in your day-to-day operations arise?

With internal audit constantly evolving, one needs to leverage technology to the highest extent possible. The use of technology is vital, to help us identify and address weaknesses and risks before these can materialise, as well as to provide recommendations to manage them.

At Bank of Cyprus, the Internal Audit Division (IAD) has for years now adopted the International Standards for the Professional Practice of Internal Auditing and has been externally assessed for full compliance. In this context, we wanted a transition to a paper-less environment, a cut back on red tape and streamlining of our monitoring findings activities and preparation of reports to senior management. Technology was the core factor for succeeding these. Thus, we sought for a central platform that would assist us in automating our audit processes, create a logbook in which we could collectively import and monitor on a continuous basis the identified risks, controls, working papers and our findings, as well as to strengthen our cooperation with the auditees.

Is this philosophy consistent with your organisation's strategy?

Early on, Bank of Cyprus reailised that effective adoption of technology would be the basis of any future growth as well as a contributing factor to its sustainability. So, the Bank proceeded and continues to invest heavily in its digital transformation. One important achievement of this transformation has been the fact that the Bank’s first modern branch has opened for the customers, with a different and contemporary operational model, providing services that are based on new technology and automation.

The automation of internal audit operations is incorporated in the Bank’s strategy, as we also on our part, are moving towards contemporary methods of communication with the auditees, exchange of information, data analysis and preparation of reports.

Which are the benefits that the TeamMate+ system has offered?

A major success we are proud of, is the fact that the Internal Audit Division carried out the entire management of the TeamMate+ project on its own resources, within the set deadlines and budgets. Specifically, I assigned the organisation and monitoring of the implementation of this project to the manager of the Information Systems Audit & Data Analytics Department, Mr. Panayiotis Koumousis. In this context, we decided that we needed to exploit the maximum value of this software, the soonest possible. Thus, further to our principal audit activities, we managed to expand the automation to the procedures of the Internal Audit’s Investigations department.

The implementation of the TeamMate+ system has allowed us to exploit many advantages. The most important of these, are the real time interaction with auditees for the monitoring of the implementation of our recommendations, as well as the analysis of information with the purpose of preparing reports to senior management based on more accurate data. In addition, the management of resources required during the performance of our audits is for the most part done automatically, which reduces the associated required time and provides the appropriate information for a more accurate budgeting of the internal audit plan. Lastly, audit evidence is stored and categorised in the system, saving auditors’ time for their organisation, process and reassessment.

I would like to mention that during the implementation of TeamMate+, we suggested significant changes to the provider, Wolters Kluwer, in relation to the system's functionalities. Wolters Kluwer adopted some of our suggestions through subsequent upgrades to the system, providing extra capabilities to all clients globally. I feel deeply satisfied that during this project, we surpassed ourselves and managed to make Bank of Cyprus widely known for an additional reason, which is the successful transformation of the operation of the internal audit based on technology.

Have any skills been developed through the application of the TeamMate+ system?

The role of the internal auditor is constantly evolving, along with the expectations of its stakeholders. At this stage, the internal auditor is called to take steps to transit from the Assurance Provider or Problem Solver maturity levels to the Insight Generator level. In other words, the internal auditors, through the processes they follow and their reporting to management, are called to surpass the stage of problem solving, transiting to the next level in which they will add more value through the identification of risks before these materialise.

TeamMate+ system assists us in our endeavors to reach the Insight Generator level. By effectively utilising resources through the automation of processes, our auditors can dedicate more time to risk assessment, data analysis, root cause analysis, as well as to the extraction of conclusions in regards to the efficacy of the Bank’s management in terms of risk identification and management. For the achievement of all these, significant attention is given to the development of our auditors, who further to their technical know-how, also improve their soft skills on an ongoing basis. Indicatively, good communication skills, ability to adapt, critical thinking, teamwork and business acumen, constitute determining factors for the quality of our work and fulfilment of our objective.

Do technology and management of the pandemic impact go hand in hand? What do you think?

The pandemic has certainly found many organisations unprepared in a number of areas. We were fortunate, to have adopted the system since 2019, which meant that our operations had already been adjusted to make the most of the automation and functionalities offered by this valuable tool. As such, we were able from the outset of the pandemic to cope with changes relating to remote work and off-site audits. Our auditors were ready to respond to these needs and continue their work smoothly. We can therefore confidently say that with the assistance of technology we successfully managed to overcome the difficulties posed by the pandemic.

What advice would you give to organisations wishing to adopt internal audit management systems?

The senior management of the organisation should support this action and stress its importance. Moreover, the internal audit division should welcome changes in its operating environment. Important preparation must take place prior to initiating the automation process, of which the first step is to simplify and re-engineer the internal audit procedures, considering the new system's capabilities. Last but certainly not least, in terms of a successful implementation of such a system, is to ensure that you set up a dedicated team comprising of auditors and technical experts within the organisation, working with dedication for managing the implementation. Through this, technical knowledge will be transferred to the internal audit team, who will be able to carry out any subsequent upgrades and adjustments to the department's processes.