Feature

Hot water
Nicola Brennans auditing of procurement practices at Northern Ireland Water led to political outrage and boardroom departures. Neil Hodge talks to her about the experience, and what she learned from it
dont think weve dealt with a more serious case of complete disregard for public sector ethics. It has been a difficult experience, but one that Brennan says has made her a stronger person and a better internal auditor. after Laurence MacKenzie became NI Waters new chief executive. Formerly an internal auditor himself, MacKenzies antennae went up over suspected irregularities in the organisations procurement processes as early as 10 August. He had been asked to approve additional expenditure with a contractor for services at a rate that to him did not seem like attaining good value for

EvEry head of internal audit wants to make an impression and get the attention of senior management and the board. Thats especially true for those who are new in post. But few can expect to make the impact that Nicola Brennan did when she joined Northern Ireland (NI) Water to help set up and manage the internal audit team. And perhaps few would want to. Brennans investigation into the way the company awarded supplier contracts has led to boardroom dismissals and a parliamentary enquiry events that have thrust her work, and her organisations failings, into the public spotlight. Indeed, Stormonts public accounts committee chairman Paul Maskey told Members of the Legislative Assembly in July this year that the failings at the organisation were absolutely staggering, adding: Since our committee was established, I
16 Internal Auditing . Dec/Jan 2010

Rollercoaster ride
Brennan joined NI Water in July 2008 to help set up and manage its fourperson internal audit team following the organisations transition into a government-owned company. The key part of her remit was to develop the organisations in-house internal audit function while accountants Ernst & young stepped back, working initially in a co-sourced arrangement. Brennans team would then take charge completely of all internal audit work from 1 April 2010, when E&ys three-year contract ended and she officially became head of the function. But her rollercoaster ride started in August last year, just two weeks

We are not watchdogs snooping on what other people do. Internal audit is there to add value and flag up problem areas, though its findings are often not as damaging as this

Dec/Jan 2010 . Internal Auditing 17

Feature
money for the taxpayer. By early September he called in Brennan and her team to investigate how this contract with Contracting Out, a procurement specialist, had been originally awarded. Brennans investigation concluded that the supplier appointment had not been properly approved and that it had been engaged through a single tender action (STA) without competition from any other suppliers. Furthermore, Contracting Out had secured a 6% success fee for savings identified rather than delivered, which meant that taxpayers money was being used to reward suppliers for potential savings rather than savings actually realised. On the back of these findings, MacKenzie commissioned a wider review of a sample of NI Water contracts between December 2008 and December 2009, asking Brennan and her team to investigate whether any other pre-existing contracts did not comply with the organisations governance arrangements and applicable procurement regulations. Internal audit reported back on 15 January 2010. Its report uncovered 26 other questionable deals, some potentially breaking EU rules.

Broken rules
MacKenzie immediately informed NI Waters sponsoring government department, the Department for regional Development (DrD), and an Independent review Team (IrT) was jointly established to determine what led to such governance failings. This was in parallel with further audits that were commissioned into contracts dating back to April 2007. By April this year Brennans internal audit reviews had found 73 cases where NI Water contracts worth a total of 28.4m were awarded without appropriate competitive processes or had been excessively extended beyond the contract terms, leaving the company unable to demonstrate value for money for taxpayers.
18 Internal Auditing . Dec/Jan 2010

The experience has taught me that it is important to remain steadfast in your opinions, determined and independent so that you are always true to yourself

Brennan says that the problems with procurement were also likely to have been present prior to NI Water replacing the Water Service its predecessor in 2007 as part of a devolution reform package. But she adds that the weak controls environment that was in place surrounding contracts was exacerbated by the delay in the implementation of an IT procurement system. Another problem was the scale of change management within the business it was being reorganised into a government-run company quicker than originally planned, which meant that the organisation was reliant on a large volume of independent contractors and consultants. Added to that, some staff procured services of their own accord without engaging the procurement function, which meant that contract award records were incomplete. A further major root cause was the general lack of awareness across the organisation of the procurement procedures

and approval requirements says Brennan. As a result, we now have a procurement compliance ofcer to take charge of these issues, she adds. Following Brennans internal audit reports and the related IRT ndings, four of NI Waters non-executive directors were dismissed. One of them was the organisations chairman, Chris Mellor. Furthermore, in August, Paul Priestly, permanent secretary at the DRD, was suspended over continuing investigations into what went wrong. He had told Stormonts public accounts committee the previous month that the organisations procurement practices were shocking, indefensible and unacceptable, adding that its evidence of lazy and bad practice. Its about allowing a contractor to get into the lifeblood of an organisation.

Personal challenge
While investigations into what happened at NI Water are still

ongoing, Brennan has had time to reect on what has happened in the past 15 months. The whole experience has been a personal challenge for me. It has been a very stressful period and it has been a very bumpy ride at times, she says. I had only been working at NI Water for a year before the chief executive requested the audit that would uncover the failings in the organisations procurement processes. Indeed, it would have been a lot better if the whole episode had never happened as the reputation of the organisation has been damaged and politicians have become involved. However, it is imperative that such instances of poor governance and control are brought out in the open. The organisation will be better managed as a result of all this and hopefully the lessons learned here will be shared in other public bodies. Brennan says that having a CEO

Following Brennans internal audit reports, four of non-executive directors were dismissed, including the organisations chairman

Advert page 19
Dec/Jan 2010 . Internal Auditing 19

Feature
champion the cause of internal audit is a real bonus. I have been very fortunate to have a chief executive that understands the value of internal audit through personal experience. That level of backing particularly when we were both under a lot of duress and pressure is a massive help, and not all internal auditors have been as lucky, she says.

Lessons learned
BAseD on her recent experiences, Nicola Brennan shares her advice on how to handle a controversial audit assignment. 1 Stick to your guns If you believe that something is not right and you have evidence to support your view, make sure the problem is not swept under the carpet. 2 Stand up to pressure Confrontation is never easy, but internal audit is always likely to flag up problems that the executive and other stakeholders might not like. 3 Be cautious with risk-based internal audit Applying a risk-based audit approach is not always the right move. Always question whether a full, riskbased approach is appropriate or whether this should be supported with substantive testing techniques. 4 Keep your team informed If you have been asked to carry out an in-depth review which is outside internal audits normal work and may be controversial, let the team know the details so that they can be prepared for office politics. 5 Rebuild trust It is important to restate to people within the organisation and other stakeholders that internal audit is there to add value to the business and is not an internal policeman that snoops on them.

Risk-based worries
More generally, the experience has made Brennan cautious about the merits of risk-based internal auditing. When you adopt a riskbased auditing approach you are confirming to a certain degree that the controls that have been put in place by management are appropriate to manage the risks within the business area being reviewed, she says. Consequently, the operating effectiveness of the controls are then tested on a limited sample basis. But there is a danger that you are not going to find control failings because testing is limited, especially if your systems are immature, meaning that the population you are testing from may not be complete in the first place, she adds. Instead of automatically adopting a risk-based approach, internal audit departments need to consider the systems already in place, the skills and resources available, as well as the culture of the organisation. After a tumultuous year, Brennan is ready to restore order and calm to her team and to the organisation. One of the key issues on her agenda is to engage with staff across the business and reassure them that such investigations are not ordinarily part of internal audits workload. The role of internal audit in this process is likely to have made some staff unduly nervous about what we do and why we want to engage with people throughout the business, says Brennan. We are not watchdogs snooping on what other people do. Internal audit is there to add value
20 Internal Auditing . Dec/Jan 2010

The role of internal audit in this process is likely to have made some staff unduly nervous about what we do and why we want to engage with people

and flag up problem areas, though its findings are often not as damaging as this. Our job now is to reassure staff that we are not internal spies carrying out a policing role and so we are rebuilding our reputation within the organisation, she adds.

Regaining trust
Brennan admits that this may not be an easy task and that it is likely to take some time. Regaining trust is not going to happen overnight, but Im confident that people will appreciate the work that we had to do to protect the organisation, the pressure we were under, and the value our work has added to the organisation as a result, she says. I think that this has been a tremendous learning curve, says Brennan. The experience has taught me that it is important to remain steadfast in your opinions, determined and independent so that you are always true to yourself. Carrying out this kind of review and reporting such problematic findings is going to make waves within the organisation, but you have to stick to your guns, she says.