In 2002, one of Canada's largest oil and gas companies ("the client") was looking for a new internal audit firm. The client's incumbent accounting firm was dissolving, and another accounting firm was set to take on the client's external audit. The client foresaw that due to Sarbanes-Oxley requirements, it would become necessary to have an additional, separate firm handle their internal audit.
The client had long preferred to outsource its internal audit function, believing that outsourcing offered greater flexibility, the availability of true subject matter experts and top quality service. They wanted a firm to fulfill their internal audit needs with a consistent level of service, so they issued a request for proposal (RFP) for an initial three-year internal audit engagement.
PwC was one of several firms who responded to the RFP. As market leaders in the oil and gas community in Calgary, PwC leveraged its considerable experience in the industry to develop a customized response.
"The client felt our RFP response demonstrated the strongest subject matter knowledge," said Matthew Wetmore, a partner with PwC. "We really did our homework, and collaborated with the client's stakeholders throughout the process to ensure we understood their needs clearly."
Given their preference for the outsourcing model, the client's main challenge was finding the right partner firm to manage their internal audit scope of work that in any given year could include upwards of 30,000 project hours, and between 45 and 70 individual projects.
With such a large project, PwC's first challenge was identifying potential projects and prioritizing them, balancing the governance projects with the special requests of the client, as well as the budget available for the year.
A key focus for PwC throughout the seven-year engagement was ensuring that the approach was constantly evolving, and that new ideas and resources were continually brought to the project as the organization's needs changed.
Another challenge was keeping the many stakeholders informed and involved in the process and the various projects that the internal audit team would undertake.
At the very beginning of each year, PwC conducted a robust planning cycle. A key element of planning was the series of workshops with executives across the client's organization, held every year. PwC instituted these workshops to allow stakeholders to voice their opinions and their needs, ultimately generating a master list of potential projects under the greater umbrella of internal audit.
Following the workshops, PwC presented a report to the leadership teams, with an initial take on prioritizing the projects. Throughout a highly collaborative and open process, PwC worked with the client to develop a key list of projects for the year that would meet the immediate and special interest needs of the organization, as well as fit into the budget. Projects that were not approved were kept on a list and used as a starting point for the following year.
"Through the workshops, we were able to ensure that every stakeholder felt heard, and that we fully understood their needs and priorities," said Wetmore. "At the same time, simply enumerating the sheer number of potential projects clearly demonstrated the need for the work we were doing, and its value."
To ensure that all the key stakeholders were kept up-to-date on the status of projects, PwC initiated a series of regular, ongoing meetings with key stakeholders at the client's organization. Some were held quarterly, some were monthly, some were biannually—but regular meetings were held with the CFO, the client's controller, the key controllers and leadership teams in each business unit, and the Audit Committee. PwC would occasionally use these meetings to introduce different team members and subject matter professionals to the client. Through these meetings, PwC kept teams informed and shared progress and results, all while building and strengthening relationships.
Since PwC consistently brought in subject matter professionals from across the firm to respond to new or changing needs, the structure of the PwC team changed and evolved with the nature of the work—by the end of the engagement, the team had nearly doubled in size.
The nature of internal audit work varies greatly depending on the client organization and their needs. Throughout PwC's relationship with the client, the internal audit team focused on contract compliance, fraud risk management, process review and improvement, IT audit work and special projects, construction risk management, treasury risk management, and towards the end of the engagement, the client's CEO/CFO certification (Sarbanes-Oxley) work.
The client was highly satisfied with PwC's work as internal auditors; the initial three-year engagement was extended indefinitely until the client merged with another major oil and gas organization that was an existing PwC assurance client.
Throughout the years that PwC acted as internal auditors, the benefits to the client were significant, and measureable in a variety of ways.
PwC conducted client satisfaction surveys after every single project, collecting both numerical and written feedback which was integrated into the reports to the Audit Committee. PwC also participated, along with the client's other internal departments, in their balance scorecard program, measuring their performance across criteria including customer satisfaction and timeliness of delivery. Management at all levels expressed very high satisfaction with PwC's services.
As another key performance indicator, PwC measured dollar value savings (through improved process and efficiencies) and recoveries (often as a result of contract compliance) that were attributable to the internal audit projects. An overall figure for the entire span of the engagement is nearly impossible to determine; but, for example, the dollar savings achieved in the final full year of PwC's engagement, was upwards of $12 million. These savings were largely derived through contract compliance work initiated by the PwC internal audit team.
Had the merger not made the continuation of the relationship impossible, PwC would have continued to grow and evolve in their role as internal auditor for the client, continuing to provide a high level of customer service and working to take the client's internal audit work to the next level.
Matthew Wetmore is a partner in the Consulting practice. He has extensive consulting and industry experience in internal controls, process design and implementation, comprehensive due diligence, vendor support and post-merger integration.
Richard Arsenault is a director in the Consulting practice. He is a Chartered Accountant with more than 20 years of experience and focuses on internal audits.