The better the question
Can you understand the full picture without seeing what lies beneath?
Network Rail’s Internal Audit team needed help to turn their audit findings into an actionable framework.
Network Rail owns, operates and develops Britain’s railway infrastructure. Managing 20 of the largest and busiest stations across England, Scotland and Wales, Network Rail is also responsiblefor timetabling.
Network Rail’s Internal Audit team are central to the organisation’s ability to deliver its vision of “Putting Passengers First.” They are critical drivers of improvement and change – but meaningful change cannot happen unless they can fully understand the root cause of why an audit issue occurred.
Network Rail identified issues in their current Root Cause Framework (RCF), so they asked the EY consulting team to help transform their Internal Audit processes.
Network Rail already had a considerable volume of audit findings and recommendations from previous reports. The challenge for the team was how to cut through the complexity of that information, identify key themes, and turn these into tangible actions aligned to Network Rail’s business strategy and goals.
To solve a problem, it is vital to examine the root cause, rather than focus on the symptoms – something Network Rail’s audit team always understood. However, this is not always easy to put into practice. By their nature, root causes can be complex and difficult to evidence, with the underlying pattern they create only becoming clear over a period of months or years. Identifying and articulating these patterns quickly require a shift in mindset and a new way to analyse the information available.
Head of Internal Audit at Network Rail, Gerry Mansey understood that in order for Internal Audit to create impactful change within a business, communication was a key component.
“I used to ask my team members: if you stepped into a lift with the Chief Executive tomorrow, how would you summarise the lessons we had learnt from our internal audits? There’s nothing wrong with explaining what we had learned in the last month. But what about the last quarter, year or two years? Our internal audit team needed instant access to these important lessons as a matter of priority so that we could better understand the root causes behind our audit findings and present them in an articulate, accessible and aggregated way to our Board.”
The better the answer
A Root Cause Framework helps to identify and mitigate problems.
Applying discrete categories when defining root causes makes it easier to pinpoint patterns and weak spots.
EY teams worked collaboratively with Network Rail’s Internal Audit function to build and embed a bespoke RCF. The teams jointly identified eight discrete categories defining the root cause of internal audit findings, observations and any associated behavioural factors. This is one of the RCF’s most significant and innovative features, as it allows teams to directly align audit observations to root causes, making it easier to identify underlying patterns and pinpoint weaker areas.
Commenting on the importance of giving process and people equal weighting on this project, Emma Price, EY Associate Partner in Business Consulting, said: “You can set down the best control processes in the world, but things can still go wrong if people don’t follow them. The important question is: ‘how are processes implemented?’ – and that’s behavioural. Historically, organisations have found it difficult to monitor, measure and track behaviour effectively. However, the reality is that by using the powerful data analytics tools now available, we can design frameworks that are capable of identifying and measuring specific behaviours more accurately and objectively.”
The data-led framework was flexible, so that it could be applied either “live” during an audit, or retrospectively to previous audit reports. This led to a bank of high-quality root cause information which could be used to underpin evidence-based insights into Network Rail’s risk and controls landscape.
The project team faced a number of challenges from day one. For example, they had to develop and implement the RCF with minimal disruption to Network Rail’s existing internal audit functions, whilst ensuring that the root causes they devised were objective.
In addition, they had to assess the best way to report back on audit findings, using the information effectively and enriching institutional knowledge.
From the start, the project was driven by a strong spirit of partnership and collaboration between the teams from Network Rail and EY and this was integral to its success. Failure to ask the right questions would run the risk that Network Rail’s internal audit community would be reluctant to embrace the new RCF, or indeed recognise the value of the rationale behind it. EY teams initially focused on asking questions to establish exactly what Network Rail wanted the RCF to achieve, then placed the needs of the end user front and centre of the design process.
Hasan Ali, a Director in Business Consulting who leads EY’s Risk Innovation Hub, stated that, “Given this was a new way of analysing data, we needed a new way of presenting it back to Network Rail. We wanted it not only to be user-friendly, but also to drive insight and change across the organisation. Working in collaboration with Gerry and his team, we created custom visuals that depicted the key messages in a striking, impactful way that would resonate with stakeholders.”
The project team embedded the RCF widely across the user community, working at pace to deliver in spite of the national lockdown. To win the buy-in needed to ensure success, EY teams ran a series of targeted virtual workshops with members of the client’s internal audit team to ensure they were fully engaged with the framework and understood the approach before go-live.
This tool has attracted positive comments from the Network Rail team from the moment I first presented it. Since then, it has become part of our language.
The better the world works
A framework providing actionable insights into people and process.
Network Rail’s new RCF dashboard has reduced workload and created an internal audit function fit for the future.
The RCF has exceeded Network Rail’s expectations and has proved invaluable for their business. Designed collaboratively from start to finish, with the needs of the end user at the centre, it is intuitive, high-impact and, above all provides vital and valuable insights. It represents a critical step on their journey from traditional, compliance-focussed internal audit, towards using real-time risk intelligence to build an Internal Audit function for the future.
The RCF – which has now been live for a year – has added significant organisational value for Network Rail by helping to generate more informed conversations about internal audit findings, whilst the RCF’s dashboard interface makes the underlying themes clear to business stakeholders. For example, the root cause of multiple internal audit findings might be a gap in procedural documentation, or supporting training – but without the means to recognise and interrogate patterns in audit data, such instances are difficult to identify.
Business risk and control owners across Network Rail can access the RCF dashboard in real time and see where their core weaknesses lie; this, coupled with its visually engaging nature, makes it easier to proactively address issues. As a result, the internal audit team are required to undertake less follow- up activity; relationships have improved, and there has been a positive shift in how internal audit is perceived in the organisation.
“Internal audit can be a difficult area to engage with and it is often hard to generate interest and excitement. But with its high-impact, highly engaging dashboard, this tool has attracted positive comments from stakeholders from the moment I first presented it. Since then, it has become part of our language.” – Gerry Mansey
Additionally, the aggregated insights emerging from the RCF provide a fact-based sense check to compare the organisation’s annual controls self-assessment (Group Assurance Letter Process) against, enhancing overall assurance.
The dashboard has had such an impact that Network Rail Non-Executive Directors have asked to share it with other organisations as an example of good practice. It is an illustration of collaborative working to co-develop a solid foundation for deriving meaningful, actionable insights from large volumes of complex information.
What next?
The initial phase of the engagement was focused on developing and embedding the RCF and on building and rolling out the dashboard for use in business-as-usual activities. Now EY teams and Network rail are working together to continue enhancing the value the internal audit function delivers.
Alongside ongoing development of data analytics, the teams are now working closely to build out tangible, consistent ways of identifying and measuring behavioural factors in audits linked to the root causes. This will drive a deeper understanding of the behavioural drivers that create issues and facilitate the development of targeted actions aligned to Network Rail’s wider business strategy and goals - whether behavioural or procedural.
Maintaining a collaborative approach will continue to be key to the project’s success. By integrating Network Rail’s knowledge of the organisation, with EY technology and risk management experience, the project team will continue to equip the internal audit function to answer the all-important question “why?” and help to embed the human factor that lies at the heart of the commitment of putting passengers first.
