solutions by stc: A journey from transactional to strategic assurance

Introduction: The need for transformation

Based out of Saudi Arabia, solutions by stc offers comprehensive, end-to-end technological solutions, ensuring seamless transformation for organisations. With the business standing at a pivotal juncture, poised for unprecedented growth and profitability, the Internal Audit (IA) function recognised the urgent need for transformation. This was especially critical as the business prepared for a significant transition to a publicly-listed entity and planned a major workforce expansion. Despite performing robustly, the IA function had pinpointed several key challenges that the business needed addressing to strengthen its foundational practices.

One notable opportunity identified within the organisational framework was enhanced collaboration and communication across different functions. For example, addressing the gap in exchanging IA reports with the Governance, Risk, and Compliance (GRC) function highlighted opportunities for strengthening the assurance culture. This collaboration also enabled a more strategic approach to risk management, moving beyond mere transactional operations and compliance towards proactive risk mitigation management.

Acknowledging these challenges, there was a compelling need to overhaul the IA strategy. The envisioned three-year plan aimed to evolve the IA from a traditional role into a strategic, data-driven advisor to management. The pivot was crucial for effectively navigating the risks and seizing opportunities during the company's significant expansion and upcoming IPO.

A strategic shift to stay ahead of the curve

The IA function at solutions by stc, while proficient in traditional assurance practices, recognised the need for a strategic shift to stay ahead in a rapidly evolving business landscape. Despite excelling in maintaining an IA plan, conducting risk assessments, and prioritising audits, the organisation’s ambitious growth trajectory called for a fundamental change.

An internal maturity assessment was carried out and it highlighted a key goal: to move beyond the conventional siloed approach. The objective was to refine the IA operations to seamlessly integrate with the broader vision for expansion post-IPO and to comply with the latest standards from the Institute of Internal Auditors (IIA) that emphasise enhanced collaboration across the three lines of defence.

This strategic shift was designed to proactively tackle challenges arising from recent and upcoming acquisitions. With the business world moving swiftly towards digitisation, solutions by stc positioned itself at the forefront of this trend. The revamped IA strategy was not merely about keeping pace with growth but about navigating future complexities with resilience and adaptiveness, ensuring the organisation remained ahead of the curve.

PwC Middle East’s role as a trusted advisor

PwC Middle East played a critical role as a trusted advisor in steering solutions by stc from a traditional IA function towards a predictive, digitally advanced model. The strategic transformation was based on three key pillars: Digital Transformation, Combined Assurance (CA), and Project Assurance. Recognising the complex and interconnected nature of the risks involved, solutions by stc worked closely with PwC Middle East, prioritising the CA pillar to modernise their IA function in response to the current landscape.

PwC Middle East rolled out a detailed three-year CA roadmap, incorporating strategic elements and foundational steps. This comprehensive approach included identifying and assessing assurance providers across the three lines of defence models, organising crucial meetings and walkthroughs with key stakeholders, and conducting validation sessions. Additionally, PwC Middle East helped create an assurance map to pinpoint top organisational risks and delineate clear roles and responsibilities, thereby cultivating a robust assurance culture primed to tackle emerging risks.

The collaboration also yielded a high-level strategic document for the CA programme, supported the establishment of a dedicated assurance committee with clear mandates, developed a detailed CA methodology, crafted in-depth CA plans, and enhanced organisational knowledge through targeted awareness sessions and workshops.

This partnership marked a significant milestone, firmly positioning solutions by stc as a regional leader in holistic CA programme implementation — a feat unmatched by any other organisation in the Middle East. This pioneering effort not only set solutions by stc apart but also established a benchmark for excellence in the field, showcasing the transformative power of strategic collaboration addressing evolving business challenges.

Challenges faced and lessons learned

Throughout the transformative journey, numerous opportunities for growth emerged. A notable challenge was to align the diverse interests of all stakeholders as different organisational functions firmly adhered to their established mandates. To overcome this, solutions by stc, with strategic assistance of PwC Middle East, successfully implemented several key initiatives aimed at fostering a collaborative culture. This included the rollout of training programmes, workshops, and awareness campaigns designed to enhance mutual understanding and cooperation across the organisation.

Effective communication channels were established among the three lines of defence, facilitating better collaboration and smoother information flow. Despite these efforts, significant hurdles persisted, particularly regarding transparency and the timely sharing of information by the first and second lines, which was critical for assessment and validation processes.

With PwC Middle East's support, solutions by stc developed a robust framework that recognised the unique importance and mandates of each line. This framework employed a data-driven approach to bolster informed decision-making, particularly crucial in scenarios requiring zero-risk tolerance. This strategic shift not only addressed the immediate challenges but also laid a foundation for sustained organisational alignment and risk management excellence. The formation of the Combined Assurance Forum (CAF) and Combined Assurance Committee (CAC) also played an integral role in addressing challenges. The CAF served as a crucial bridge to the CAC, directly reporting progress, risks, and outcomes while also contributing to the development of the CA plan. It optimised assurance coverage across key risk domains through collaborative management and facilitation. Meanwhile, the CAC, an executive body, spearheaded assurance initiatives in line with strategic goals endorsed by the audit committee. Comprising departmental heads and chaired by the Chief of Internal Audit, it oversaw the execution of the CA Plan, ensuring adherence and delivering comprehensive progress and risk coverage to stakeholders. The successful implementation of CA was significantly facilitated by these committees, ensuring comprehensive coverage across all risk areas.

Pioneering a holistic CA programme: Managing risks and enhancing operational efficiencies

solutions by stc, in partnership with PwC Middle East, revolutionised risk management by pioneering a holistic CA programme, unlocking transformative benefits. This groundbreaking initiative optimised coordination among the three lines of defence, enhancing the effectiveness of CA. Assurance providers collaborated closely, conducting thorough assessments and delivering consolidated reports. These efforts were continuously refined based on evolving organisational needs and feedback, ensuring the CA model remained dynamic and effective.

The implementation of this programme brought significant advantages to solutions by stc. By reducing redundancy and preventing potential oversight, the programme fostered enhanced collaboration, leading to smoother operations and optimal use of resources. This streamlined approach significantly improved the efficiency of reporting from the second and third lines to the Board of Directors and Audit Committee, offering them comprehensive assurance and critical insights into organisational risks.

Furthermore, by establishing a unified risk landscape, the company focused its efforts on addressing the most pressing risks, ensuring the strategic allocation of resources. The meticulous tracking of remedial actions also empowered the organisation to prioritise areas for improvement and address vulnerabilities systematically, enhancing overall processes and procedures.

As a result, Executive Management and the Audit Committee gained increased confidence in the organisation’s ability to manage risks and uphold robust assurance frameworks. This not only reinforced solutions by stc’s reputation for reliability and integrity but also positioned it as a leader in innovative risk management strategies.

PwC Middle East perspective

The transformative journey of solutions by stc's IA function demonstrated the profound impact and benefits that could be achieved, serving as a powerful blueprint for overhauling other organisations' IA operations.

Every IA function possesses the potential to evolve. Depending on factors like industry regulations and the specific complexities and needs of the business, organisations may choose either a comprehensive overhaul or a phased approach to transformation.

Before launching this transformative journey, it was essential to navigate several challenges, for which PwC Middle East could provide expert guidance. This included:

Fostering a culture open to new risk management approaches, shedding traditional silos.
Promoting seamless communication across the three lines of defence.
Encouraging the first and second lines to collaborate on mandates and budgets, mitigating concerns about power dynamics.
Emphasising transparency and information sharing, particularly in areas with potential overlaps.
Implementing a robust ongoing monitoring process for Enterprise Risk Management's (ERM's) top risks, ensuring data validation and comprehensive assessments.
Proactively addressing repetition of mandates due to frequent personnel changes.

The transformation plan was a strategic endeavour that required time, clear objectives, and well-defined steps. For solutions by stc, a three-year timeline was optimal. Success hinged on full organisational commitment to a carefully structured long-term plan, underscoring the critical importance of dedication to achieving enduring change.