Innovation drives the internal audit function of the future: Insights from BPER Banca’s chief audit officer

BPER Banca is one of Italy’s most important banks. While it ranks third by assets in the country, the bank is a top performer. Earlier this year, BPER doubled its dividends on the heels of its interest-rate management strategy. In one of the most uncertain economic times for banks since the 2008 global financial crisis, BPER stock is up 28 percent.

Designed to help decision makers protect assets and support operational resiliency, BPER’s internal-audit (IA) function, led by banking veteran and chief audit officer Roberto Rovere, has helped the bank adjust to business uncertainty. As risks have become more frequent and complex, BPER is thriving amid a challenging environment, partly due to the efforts of the organization’s C-suite and board and Rovere’s thirst for innovation.

Rovere took an unconventional path to his current role. He worked in multiple areas across financial services, a journey that fits his leading role at a bank with leadership positions in retail banking, corporate and investment banking, wealth management and insurance, employee loans, and consumer finance.

Rovere recently sat down with McKinsey partner Laura Webanck to discuss the changing role of the auditor and the IA function amid today’s headwinds. An edited version of their conversation follows.

Laura Webanck: Tell us about the journey that led you to this role as BPER Banca’s chief audit officer.

Roberto Rovere: I did not follow a typical career path. I took a cross-functional approach by working in consulting and various functions across banking—including organization, human resources, risk management, and compliance—before arriving in IA. Training, in particular, has played an important part in both my own development and [the development] of those around me. My different roles have provided a horizontal view of the banking business, which I believe has been quite helpful in becoming a chief audit officer.

Laura Webanck: Emerging risks are becoming quite material for banks today. As this continued evolution of the risk landscape is underway, how do you see the role of IA changing for banks?

Roberto Rovere: The risk landscape has changed dramatically over the last decade, especially since the COVID-19 pandemic. All these aspects—digitalization; innovation of new products and services; technology; market competition; environmental, social, and governance (ESG); geopolitical conflicts; and more—not only represent new risks but also require a completely new perspective and, therefore, a change of mind in our approach.

Given the frequency and impact of these risks, the IA function must be proactive and adapt faster, with a permanent anticipatory mood. The traditional and static audit life cycle is no longer adequate. Stakeholders—including the board, employees, regulators, and investors—expect timely assurance as to how banks will react to mitigate these risks. Thinking about an IA function that plays a leading role in the bank has helped shape our strategy for the future.

Laura Webanck: The complexity and the interaction of different risks are proving to be bigger themes. Would you say that they also increase the importance of the audit’s role, given your transversal view?

Roberto Rovere: IA is a function with a wide view across the bank. We must be able to provide an independent, timely, and complete view of the effectiveness of the controlled environment, rooted in a dynamic and analytical operating model. Our aim is providing stakeholders with the safer run and a well-understood operating environment across the group. Delivering transparency to the board, insight to the business and company, and a compelling proposition to our talent in audit are what we aim for. For example, who on earth, if not IA, can provide the board with a holistic and critical view of the execution of all the projects connected to an ESG strategy that, by definition, crosses the bank?

Laura Webanck: What are you trying to achieve now with the transformation of the audit?

Roberto Rovere: Our starting point was the traditional audit model. With a natural love for innovation, I foresee us leapfrogging from the past to the future. We wanted to design a path with a clear view of best-in-class audit practices around the world. With insights-driven data, we hope to change the position and the perception of IA of the bank across all stakeholders and also in the market to be attractive to talent.

Laura Webanck: What are some of the changes you are making within the IA function at BPER Banca?

Roberto Rovere: We had methodologies that were backward-looking and not reactive enough. Therefore, we were seeking a blueprint that would help the board’s steering capabilities, drive value for the bank, and align with the business.

This is why we are reassessing our audit framework entirely and moving toward an unconditional transformation journey made of four pillars:

1. promoting a dynamic risk assessment process, using predictive analytics for more timely intervention and with a forward-looking approach to risks and unexpected events
2. building up our dialogue with business through a convincing audit execution, driven by risk and data
3. improving the follow-up and reporting process, granting the best and most appropriate remedial action
4. with the aforementioned pillars leading to a dynamic and continuous audit approach, fastened by a close synergic approach with the bank’s chief data officer and chief information officer

Laura Webanck: What has the journey looked like thus far? How do you see BPER Banca’s audit transformation playing out over the next few years, and how do you think about transformation more broadly?

Roberto Rovere: Since the beginning, we knew that change within our audit function was necessary to manage, if not anticipate, future risks and help our businesses manage those risks. We are now seeing tangible results in efficiency and effectiveness, which is touching all parts of the bank. While still in the early stages, we are already getting the success we hoped for. These results are encouraging us to challenge ourselves further to continue down the path of delivering positive results.

Our “four pillars” transformation strategy is a three-year journey of 71 project initiatives that build upon each other. Many of these initiatives require close collaboration with other functions that can directly benefit human resources, information technology, data and modeling, and other second lines of defense. Nevertheless, we are building a future-proof IA function. The final key to our success is our ability to keep stakeholders updated on the progress made and the benefits obtained.

Laura Webanck: How have data and analytics benefited the audit function?

Roberto Rovere: Digital data analytics and artificial intelligence (AI) are improving our day-to-day life outside of the bank and within the IA function. We are convinced that data analytics and AI are the most powerful enablers to foster our vision. Predictive analysis will also enable an early detection of underlying risks. It is beneficial to redesign audit processes with better data, but it can’t be forced. Building a data culture is something that can benefit the entire function. As we look across our audit transformation, data has helped extensively in four areas: risk assessment, dynamic audit planning, risk-driven audit execution, and reporting. We are in the first year of our journey, and many of the solutions that we are delivering are prototypes that are not consolidated, but their accuracy and predictive power are already surpassing the previous ones.

Laura Webanck: How do you hire, train, and retain the right skill sets within the audit function?

Roberto Rovere: Skills and people are enablers of our strategy, with technical competencies remaining ever-important. As risks have evolved, so too has the need for soft skills, with a risk-focused mindset for flexibility, agility, and speed, to drive our transformation efforts. Auditors should ask themselves, “What could go wrong?” While the question appears quite simple, the answer is the core of our job since it helps foresee risks connected to the processes.

Communication skills are a powerful tool in our path to change the perception of IA across the bank. Only with clear communication can we explain and effectively validate our value with stakeholders. This constant and constructive communication of risks has been instrumental in our ability to add value to the business and across the organization.

These are the qualities we are both looking for in the candidates we select from the market and improving with tailor-made upskilling programs for our team.

Laura Webanck: What has been, or do you expect will be, your biggest challenge in this transformation?

Roberto Rovere: Initially, I thought that the injection of technology and advanced use of data in our processes would have been the biggest challenge. After six months of our transformation journey, I found out that the biggest challenge is our cultural change. As we integrate existing staff with new team members, we are breaking some rigidity through our change management process, and we strive to create a place where each colleague can learn and grow as a person and accomplish something meaningful. Integrating people with different backgrounds belonging to almost five generations—from boomers to Generation Z—in a changing working framework is proving to be tough but also exciting.

Rovere encourages other chief audit officers to be brave. “Try to imagine your future goals by trying not to look to the next corner but at least to the next three corners. Doing so, you discover that it is a journey, not a task.”