Holiday maker

As the holiday season approaches, most people start thinking about a couple of weeks in the sun. But, as Kevin Goulding, group head of internal audit at Dublin Airport Authority, explains,the season brings more complicated challenges
for those running airports.

9 July 2013 @ 11:14 in Features.

The airline industry has been one of the hardest hit since the global economic crisis gained momentum. While passenger numbers are moving back up to pre-2008 levels globally, profit margins have narrowed for most, and the environment is set to remain challenging for some time, according to the International Air Transport Association, the major industry body. 

Yet there are always some that buck the trend and succeed where others struggle. Dublin Airport Authority (DAA), which is state owned, but operates on a stand-alone commercial basis, runs Dublin and Cork airports and delivered a solid performance last year. Turnover increased by three per cent to €575m, while profits (excluding exceptional items) grew by 66 per cent to €43m. Group operating costs fell, while passenger numbers rose – 8.8 million passengers used the recently opened Terminal 2, which is driving the airport’s long-haul growth. 

So far this year, the positive upturn looks set to continue and there are signs that even more people will be jetting to and from the Irish capital over the summer.

Kevin Goulding, DAA’s group head of internal audit, is confident that the airports can cope with the projected surge in demand, and that the necessary controls are in place to ensure that passengers have a smooth journey and that internal audit is not run ragged. “Increased capacity and larger passenger numbers are always a risk issue, but the opening of Terminal 2 a couple of years ago reduced those capacity risks,” he says.

Care of duty

But Goulding’s internal audit team is working in a business that is far more complex than that of many airports. DAA has three strands to its operations. The most important and resource-intensive of these is running Dublin and Cork airports. In the past few years it has also developed a consulting arm that provides advice to airports that are, for example, planning to develop new terminals, facilities and business opportunities. Third, over the past 50 years, it has developed an enviable sideline in duty-free/duty-paid shopping with its retail business Aer Rianta International (ARI), one of the world’s largest airport duty-free and duty-paid retailing companies with an interest in 24 airports in 14 countries.

During 2012 ARI generated profits of just over€€27m. It saw strong sales growth in the Middle East and in India, where annual sales at its Delhi Duty Free passed US$100m for the first time. ARI also opened its first Chinese stores in 2012 and has recently been selected as the preferred bidder for the duty- free business at Mumbai’s new Terminal 2, which means that ARI will be operating the key duty free outlets at India’s two main international gateways. This will give DAA a very strong position in one of the world’s most important growth markets.

As a result, Goulding says that internal audit’s work is increasingly involved with the way that the business is expanding internationally. “Bidding for duty-free contracts is big business for DAA and the organisation keeps an ear to the ground to find out when a new opportunity might become available. Our work involves providing assurance on financial statements. In order to win these contracts, the organisation has to give guarantees and provide sound financial forecasts on the amount of revenue and customers it can bring in. We need to check the information behind those figures,” he says.

His team will audit the activities of each ARI subsidiary every two to three years. “This process is complex for a number of reasons. First, it is a question of resources. We have a small team so we need to ensure that resources are deployed in the most effective way possible. The other issue is that many of the ARI operations are joint ventures, and we may need to agree a ‘right to audit’ with the other party. Added to that, joint venture partners may have their own internal audit teams and external auditors, so sometimes we can leverage off their work,” he explains.

Fully automatic

Another area of financial risk for internal audit relates to loss of revenue or “revenue leakage”. “The financial controls we have in place are robust and the business model we use has been established for a long time, so we are aware of the risk profile,” says Goulding. “However, some of our invoicing involves a degree of manual input and that is a concern. The business is trying to automate more of these processes, and internal audit is monitoring progress,” he says.

IT risk is already at the heart of his team’s work. “Our business is very IT-driven,” he says. “There are around 180 different types of IT system across the organisation; everything from the usual desktops to check-in terminals, CCTV, security scanners and arrival and departure monitors. We have identified about 25 of these as critical. We have to make sure that these systems will work and that there is a back-up process we can switch to very quickly if anything goes wrong. Business continuity is a major focus for us.” 

To ensure that the risk of IT disruption remains low, internal audit has a policy of communicating the importance of “patch management” throughout the organisation. “It is hugely important that everyone is using the latest – and safest – versions of software on their systems, so the IT department sends out communications notices to remind people to install the latest patches made available by software providers to get rid of any vulnerabilities,” he explains.

Developing high flyers

Goulding believes that it is important for internal auditors to move into other departments in the organisation after two or three years. He also likes to “mix and match” his staff so that members of his team get to experience all aspects of internal audit work. “I don’t want people to be stuck looking at one area of work all the time, such as regulatory compliance. I want my team to be flexible and to experience the whole range of work that internal audit does so that they get variety, enhance their skills and can benefit the wider business if they move into another department in the organisation,” he says.

Goulding’s first dedicated internal audit role after qualifying was at paper and packaging company Jefferson Smurfit Group (now Smurfit Kappa), where he was mentored by a head of internal audit who constantly stove to make the function “best in class”. “That experience shaped the way that I think about internal audit a lot. My then boss always looked at what value internal audit could add to the business and he put a strong emphasis on having different skill-sets, and I share exactly the same view,” he says.

He took up the role of group head of internal audit at Dublin Airport Authority (DAA) in January 2012. Before this he spent over seven years at Kingspan Group, which provides environmental, construction and renewable energy products. He enjoyed
this job, which included setting up the internal audit and risk-management functions, but a seven-week spell in hospital after a routine appendix operation went wrong and nearly killed him put the constant travelling into perspective. 

“Around 96 per cent of Kingspan’s business was outside Ireland, so my work involved a lot of air travel. I felt like George Clooney’s character in the film Up in the Air – I always seemed to have a bag packed and I was constantly living out of a suitcase, collecting air miles and hotel booking points. My near-death experience put my lifestyle into perspective, and I thought I’d look for a new challenge that kept me close to home,” he says.

One of Goulding’s first tasks when he took charge of the internal audit function at DAA was to make personnel changes within the existing staff. “Over the previous three to five years some of the more experienced internal auditors had left the organisation to take up opportunities outside DAA. They had been replaced by personnel from other parts of the business with less traditional auditing experience, but with a great knowledge of the operation,” he says. 

“While their technical knowledge of the business was a huge asset, some of the team did not have all the requisite formal audit training and qualifications. Some of them had also been moved into the audit function temporarily and had stayed in the team longer than originally planned, so it was time to find new roles for them in the business. 

My approach is that the internal auditing department should be a springboard for new talent whereby recently trained and qualified auditors are brought into the organisation, and then move out into the business after about two years in audit,” he explains.

The redeployment took longer than expected, but Goulding says that he now has a team of five, including four qualified internal auditors. He is currently looking for an IT audit manager plus another internal auditor to focus on the international side of the business. This will make the team “about the right size for the organisation and quantity of work that we are doing”, he says.

His longer term plans could also involve internal audit working more closely with external teams. While he does not have a co-sourcing arrangement in place with any third-party provider at present, he concedes that he may look more closely at this option as the international side of the business grows. This could be particularly useful where the team needs local language skills, he points out. He also wants to build up the relationship internal audit has with external audit for “their shared mutual benefit”. 

“In my last role at Kingspan we carried out a number of joint audit assignments across the US business with the external auditor so that skills and experience were pooled and costs were reduced. In effect, for certain locations I ensured that the requirements of the external audit programme were fully covered by the internal audit programme and that work papers were robust enough to be relied on by external audit,” he says.

“It is more difficult to create that relationship here because external audit is statutory, there are issues surrounding independence and safeguards would need to be established. However, there can be real benefits from sharing certain work to minimise duplication of effort and to ensure there is sufficient leverage off internal audit work,” he adds.

Kevin Goulding in numbers

• 1998 to 2004 – senior internal auditor at Jefferson Smurfit Group plc (including secondments to the SAP implementation).
• 2004 to 2011 – head of internal audit and risk management at Kingspan Group plc.
• Jan 2012 to present – head of internal audit at DAA.
• He is a qualified accountant with the Chartered Association of Certified Accountants and part of the IIA’s heads of internal audit service

Black box: the business figures

Dublin Airport Authority (DAA) runs Dublin and Cork airports (Shannon Airport was ceded in December). In 2012 turnover increased by three per cent to €575m, while profits (excluding exceptional items) grew by 66 per cent to €43m. Group operating costs were slashed, running at eight per cent below 2008 levels when Dublin Airport was operating with only one terminal.Passenger numbers at Dublin and Cork airports were up by 1.6 per cent – equating to 340,000 extra passengers – while the number of long-haul passengers travelling through Dublin Airport grew by 16 per cent, owing to new capacity on routes to the Middle East and to North America. About 10.3 million passengers used Terminal 1 at Dublin Airport in 2012, while 8.8 million passengers used the recently opened Terminal 2, which is driving the airport’s long-haul growth. 

In the first three months of 2013 passenger numbers at Dublin were up four per cent and eight new services have started flying since the start of the year. The airport has secured new transatlantic capacity so that 224 flights a week will operate during the peak holiday season.