Internal audit is important because organisations cannot govern themselves. A bold statement no doubt, but one I have found to be true in my career experience to date. Management teams, in my experience, risk falling into a number of traps. First self aggrandisement. Not fraud or theft, although corporate scandals are littered with this. Not out of proportion rewards for senior executives unchallenged by so called ‘non executive’ and ‘independent’ board members – and this I have seen in most places, including the public and not for profit sectors. I refer instead to the fact that senior management teams cannot be ‘strongly objective’ about themselves or their organisations.
Erica Schoenberger, in her book regarding corporate culture, points out that senior managers simply begin to either to believe their own hype, or are unwilling to change the benefits and position that they have personally to allow necessary change within an organisation. She uses the example of big american corporates of the 1970s, in particular General Motors (GM). She argues that whilst senior executives can begin to see the problems of change and market positioning, they will change internal structures, will focus assets, develop new lines of business etc. but they are not able to relocate the business overseas, move away from core locations or make the changes that are really necessary. In other words, the executive turkeys are not willing, ultimately, to vote for Christmas, no matter how objective, strong or compelling are the reasons to do so.
This brings me back to internal audit. Its core strength lies in the ability to say what must and should be said. When I worked for a professional services firm, I think I often confused being client-focused with being nice or polite, and I avoided difficult and challenging messages. This was normally with a well-founded fear that senior managers of the client organisation would re-tender the audit service, often with a sole objective of removing a difficult audit team or auditor. In fact I confused who was the client. The real client was the body corporate, the organisation, and internal audit should say what needs to be said, not what is polite, or unchallenging, or comfortable.
One of my biggest professional regrets was to not consistently point out where governance was failing. Merely to hope influencing over a long period of time would resolve the issue. Governance is the most difficult issue to address, as the auditor has few friends when doing so, either senior managers or the board. It is also the issue that is the most pernicious and regular I have seen in my career, perhaps for this very reason. Audit committees that become ‘cheer leaders’ for management, or just as bad go into a checklist mode of meaningless compliance checking (Hanif Barma of Independent Audit Limited has produced some good, readable, work in this area). Non executives that do not really understand the business and challenge and hold to account senior managers in constructive and supportive ways is another area of concern I have seen.
Internal audit is the one force within an organisation, particularly if in-house, that can really say what it means without fear of reprisal. In fact a good senior management team and board should find their auditors giving them tough love. All organisations need it and it ultimately protects and supports them in their role.
If we think of this in personal terms, the really best friend is the one who tells you when you are making a mistake, being ridiculous, or getting a little fat and need to exercise. You don’t like the message, you don’t initially agree, but you know at that point that they are a trusted friend and listen all the same. In time you think about the message, digest it and act on it because you know they are on your side (whilst often still not agreeing with them). You then correct your mistake, get perspective, or exercise a little and ultimately feel a little better.
So my call is for internal audit to step up to the plate, say what needs to be said, as a friend. I also suggest that boards and senior managers all adopt internal audit as their new best friend.