The non executive nature of internal audit can be problematic. This vexes many of my professional colleagues as it seems to stop them doing all sorts of things: re-reviewing their own work; getting usefully involved in project assurance; debating how frequent should auditing be before it becomes ‘management assurance’ as opposed to audit; and most tellingly being confident enough to have an opinion on the business as non experts.
So if we are non executive and we are non experts what do we bring to the party? Well if we allow our own insecurities as a profession and as individuals show, very little. I trained with one of the big four accountancy firms. Despite having my first three years telling me what I could and should do and file structures and sampling methodologies pushed down my throat, I survived this to make it to manager. Now, suddenly I found the game changed, it was not about what you couldn’t do, but what could you do. Can you ‘get things done’. The reward was not for being ‘right’ and ‘technically accurate’ but for social skills, responding to clients’ needs and making stuff happen through others (your team) and bureaucracy (even the private sector has that). I then took up the opportunity after that to head up my own in-house audit service. I took this not for the pay or reward (definitely not!) but for the chance to establish my own modern vision of internal audit without constriction and rules. Thankfully I had the benefit of an excellent colleague who went on the intellectual and experimental journey with me. We both studied with the IIA (use the UK one it has an excellent set of qualifications).
Yet the profession as a whole is still stifled by a need for rules and guidance, not a sense of pragmatism, adventure and contingent, principles-based delivery. For here is the key lesson in my view. A good CAE should have confidence. Not arrogance, as we are a fellow and complimentary part of the organisation’s governance and management structure. Think about managers for a moment. They have no rules – management has no intellectual orthodoxy or must-do approaches. No prescriptive rules. No even principles based international standards. Yet managers everywhere are held firstly responsible for all of the things we audit. To succeed in management you need a can-do attitude. A sense of confidence and self-belief. Not qualifications or rules.
So for internal audit. We share manny of the resources as senior management have to address and tackle the management problems of the business. We have a broad remit; cross cut at a strategic, tactical and operational level; have access to the senior people and governors of the business; are able to say and write what we think; and are able to look at a wide set of skills and activities to address problems. Yet we have something more. Freedom from accountability for the results; a systematised and disciplined view of the world; a good understanding of finance and risk; a requirement to formalise our thinking within a reported format; a need to form opinions and step back from day to day activity.
This is what internal audit brings to the party. Management with an intellectual and rigorous structure. I come back to where I started. The key lesson I have learnt is to have confidence in myself and my profession. I have learnt time and time again that a good internal audit review will be prescient and meaningful. How many times have I predicted something will go wrong and, eventually, it has. This re-inforces my view that as generalist and inexperienced I feel at the start of each review, that managers are in exactly the same position. They may internalise the language, social totems and symbols of their work, but this gives them problems, not advantages, when solving an organisations’s problems. This baggage can be a barrier, not assistance to move forwards. Internal audit’s obsession with objectivity and independence is helpful and welcome, because it keeps us sharp.
So what stops internal auditors bringing this value to the party? Confidence. Have confidence in common sense. It is not common. It is the key thing internal audit brings. So go forth and take the confidence with you!