So we read in the UK IIA’s magazine this month about an internal auditor adding value by having people from the business involved in internal audit. In this case at Shell. http://auditandrisk.org.uk/features/he-can-be-sure-of-shell
Now this makes perfect sense. Of course an auditor will be able to have better risk based discussions if they understand in detail the business they are auditing. But read further. 85% of the audit team is rotated. That’s a huge amount. Where is the core audit skill, training and management there? Will this lack of audit skill really make the audit better?
But read further and it becomes clearer. ‘So we bring in experts whom we train to be internal auditors in six months’. Really? Is internal audit nothing more than a few skills or conflict resolution, report-writing, analytics and interviewing (as posited in the article)?
All of this is done to improve ‘credibility’. As somehow ‘just’ an internal auditor is not credible, or incredible (not in a good way). Look at the subtitle of the article on the front page about ‘how a constant flow of new recruits from the business helps internal audit generate value’. That is the gold (or black and gold) statement. Internal audit per se does not add value. Then if we are left in any doubt whether this view is taken in Shell we learn that the chief internal auditor has had a long career as an accountant in Shell. It is not possible to tell from the article or the internet, whether he is IIA qualified. I hope so, but the audit approach does not suggest a career auditor.
So what is my issue with this? It’s clearly a valued IA function. It works in a complex business. It is clearly sensible to have a guest auditor or rotation scheme. Well my issue is intellectual and more fundamental than that. It’s about the internal audit profession learning to have confidence in itself. It does not need to be something else to be of value.
First, let’s take the idea that internal audit is of no value per se. Well the knowledge that a guest auditor scheme brings is context dependent knowledge. That is experience, skills. In a business like oil I imagine understanding how stuff is ‘done’ is quite important. Internal audit is more than that though. It is also context independent knowledge, the ability to analyse, think about risk, be cold and detached, objective and independent. I suspect Shell pays a reasonable sum to consultants like Boston Consulting, Bain etc. Why? If you need context dependent knowledge to analyse a business, add value and be credible, why do this? It is because being professionally trained to analyse a business is important and is a skill of value in itself. The joining of context dependent and independent knowledge is a tough skill that few internal auditors (myself included) fully master, yet alone an oil engineer on a one year secondment.
Second the conceptualisation of internal audit as needing to really understand the business’ detail to be able to add value. Well, although I believe independence to be a state of mind, not fact, there is a sense in which that fresh challenge is missing when someone comes from the business. It doesn’t matter what the business is, or whether it is complex or not, we are all human and therefore carry with it a lens of understanding we gain through being socialised in a business. It takes strong professional training to fight this innate human tendency. Thus those from the business will have a view about ‘how things are done’. Some of the best auditors I have known have a great ability to play ‘dumb’, asking the most fundamental and ‘stupid’ questions that the business is either not able or not willing to ask itself. This is often the core value of a good internal audit function.
Third the model of internal audit as a business embedded and engaged is a good one. Here Shell do get this broadly right. The old ‘them and us’ management and internal audit model is unhelpful. But for a partnership and embedded model to work, both parties need to value themselves. I bet the finance team in Shell do not rotate their staff so much. They believe they can add financial control and value through using their professional skills without having 85% of their number as engineers on secondment in finance. So why not internal audit? Internal audit has value through its mindset; its wide-ranging coverage; its strategic, tactical and operational focus; its freedom from executive accountability (with its pre-destined focus on managing issues, not risk); its analytical, interview, influencing and reporting mindset; and its independent and objective mindset. Mixing the professional and technical silos in any business is good, but this must be balanced.
Fourth, what is it that general management bring to the table that is so much more than a professionally trained auditor? Most managers understand in detail their operational business, but often have few, or limited general management and professional management training. Does this not mean internal audit, with its wide-ranging, strategic and cross business coverage, professional business and risk training, and experience across the whole business, not a single professional or operational silo, should have at least something equal to bring to the table as the manager of a function or operation?
I am of course taking the article at face value (they are limited for space) and many of these points may well have been considered by the Shell team and overcome. My overriding concern is that internal audit, as a profession, must get more comfortable in its own skin. It must value itself without becoming either more like management or more like consultants. It is a ‘professional dysmorphia’ that will prevent the profession from self actualising in the long run.