I am cracking my way slowly through a PhD – bizarrely in marketing (don’t ask – it’s a subject that fascinates me and is I think a much neglected concept to be studied critically). As part of this I am working with three case study organisations. They are very diverse, large, complex and high performing (in their fields of expertise). It is nice to be able to spend some quality time with some diverse organisations.
What has struck me in various conversations is how all organisations need a critical eye. They need a party that is knowledgable, confident and capable of understanding how the organisation really works to challenge them. This challenge needs to be done after the manner of a friend – robust and direct, but with understanding and compassion.
So many organisations reach out for this robust and critical challenge that really says what needs to be said, but struggle to obtain it. They employ consultants who tell them what they want to hear (they are the people paying of course), or tell them nonsense (because they have not really understood the question / organisational context). Or they submit to inspectorates with reporting and agendas that will play out in the public domain, meaning the result is either made bland or are driven by other organisation’s views of the world. Both of these methods of feedback can, of course, work. Yet in practice they do struggle to consistently and helpfully challenge organisations in a way that enhances, builds and moves their client organisations on.
I believe good internal audit can do this. Good internal audit, that is accepted by the client organisation as a friend. For only once an organisation loses its inhibitions can it truly have an honest and open discussion with its internal audit service and itself.
Yet accepting this level of feedback is tough. Tough for the organisation as a whole, tough for the individuals within it (many of whom believe criticism will be career limiting). Most of all tough for those who govern the organisation. For it is difficult to accept that something you direct and control is suboptimal, let alone, poor performing, and those charged with governance are accountable for the organisation’s failings after all.
Yet this is also tough for internal audit. As a CAE my preference is to deliver thin reports, spreading good and positive assurance news. Shorter to draft, easy to quality assure, easier to deliver, positive response from all parties etc etc. Being a challenging, difficult, bad news-delivering, argumentative, stroppy CAE is not easy nor enjoyable! Choosing which items to deliver and in which order – much more challenging and difficult.
Yet, if an internal audit function can get its client organisations into a good space where both parties take the pejorative element out of internal audit and the process of review, then there is a better outcome to be achieved. This requires both parties to see issues and risks in objective terms, to accept that both risks and occasionally issues, arise in a resource constrained, complex and challenging world. If internal auditing can be seen as a collaborative process to lay bare reality, with a view that the process itself, even before an outcome, is cathartic and useful, then internal audit can really leverage its USPs (unique selling points).
For internal audit is uniquely, independent and objective, yet engaged, interested, supportive, and understands its client organisations. So, objectively speaking, where else, either inside or outside of the organisation, do you get this confluence of unique features?
So when I am in conversation with an organisation and they ask for a source of objective but supportive review and challenge – I shall say – look no further than an excellent internal audit service.