I have always thought of good internal audit to be much like how I imagine a catalyst works in chemical processes. I say imagine, as I left my education after GCSE level (end of high school around the age of 16 for my international readership), so as my science degree colleagues will say, I am no scientist.
For me a catalyst has a number of traits that are similar to internal audit within an organisation. First, they promote substantive and substantial change. Their presence creates a circumstance that makes change both possible, likely and in some cases, inevitable. I see internal audit in these terms. Far from the blocking, barring and dis-enabling role that audit is sometimes credited with, it should take a role to promote, facilitate and sometimes demand, change.
Second, a catalyst creates and promotes this change but does not get involved; it is not doing the change itself. This has lots of similarity in my view with internal audit’s role being non executive. I am not an Institute of Internal Audit purist, regular readers of my blog will realise that I take a ‘what makes sense’ approach to my work, in that I do not believe in the long list of purist bans and admonitions against action that the the IIA believes. Sure I believe in being non-executive, but I would like to temper this with some practical pragmatism. If internal audit is the only or right party in a situation to get the organisational good done, it should do so. Sure it should not do it for ever, nor ever take a risk treatment decision itself. It should, however, provide plenty of consultancy support, advice and encouragement to make itself helpful and relevant to the management team. For it seems obvious to me that if the management team had capacity to do something, then the opportunity for internal audit should not be there in the first place.
Third internal audit should promote, as a force itself, change in an organisation. If the best internal audit can do is reportage of organisational atrophy and failure, that’s not much of a value proposition. One has to be careful that this promotion is not one of its own making, or in other words, pursue its own agenda. Ideally this should be something mandated and directed by the board. If not them, the senior management team. If the reason change is needed is because of these both, then the organisation should be served by an objective audit function stepping in. I would suggest, however, this should be a last resort. Only in extremis should internal audit step in in this way.
Fourth, I always imagine that catalysts fizz when they react. In my experience a little manageable creative tension is important when internal audit interacts with the organisation. Clearly something explosive is unhelpful. Although I guess where an organisation needs substantial change, perhaps a big bang is required. I would hope, however, that if an organisation had functioning governance and internal audit, then this level of crisis should, generally, be averted. So a good internal audit function should provide a little light, heat and fizz, to promote cathartic organisational change.
Fifth, catalysts work because they have the right connections, structure and composition to work with the other organisational components to deliver change. In particular a catalyst needs to adjust to the context to be effective. So a good internal audit function should be constantly adjusting, constantly sensing and adapting and having a learning approach to what it does. It should do this because internal audit should always be a force for positive and engaging change, development and enhancement.
I believe and have stated on this blog many times, that I believe internal audit has a potential to be transformative to organisations. In particular I think internal audit has the necessary position, floating above the organisation, yet part of it; and with the right skills and connection to governance and senior management; to really promote good organisational change. So, consequentially, I think the role of being an organisational catalyst is commodious to internal audit.
So how can internal audit play this role? I think first internal audit needs to increase its capacity beyond compliance. Internal audit needs to be fully risk based. This means engaging in an organisation’s key challenges; being in the middle of the key debates; providing an in depth but also organisation-wide understanding of the organisation; high quality staff that can think off-piste; and most importantly an ability to sense and understand organisational priorities.
It is this last bit, sensing of the organisation that is both the most needed but also the most challenging. Most needed, because it is easy for internal audit to retreat into an objective and independent white tower turret. I say most challenging, as organisational ebbs and flows and politics are notoriously difficult to interpret and understand and even harder to work with and address. As I’ve written on this blog before, internal audit should at least understand, but remain aloof and disengaged from, organisational politics. For if internal audit is to promote change as a catalyst, it needs to understand the politics pro and anti the change, and also the underlying business of environmental need for it.
So for internal audit to be transformative, a proposition I firmly believe, it needs to be a catalyst. I’m sure the chemists out there amongst you will point out the deficiencies in my scientific knowledge, but as a simile or metaphor for good internal audit I think it stands. Do you?