I am on the board of a number of organisations, an international non governmental organisation, a UK national charity and world-class higher education institution. I also work in my day job with a huge range of organisations and their corporate structures. These organisations have a range of internal audit provision through to none. Where there is internal audit it adds value, in whatever form.
Organisations go through life cycles, and the bigger, more established and complex they are, the more they benefit from a good internal audit. They benefit because organisations under-resource corporate functions. I understand why. Corporate functions are overhead. They don’t make stuff, they don’t sell stuff, they don’t speak to customers, they don’t deliver the cash earning product or service.
Yet, when an organisation gets to a certain size, it ceases to be controllable by people, either one, or a few. The span and depth of control is too much. Culture helps, but is difficult to deliver and control. This is where good strategic internal audit comes in. Not the compliance or two dimensional internal audit, but one that asks the really difficult questions and one that has coverage from the strategy down the organisation into delivery.
Good internal audit says the unsayable. It challenges group think. It systematically looks at the organisation (and yes in depth and breadth, not just six top level reviews a year). It goes from the strategy and follows that through to the floor, to the way the organisation is seen by customers, beneficiaries and stakeholders. For only when you have enough time and independence to look objectively at the organisation can you really form a view over how it is really working.
So why heavy lifting? Well for me internal audit is the organisational equivalent of going to the gym. It is the organisation trying out its parts, putting them under pressure and isolating them (as you do with weights at the gym) to see if they work. This process of putting them under pressure identifies sometimes big problems and weaknesses, but most of the time there are lots of little things that could be better and fixed. That’s how you grow muscles at the gym, through the precipitation of lots of ‘micro’ tears. These repair and the muscle grows and that part of your body has greater capacity to lift more. So it is with organisations and internal audit.
Just like going to the gym, it can be aversive for organisations to face the challenge of internal audit. Most organisations have developed the optics of public and reputational protection. Too often that becomes internalised and the top management team loses its openness to challenge. The press lines replace reality. Sure being told something is not good, or having an alternative perspective is challenging. I know that as a leader myself. Being open to challenge is not easy or pain free sometimes. It is something I and I think organisations must continually work at.
Internal audit’s role is to ensure the organisation has plenty of capacity to run to keep up with competitors. It should be the gym instructor counting out the ten press ups and putting the extra weight on the bar. Don’t get me wrong, most great management teams I’ve worked with do the same with their strategies. What they don’t have is the capacity and time, however, to test this down the organisation, to follow down the delivery and control chain. Internal audit is set up to do that.
Of course internal audit needs to know what organisationally ‘fit’ looks like. So you need a breadth of generalists, specialist and range of professional backgrounds. You most of all need a mindset that is willing to put up with the gripes and moans of the organisation as it is at the ‘gym’. This requires auditors to be fairly strong and resilient in the face of challenge, without being closed to it.
Just like a good gym instructor, you get what you pay for. A cheap service benefits you less. Similarly doing it without a good gym does not work, so home exercise is possible, but rarely takes you forward. So it is with internal audit; organisations need to invest time, resources, energy and engagement to really benefit. As an internal auditor I’ve met fit and unhealthy organisations. Unhealthy ones are flabby, inefficient and lazy, and so the role of audit is harder (most notably on the engagement side).
So next time you engage your internal audit team, think of it as being like exercise. It’ll be challenging, difficult and hard work, but you will gain the pleasure and endorphins that result and be more efficient and effective as a result – a real win!
So when will you next train and get those IA gains?!