How about a truth to power metric for evaluating the internal audit’s performance? How about a performance that evaluates the entity’s performance based on this metric? Isn’t the entity’s performance evaluated against its purpose, goals and objectives? Aren’t the systems of Governance, Risk Management and Control (GRC) wholly and solely responsible for enabling that performance?
Isn’t the internal audit work focused on the truthfulness of what these systems swear by to accomplish? Well, enough questions…. for now! Let’s break these down for answers. Some might wonder what’s the truthfulness in these contexts. Others might be puzzled to think how something that’s an objective in external audit reporting could be relevant to internal audit. So, let’s take on these.
Truthfulness of what the GRC swear to accomplish is:
- The truthfulness of the entity’s vision and mission to its purpose.
- The truthfulness of the entity’s goals and objectives to its vision and mission.
- The truthfulness of the entity’s Governance system to its vision and mission.
- The truthfulness of the entity’s Risk Management system to its goals and objectives.
- The truthfulness of the entity’s processes and its Control systems to its Governance and Risk Management Systems.
It’s all there; the truthfulness of the conceptual design and the truthfulness of the processes and systems to that conceptual design!
One might consider this truthfulness as alignment or conformance. And it relates similarly to the external audit’s reporting objective of expressing an opinion on the truthfulness and fairness of financial information against the financial affairs of the entity. But the objective here is the significance of truthfulness.
An entity (any entity) put up together with all its intricacies is inherently susceptible to the truthfulness of its components working in tandem. For instance, if the entity’s processes and its control systems do not align with the risk mitigation and governance requirements, they aren’t working to that end.
This way one can easily grasp how significant truthfulness of the execution (down at the process level) is to the ideation. The processes delivering value ought to be truthful to the vision and mission and thus the very purpose of the entity. If they aren’t, the vision and mission and thus the purpose cannot be fulfilled.
That’s the meaning of truthfulness. Staying true to the entity’s purpose means all systems and processes conform and align perfectly with the purpose. So, can the understanding of the people responsible for those systems and processes be untrue to the entity’s purpose? Can an entity accomplish its purpose if its management (the power; the ones appointed to carry out the vision and mission) have an understanding that’s not true to the entity’s purpose or the owner’s ideation of its creation?
Yeah, I understand, I added further questions to the many I answered already. But these ones are easier to answer. No entity could accomplish its purpose, if its people (assuming the power to run the show) appointed to fulfill that purpose have a different understanding of the purpose or they have some other purposes!
And when discussing truthfulness, it really comes down to this power. It’s the power whose staying true to the entity’s purpose, vision, mission, goals, and objectives matters for the entity to strive to accomplish these goals because the people gear the entity in that direction.
And it’s not just staying true to the ideation / concept and its components behind the entity. It’s also the brick and mortar responsible for realizing the ideation; the processes and systems. Staying true to the systems and processes and doing right by them is the only way the people power can steer the entity towards fulfilling its objectives.
For it is the processes and systems that ensure consistency and standardization even when those responsible for them come and go. In such a scenario, these ensure that the entity as a whole never loses sight of its purpose, vision and mission.
That’s also a lesson for those who still believe that formalization of operations through processes and systems does not drive the entity. As I have covered this in adequate detail and rather sarcastically here, the processes and systems are the execution of the purpose!
Now that we’ve understood the significance of truthfulness in the context of any entity’s context, let’s revert to the truth to power metric. This truthfulness needs objective and independent evaluation. So that this could be improved and perfected resulting in improvement and perfection of the realization of the purpose.
The only objective and independent function poised to do justice to the evaluation of truthfulness is inarguably the Professional Internal Audit. That’s not simply because of internal audit’s technical prowess in the evaluation and improvement in domains of the GRC systems responsible for realizing the entity’s purpose.
Instead, owing to its objectivity and independence, it is more about Internal Audit being well positioned to ask questions on the truthfulness, escalate matters to those charged with governance, raise voice against impairments to the truthfulness of processes and systems and outrightly call out falsehood.
Falsehood that includes:
- Ethical violations
- Malpractices
- Control Environment degradations
Undoubtedly, falsehood is most strongly manifested by ethical violations, malpractices and control environment degradations. This is because they result in misaligned vision, mission, goals and objectives. This is also because they result in deficient and impaired GRC systems and non-compliant processes and practices.
Internal Audit under the sole influence of enabling fulfillment of the objectives of the entity it is serving could be the strongest voice against falsehood. In fact, it has to be and it is! Even if the perpetrators of falsehood include the topmost management executives or members of the governing body, it is internal audit’s job to speak truth to power, unreservedly and unabashedly!
An internal auditor is required to speak truth to power unafraid of its consequences especially when the job could be a casualty. Because loss of objectivity and independence is a bigger casualty. It’s the loss of auditor’s identity!
Truth to power is a serious metric because powers seldom like to hear, see and understand truth. It’s because power makes its own truth. To power the truth is only what it wants to hear, see and understand. Truth that comes from others, especially internal auditors, is not something the powers are looking forward to.
But can that stop us? Can we be afraid of power? Could that ever be us?
The antonyms for speaking truth to power in the internal auditor’s context are influenced, spineless, unconscionable and timid.
An internal auditor can be anything but these!
Boards can set the truth to power metric as IA’s KPIs with evaluation criteria focusing on the nature of findings reported pertaining to governance failures, ethical malpractices and control environment degradations.
Alternately, the Boards can establish the antonyms as the IA’s KPIs with evaluation criteria focusing on the deficient audit planning, strategies, findings removed after draft reporting signifying influence / coercion, etc.
And for the sake of leadership that the Boards claim to represent, they should let auditors evaluate their governance failures and speak the whole truth about it!