Yeah strikes! Because, with the right ingredients internal audit is indeed a force to be reckoned with! And owing to the conditions like organizational independence and objectivity of the approach, this is the only force that strives for sustainability, evolution and continual improvement.
Ingredients? Is it dependent on ingredients? Why is it dependent on ingredients? We’ll discuss all about ingredients later. But let’s first address what does a strike means (and what it is that matters!). And what does it entail followed by why its internal auditing that’s such a force.
A strike means everything from a literal meaning to what could be anyone’s imagination. Certainly, from the average internal audit client’s standpoint it is how worse things could get, but from the auditor’s perspective it is how far internal auditing could go professionally and ethically to make an impact for the better.
Imagining the impact of internal auditing work as being worse is typical of clients who are neither acquainted with internal audit nor willing to get along with it. These are not all clients. There are always those rare ones out there who think of internal audit as an investment meant to help safeguard other investments.
And that’s a rare breed for sure. Because that’s why internal auditing still needs regulation in many territories the world over to ensure its presence. Else while, it comes down to those extremely limited farsighted entrepreneurs who understand it’s imperative to have robust Governance, Risk Management and Control (GRC) systems in place to think big.
And GRC is strictly an internal audit forte. So, when it comes to these limited thought leaders, they never lose sight of what internal auditing is and what it offers. They don’t need regulation to have internal audit by their side.
From a professional internal auditor’s perspective, when it comes to the value adding prospects of internal auditing, sky is indeed the limit.
From assessing and helping improve Governance by the Board through reviews of compliances with regulation, statute and commitment towards key policies approved by the Board to development of Terms Of Reference for Board’s oversight committees, internal audit ensures its work offerings are fully aligned with Board’s expectations and requirements.
From determining business objectives, developing risk assessments, identifying risk universe and helping develop risk registers to identifying individual risks and mapping these to heat maps to ascertain their risk scores against tolerance and capacity thresholds, internal audit ensures the client never loses sight of its objectives and that the evolving objectives are always within reach.
From the identification of control requirements, recommending new designs and improving the control designs to reviewing the fulfillment of control objectives, conformance with control procedures and reviewing the impacts of controls in a cost-benefit analysis, internal audit ensures the client protects what needs to be protected and builds on its growth prospects while being fully confident of its control systems.
But these value adding prospects have a flipside for the typical audit clients. Yes, as it is said, the road to evaluation and improvement of GRC systems is not linear, for the clients who get to witness the worse it gets! To the vast majority of audit clients, the flipsides are undesirable by-products of internal auditing interventions. They are undesirable because they stem out of the internal audit’s independence and objectivity. And that’s how the internal audit strikes!
Let’s have a look at examples of such strikes from my CV:
- Suspension leading to eventual termination of a cash handling employee when cash-short was explained through a confessional statement to the internal auditor.
- Termination of all the sales team of a region when customers accounts debited with invoices were not being reconciled and internal audit found through product serial number reconciliations that the goods were actually transferred to other customers.
- Terminations of stores personnel on account of unreconciled short inventory explained only by confessional accounts of pilferages during physical inventory and quantitative reconciliations by the internal auditor.
- Administrative warning issued to the head of accounting by the Audit Committee of the Board on internal audit findings of non-compliances with established Internal Controls over Financial Reporting (ICFR), deficient Financial Statement Control Processes (FSCP) and exhibiting lack of understanding on how to ensure control objectives are met.
- Two grades demotion of a management cadre officer when his falsified and fabricated submissions of compliance to the regulator were unearthed by the internal auditor and reported to the Board.
- Immediate resignation of the top management executive having a 3-year contract after barely completing a year because of continual disregard (read violations) of established policies, employee code of conduct, undermining control environment by elevating cheats as advisors, diluting/twisting Board’s clear instructions, inaction on internal audit findings, internal control violations and confronting the internal audit when it escalated matters to the Board’s Audit Committee.
Thus, the internal audit interventions do not just come at those upfront costs of investments of having an internal audit function. There are these other costs to be paid. Interestingly, these costs are not to be paid by the client entities in the short term, but by the people managing the affairs of the entity. And at times these costs take the form of blood that’s shed if not tears!
However, client entities do end up paying substantial costs on account of governance failures and control environment degradations if actions are not taken soon. And such costs become existential eventually. And the early warning system is always available to be established in the form of internal audit. Being privy to everything internal, it is internal auditing that’s the force to be reckoned with!
But internal auditors pay certain costs too! Costs of making frenemies and keeping a working relationship intact with client officials. However, I am always willing to pay these costs upfront when a client tries to suggest limits on my independence and objectivity. Additionally, I also get to earn a prized scalp to my credit. Yes, as prized a scalp as a CEO too! I do understand at times, its not exactly the way an internal auditor desires a client situation to close, and the client executive might get lucky and get a face saving exit! But exit it is nonetheless and its enough to satisfy our professional appetite!
Ah well, the list of right ingredients?
- Board’s clear understanding of its Governance and Oversight responsibilities and the role Internal Audit plays in improving and perfecting these.
- Board’s close coordination of the internal audit function’s planning, resources, execution and deliverables aligned with evolving needs of the entity.
- Board’s guidance, supervision and facilitation of the internal audit function.
- Board’s separate meetings with the internal audit function and asking the function questions about management’s role and approach towards internal audit.
- Board’s decision on internal audit’s appointment and compensation.
- Internal Audit team’s continuing and evolving competence.
Yes! Board is where the internal audit’s ‘striking’ performance belongs and matters!
Remember I once shared a friend of mine recommended me to compromise my principles (by not reporting significant wrongdoings by the executive to the Board) so that I am not seen as playing in ‘someone’s’ hands?
Something I didn’t agree with because I wasn’t willing to play in his hands.
Turns out now that he has yet again switched loyalties and has started sucking up to that same someone (to keep his sorry a** in place). It was him who was playing in everyone’s hands.
For the sake of governance and control environment, it is imperative that such people are offloaded as soon as they’re recognized, because what they’re always concerned with is their job!
Need help in identifying such souls? Look no further than internal audit, since suckers always have spots reserved within repositories of internal audit findings.