Home > Risk > Boasting about internal audit value

Boasting about internal audit value

January 30, 2020 Leave a comment Go to comments

Richard Chambers, President and CEO of the global Institute of Internal Auditors, is a friend whose leadership at the IIA and of internal audit practices I value and respect.

Recently, he wrote a blog, One Mistake Internal Audit Cannot Afford to Make in 2020.

Please read it and then consider an alternative view.

If we are focused on communicating what we consider to be our value, are we not boasting?

Do you respect people or organizations that boast about their value?

I 150% agree with Richard that internal audit should “obsess about the value we deliver”.

I also agree that there are “countless internal audit departments that were simply ‘checking the box’ in executing their mission”.  If they are checking the box and not focused on delivering what they are capable of, they are not going to be valued by the board and executive management of the organization. They will be a target for downsizing, or at least unable to get the funding they need even in good times, because leaders don’t see the business benefit.

But what is that value? How should it be identified and valued?

The value of internal audit can only be measured through the eyes of our customers!

The value of anything is only what the customers would willingly pay for it, because of the benefit it provides.

Richard gets this right when he says:

“Your key stakeholders have the last word on whether you are doing your job well. And they judge an internal audit function not by how well-run it is, but by the value it generates for them.”

When I finish a speech or training class, the organizers often ask me how I think it went. My answer is always that we will find out when we hear from the audience, my ‘customers’.

Do I tell my customers how much value I just gave them? No. I ask them how much value they derived from my presentation.

The same thing applies to internal audit.

If you feel you have to tell the board and top management how much value you have delivered, it seems obvious (and sad) that they don’t already know.

They don’t already know:

  • The value of the assurance you have provided them of the adequacy of the systems for managing risk and internal control, and whether the more significant risks are addressed by effective and appropriate internal controls
  • The value of the insights and advice you have provided, both formal and informal, to management (at all levels) and the governance body
  • The value of the actions that your work has stimulated; not the recommendations in your reports but the actual change that was made. Recommendations that are not seized by management as opportunities have little value. In fact, recommendations that are ignored because they don’t seem ‘right’ to operating management have a negative value on the reputation and standing of internal audit.

While we might have an idea of where we have added value, even some idea of the magnitude of that value, only the customer can place a value on our work with any degree of accuracy.

Providing a report or other communication to leadership that tells them our valuation of the work we have done is not only boasting but lacks credibility.

Your value is what people would be willing to pay for it. It is not what you say it is.

So let’s turn the question around for a minute.

Instead of asking whether the board and top management know what our value is, ask DO WE KNOW what our value is to them – in their eyes? If we do, are we maximizing that value? If we don’t………

Richard talks about the fact that different people in leadership judge the value internal audit delivers based on their “value premise.”

But instead of telling them what we consider to be our value, we should find out how we can be of greatest value to them.

If they don’t understand the value we can contribute, we should have a conversation with the objective of obtaining a mutual understanding of how internal audit can and should add value to the organization as a whole and to each of them individually.

Don’t just tell them. Discuss, listen, tell your story and your ideas, and agree. Help them see what you can do while understanding what you can do (differently, perhaps) to create value in their eyes.

We should obsess about delivering that value, rather than on promoting (boasting) how good we are.

The best way to make sure the board and top management understands the value is to:

  • Deliver the value (i.e., execute) and
  • Have happy customers who boast about it.

I remember a time when the retail arm (primarily Circle K stores) of my company (Tosco Corporation) was going through some tough times. I was at an executive committee meeting when somebody asked if internal audit was going to be asked to cut our budget. Several executives spoke up, telling the CEO and others that rather than cut internal audit, they wanted to increase our budget.

When we had an audit committee meeting to discuss a serious issue, I had the operating unit executive attend and we jointly communicated both the severity of the issue and the actions that we would or have already taken. (I say ‘we’ because internal audit is part of the organization, despite what some assert or imply about our independence.) Both executive management and the board members can see us adding value – but only they can place a value on it.

That’s not to say I don’t make sure that my customers get the information they need to understand our value.

I don’t think we can put a value ourselves on assurance, advice, insight, or even business process change.

But we can ask the customers if we are adding value; often we can find a way to have them put a value on it. Then we can ensure that information is summarized for top management and the board.

At Tosco, I had a large part of my organization (28 people) auditing contractors. The team agreed with our customers on the value of each contract audit, generally the monies returned or costs avoided, and this was summarized in periodic reports to management and the board.

I close with three stories.

At Tosco, I asked the CFO for his assessment of the team’s performance and value over the last year. Jay Allen, a brilliant man with a dry sense of humor, said, “Keep it up or your fired”. He then gave me a huge bonus, so I could value my work.

I asked the chair of the Tosco audit committee about the team’s performance. He said, “You help us sleep through the night”.

The CEO of our largest division told the governor of the state of New Jersey that internal audit gave Tosco a competitive advantage.

I value those appraisals, as well as the fact that our customers continued to fund internal audit faster than the rest of the organization.

What do you think?

Obsess about communicating value? Or, obsess about understanding and then delivering the value our customers want – and letting our customers understand and appraise it.

  1. John Fraser
    January 30, 2020 at 3:49 PM

    Different customers can have different responses for the same piece of work, e.g. the audit reveals major incompetence and opportunities for increased productivity. The Manager is fired/demoted. Who is the customer and what is their evaluation?

  2. Ramon
    January 30, 2020 at 4:52 PM

    I wonder if what we really need to do is to first understand how internal audit will bring value to the shareholders and use that framework as a talking point with management to ensure internal audit work takes into consideration all stakeholders.

    • Norman Marks
      January 30, 2020 at 4:53 PM

      Yes, but do we decide or do we ask them and discuss?

      • Ramon
        January 30, 2020 at 5:07 PM

        We ask/discuss/talk/meet/ with all stakeholders and every time the organization takes on new risks we again ask/discuss/talk/meet/ to ensure we consistently focus on what stakeholders need from internal audit.

    • January 31, 2020 at 6:15 AM

      Great Point Ramon, this question is exactly what created an entirely new Book in Sawyers 7th Edition – Enhancing and Protecting Organizational Value. In 2017 as a member of a National IIA Committee I chaired and effort to redesign and write Sawyers. The new book is intended to describe IA value delivered over time by introducing 5 generations of products and services in Chapter 2. Chapters 3-5 then discuss people, process and tech that has to be in place to deliver them. And Chapters 10-12 discuss how risk assessment, audit planning and internal control are defined in each generation. So the framing you imply is available.

  3. Michael Corcoran
    January 30, 2020 at 6:31 PM

    I have never seen an internal audit function that meets or exceeds all of the professional practice standards. That is the one KPI that by design by the IIA professional body would measure value for company stakeholders. However, while the IIA can measure corporate governance, they can’t even measure internal audit department effectiveness. Maybe we get some university to take it up.

    • January 31, 2020 at 6:18 AM

      Good point Michael, which is a key reason for Sawyers 7th Edition… it frames value and discusses the need to not govern the function from the standards, because that is governing from behind. Rather aspirationily look to the opportunity laid our in the Mission statement

  4. January 31, 2020 at 3:09 AM

    The value that internal audit brings to the organisation should be judged in the same way as for any other function. Does it help the organisation achieve its objectives? This judgement will be based on what it delivers: opinions on whether risks are being managed down an an level considered acceptable by the organisation – thus allowing the audit committee to ‘us sleep through the night’

  5. January 31, 2020 at 6:24 AM

    Internal Audit has a challenging role and if we truly see ourselves as Executive Advisers of Governance, Risk Management and Internal Control we need to know Value from two perspectives. 1. First we need to know what structures, ideas, practices bring the most value and we need to educate and advocate those. 2. We need to know where our Customer is and how capable they are of taking the next step. Then we need to fill the gap with information and help them take it. Together those two things create value.

  6. February 4, 2020 at 8:57 AM

    Norman, your post could not be more timely. We just had an external review of internal stakeholder perception of our value. You are right in many respects – value is in the eyes/perception of the customer.

  1. February 5, 2020 at 5:24 AM

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.

%d bloggers like this: