Home > Risk > The Culture of the Audit Department: Cop or Consultant?

The Culture of the Audit Department: Cop or Consultant?

September 26, 2022 Leave a comment Go to comments

I had the privilege of working with Mike Jacka as a member of an IIA International Committee for many years. He’s not only smart, but funny – a great speaker if you can get him.

He continues to write for the IIA’s magazine and blog.

His latest is Mind of Jacka: Not Quite a Manifesto.

Mike shares an interesting list of what he calls “the more intangible, human elements that allow us to function amid the contradictions that define our profession. To quote a fairly famous document, we hold these truths to be self-evident.”

I agree with the underlying premise, that internal audit exists to help the organization and its leaders succeed. It’s not about finding fault. It’s not about making ourselves look good and boasting about how much value we deliver.

While there are times when we have to be the cop, finding serious issues that threaten the success of the organization, most of the time we should be the consultant, providing valuable assurance, advice, and insight on what matters to the success of the organization.

Some auditors prioritize finding fault. For example, I knew one CAE who told his team that an audit report with no findings was unacceptable.

These auditors will not gain the trust of management. They will not be seen as helpful, only as potential impediments that consume valuable time.

Management will hide things and certainly not invite them in. They will resist and not be interested in working together to identify the best path forward.

I don’t believe in that approach, that mindset.

Do your testing and assessment with the objective of confirming everything is ok, rather than to find fault.

Recognize that success is a shared success – the success of the organization.

Here’s Mike’s list. I have highlighted my favorites.

  • We want to make things better.
  • We want to make our departments better.
  • We want to make our profession better.
  • We want to make our organizations better.
  • We want to make ourselves better, as well as those around us.
  • We are partners with the organization and the people who work within that organization.
  • No matter how much we are battled, beaten, and bruised, we still recognize that we are partners.
  • We have our egos, and we succumb to them, push them aside, or use them to become better.
  • Our clients have their egos, and we bow to them, fight them, or use them to understand how we can better work with those clients.
  • We take an active role in the success of our organizations, not sitting back and letting events happen around and to us.
  • We have a unique blend of skills, access, and opportunities.
  • We grab our opportunities, allowing us to place ourselves into the consciousness of those with whom we work.
  • We don’t have all the answers.
  • Sometimes we don’t have many answers.
  • Sometimes we don’t have any answers. And there is nothing wrong with that.
  • We are salespeople.
  • We are selling ourselves.
  • We are selling assurance.
  • We are selling improvement and betterment.
  • We are not selling a report.
  • We know we can count on each other — as professionals, as businesspeople, and as human beings.
  • And, ultimately, we are nothing more than people working with people to raise the bar in everything that is done.

I expect some will say that some of these are wrong, because we must be both independent and objective.

Yes, we must be independent within the organization, and we must be objective in our assessments and reports.

But that must not interfere with our ability to help the organization succeed.

We need to have that mindset and have it drive our actions as auditors and trusted advisors to the business.

Don’t be the person who is seen as always finding fault.

I welcome your thoughts.

  1. September 26, 2022 at 9:12 AM

    ‘ I knew one CAE who told his team that an audit report with no findings was unacceptable’. It’s a pity that CAE didn’t appreciate that there is always a finding even if nothing is ‘found’ – that the organisation’s objectives should be achieved because opportunities and risks are being managed to levels acceptable to the board.
    Norman and Mike – keep up the good work!

    September 26, 2022 at 9:27 AM

    Spot on, I don’t even need to comment, well said.

  3. Brahamanapalle Murthy
    September 27, 2022 at 8:12 AM

    In my 30 years of audit experience I will tell in simple terms, the dictionary meaning of the word “catalyst”
    You can describe a person or thing that causes a change or event to happen as a catalyst.

    An internal auditor role is to bring in desired changes positive – to improve the operations, deterrent – to stop activity which is not in line with organisation objective or statutory noncompliance.

    • Norman Marks
      September 27, 2022 at 8:18 AM

      I like and have used the phrase. However, it is important that any (chemical) reaction is controlled!!

      • Anonymous
        September 27, 2022 at 10:36 PM

        Thanks. ya of course, that is why the monthly review meetings and Board supervision is there.

  4. Rahul Ranjan
    September 29, 2022 at 6:10 AM

    Indeed. If we look the new three lines model by IIA, it acknowledges that internal audit has continuous interaction with other lines. It means a more active role in having things rights at the very first place rather than being reactive i.e. finding fault after action has been taken.

  1. September 26, 2022 at 9:09 AM

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.

%d bloggers like this: