Archive | Independence RSS feed for this section

What does Independence as an Internal Auditor really mean?

23 Feb

Link to the article published in CiA based on my input

Published: 12 Feb 2018 | Careers in Audit

The IIA definition positions internal auditing as an “independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes.” According to Rainer Lenz, Head of Corporate Audit at Villeroy & Boch, independence in internal audit is perhaps one of those ideas that works better in theory than in practice; it poses a challenge in its expectation of the internal auditor to be both “watchdog and consultant”.

Lenz draws attention to what commentators often refer to as the internal auditor’s ‘role dilemma’ and ‘role confusion’, noting the difficulties of internal auditors in striking a balance between being independent from operations while at the same time providing added value and benefit to operations. “Some view internal audit as a schizophrenic function,” he says; “on the one hand it needs to be completely integrated and knowledgeable and on the other hand, it requires a measure of independence from all auditors.” As a result, Lenz ascribes “a built-in cognitive disconnect” to the very purpose of internal audit.

Acknowledging this fundamental inconsistency in the very nature of internal audit within the wider business sphere, which indicates that those at the head of the business food chain are somewhat frustrated with internal audit’s inability to properly define its own role; Lenz notes “there is no congruence between what the board wants, what the audit committee wants and what senior management wants.” Thus internal audit are forever faced with the impossible task of pleasing everybody with no real sense of who to please first, particularly when each party expects something different. Lenz refers again to the IIA, who acknowledge that there may be conflicts when internal audit tries to “serve two masters” and understandably this “who’s your boss?” issue can present problems in terms of allegiances, independence, and effectiveness.

This in turn raises the need for filtering independence from the head down, with most CEOs advocating a free speech approach with their Chief Audit Executives (CAEs) enabling them to work under the understanding that he or she should feel free to voice their opinion, regardless of potentially controversial scenarios. This, Lenz notes, “draws particular attention to the importance of the CAE’s characteristics, which is possibly more important than the debate around the general independence of internal audit.”

One could argue that for internal auditors to do their jobs successfully, this requires full independence from senior management in order that the board is able to rely on their internal audit department for the necessary assurance in relation to internal controls, risk prevention and so on. “Otherwise,” says Lenz, “the risk is that internal audit’s reports to the board and audit committee will be filtered by senior management in such a way that only what is palatable to senior management is communicated.”

If internal audit is to retain its necessary independence in practice, it must take the time to invest in its relationships with the board, audit committee, key business stakeholders and senior management, sustaining a steady and robust dialogue with each party in order to perpetuate its own functional success.

 

Advertisements

INDEPENDENCE is a challenging concept for internal auditors

2 Feb

quote-independence-of-mind-enthusiasm-dedication-to-the-field-and-willingness-to-challenge-noam-chomsky-142-94-39

 

Recently, I was invited to share some thoughts about independence of internal auditors. I am basically challenging that concept …

The IIA definition positions internal auditing as an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes.”

To be blunt, in my view, independence is largely theory. It is overrated, I think. So is objectivity. But let’s stay with the subject matter of independence. There is nothing wrong with aspiring independence. But, who cuts the hand feeding him? There are inconsistencies among talk and action. Consequently, academic authors refer to the internal auditor’s “role dilemma” and “role confusion”, acknowledging for example the difficulties of internal auditors to strike the balance between being independent from operations and, at the same time, providing added value and benefit to operations. Being both watchdog and consultant is challenging.

Some authors view internal audit as a schizophrenic management function. On one hand, it needs to be completely integrated and knowledgeable. On the other hand, it needs a measure of independence required of all auditors. Thus, internal audit may have a built in cognitive disconnect. Organizations and Chief Audit Executives (CAEs) may cope at different levels of proficiency with such inconsistent demands. Those who can do that well may live longer. Thus, “organizational hypocrisy” may serve a useful purpose.

When you ask non-executive directors and audit committee chairmen what they think, how independent internal auditors are, what will they say? I recall surveys where those members of oversight bodies state that (some) heads of internal audit are not up to the job, internal audit lacks adequate independence, and internal audit has not properly defined the role that they wish internal audit to fulfill.

That points to the “who’s your boss” question. There is no congruence between what the board wants, what the audit committee wants, and what senior management wants. Aiming at satisfying all customer groups is likely to disappoint one or the other customer in some dimension, as all may expect something different from internal audit, such that no one is fully satisfied. In other words, internal audit may face tension from its attempt to serve – let’s say – its two prime customers: managers and the audit committee. The IIA acknowledges that there may be conflicts when internal audit tries to “serve two masters”. Thus, the “who’s your boss?” issue can present problems in terms of allegiances, independence, and effectiveness.

Academic studies confirm that role ambiguity and role conflict can negatively affect the independence of internal auditors. At the same time, CEOs (often) want the CAE to have no fear or favor. It is crucial that the CAE is able to work with other stakeholders in the organization and is not afraid to voice his or her opinion even in controversial situations. That draws particular attention to the importance of the CAE’s characteristics, possibly more important than the debate around independence.

There are authors who suggest that internal auditors must be independent of senior management, so that the board is to rely on internal audit to provide the assurance it needs; otherwise, the risk is that internal audit’s reports to the board/audit committee will be filtered by senior management in such a way that only what is palatable to senior management is communicated. Investing in these relationships and having a steady and robust dialogue is critical to the internal audit function’s success, given its organizational context.

My 2 cents about independence of internal auditors in a nutshell.

What is your perspective? Interested in your views.

 

Source: Lenz, R. (2016), Insights into the effectiveness of internal audit: a multi-method and multi-perspective study, LAP LAMBERT Academic Publishing, Saarbrücken, ISBN 978-3-659-85241-1, http://goo.gl/uw2pNz

Please see also: Careers in Audit, 12 Feb. 2018