Tag Archives: Internal Audit

INDEPENDENCE is a challenging concept for internal auditors

2 Feb



Recently, I was invited to share some thoughts about independence of internal auditors. I am basically challenging that concept …

The IIA definition positions internal auditing as an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes.”

To be blunt, in my view, independence is largely theory. It is overrated, I think. So is objectivity. But let’s stay with the subject matter of independence. There is nothing wrong with aspiring independence. But, who cuts the hand feeding him? There are inconsistencies among talk and action. Consequently, academic authors refer to the internal auditor’s “role dilemma” and “role confusion”, acknowledging for example the difficulties of internal auditors to strike the balance between being independent from operations and, at the same time, providing added value and benefit to operations. Being both watchdog and consultant is challenging.

Some authors view internal audit as a schizophrenic management function. On one hand, it needs to be completely integrated and knowledgeable. On the other hand, it needs a measure of independence required of all auditors. Thus, internal audit may have a built in cognitive disconnect. Organizations and Chief Audit Executives (CAEs) may cope at different levels of proficiency with such inconsistent demands. Those who can do that well may live longer. Thus, “organizational hypocrisy” may serve a useful purpose.

When you ask non-executive directors and audit committee chairmen what they think, how independent internal auditors are, what will they say? I recall surveys where those members of oversight bodies state that (some) heads of internal audit are not up to the job, internal audit lacks adequate independence, and internal audit has not properly defined the role that they wish internal audit to fulfill.

That points to the “who’s your boss” question. There is no congruence between what the board wants, what the audit committee wants, and what senior management wants. Aiming at satisfying all customer groups is likely to disappoint one or the other customer in some dimension, as all may expect something different from internal audit, such that no one is fully satisfied. In other words, internal audit may face tension from its attempt to serve – let’s say – its two prime customers: managers and the audit committee. The IIA acknowledges that there may be conflicts when internal audit tries to “serve two masters”. Thus, the “who’s your boss?” issue can present problems in terms of allegiances, independence, and effectiveness.

Academic studies confirm that role ambiguity and role conflict can negatively affect the independence of internal auditors. At the same time, CEOs (often) want the CAE to have no fear or favor. It is crucial that the CAE is able to work with other stakeholders in the organization and is not afraid to voice his or her opinion even in controversial situations. That draws particular attention to the importance of the CAE’s characteristics, possibly more important than the debate around independence.

There are authors who suggest that internal auditors must be independent of senior management, so that the board is to rely on internal audit to provide the assurance it needs; otherwise, the risk is that internal audit’s reports to the board/audit committee will be filtered by senior management in such a way that only what is palatable to senior management is communicated. Investing in these relationships and having a steady and robust dialogue is critical to the internal audit function’s success, given its organizational context.

My 2 cents about independence of internal auditors in a nutshell.

What is your perspective? Interested in your views.


Source: Lenz, R. (2016), Insights into the effectiveness of internal audit: a multi-method and multi-perspective study, LAP LAMBERT Academic Publishing, Saarbrücken, ISBN 978-3-659-85241-1, http://goo.gl/uw2pNz

Please see also: Careers in Audit, 12 Feb. 2018





Time is Ripe to Revolutionize the Audit (Forthcoming in November)

14 Oct

Big Ben 2017-10


Lenz, R. (2017), Time is Ripe to Revolutionalize the Audit, EDPACS, 56:4, 19-22




There have been doubts around the added value and relevance of (internal) audit. There have been question marks whether that profession truly focuses on what matters most. How can we make better? How can we make (internal) audit an even greater success in the eyes of its customers and stakeholders, too? In the digital age, more than ever, there is nothing as constant as change. It is time to revolutionize the audit. Process Mining has the potential to revolutionize (internal) audit. Let your data speak to drive learning and change.


“Insights Into Self-Images of Internal Auditors” is now available for free

11 Oct


“Insights Into Self-Images of Internal Auditors” is now available for free on Taylor & Francis Online:


Internal Audit Effectiveness: Multiple Case Study Research Involving Chief Audit Executives and Senior Management

10 Jan


Lenz, R., Sarens, G. & Hoos, F. (2017), Internal Audit Effectiveness: Multiple Case Study Research Involving Chief Audit Executives and Senior Management, EDPACS, 55:1, 1-17

LENZ, SARENS & HOOS (2017) EDPACS, 55:1, 1-17


The focus of this study is the relationship between Chief Audit Executives (CAEs) and Senior Management (SM) and its relationship with internal audit (IA) effectiveness. The study reveals differences between more and less effective IA functions and offers explanations by studying organizational, personal, and interpersonal factors within the German corporate governance context. The findings show that the pattern of interaction between CAEs and SM are a key determinant of IA effectiveness. This study highlights the danger of viewing customer satisfaction as the key measure of IA effectiveness since in practice expectations can vary significantly and as sometimes very little may be demanded. Moreover, CAEs typically adjust to expectations, upward and downward. CAEs can drive the agenda as well. When it comes to personality factors, “Fingerspitzengefühl” and swimming in the organization characterize the successful internal auditor. IA designations for CAEs were not found to be of added value. At organizational level, the findings show that companies that are considered as “hidden champions” demand and benefit from effective IA practices.

Keywords: internal audit, effectiveness, organizational factors, personal factors, interpersonal factors.


Additional author information

Rainer Lenz, PhD, CIA, QIAL, CIIA, is a seasoned financial and audit executive with over twenty years of international experience in global organizations.

Gerrit Sarens, PhD, CIA, is full professor in audit and governance at the Louvain School of Management (Belgium). He is the author of several books and articles on internal audit.

Florian Hoos, PhD, is assistant professor in accounting and management control at HEC Paris (France). He has won numerous awards, including the nomination as one of the worldwide 40 best business school professors under 40.

Internal audit can be an invaluable tool to provide assurance during mergers and acquisitions

31 Dec

Audit & Risk

Internal audit can be an invaluable tool to provide assurance during mergers and acquisitions, but management may not always be aware of the profession’s skills.


While the deals market is still far less active than it was before the financial crisis, organisations are always on the lookout for suitable targets to acquire or merge with to increase their market share. But mergers and acquisitions (M&As) have been notoriously difficult to get right once the money has changed hands. Studies and anecdotal evidence suggest that most M&A transactions fail to deliver their stated goals or achieve value.

Such deals would therefore seem to be ripe for internal audit’s input, but an international survey conducted in 2002 for IIA Global found a low level of involvement from internal auditors at the various stages of M&As – despite their willingness to help from the start of the process. The research found that internal audit’s contribution was limited to the due-diligence phase and the post-acquisition audit.

Ten years later, it appears that little has changed: internal audit would like to be more involved in the M&A process from start to finish, but rarely is. Why is this the case? A typical barrier is that internal audit lacks hands-on M&A experience and so it’s involved only at certain times and in specific roles.

“Internal audit has a strong case to argue for its involvement from the very outset of an M&A,” says David Coombs, an internal audit and risk management consultant. “But management is unlikely to include internal audit unless it has a proven record of adding value through the audit process or of being actively engaged in M&A work. In reality, how many organisations are there where internal audit can put its hand up and say it has that kind of reputation?”

Prove yourself

Some internal auditors have successfully forged that reputation. Rainer Lenz CMIIA is vice-president of internal audit at pharmaceuticals company Actavis – an organisation, he says, that has grown by acquisition since it was founded. “M&A is a core business process as far as we are concerned,” he says.

Lenz says that he gets involved in providing risk assessments when Actavis identifies companies to acquire, adding that he has a strong background in M&As because he used to work in finance. He agrees with Coombs that, while internal audit definitely has valuable expertise to contribute to the M&A process, the function will not be asked to participate unless it has a proven record of earlier involvement.

“Management wants advice from people who have been involved at all stages of the M&A process,” Lenz says. “More often than not, internal audit does not have that experience, so it lacks credibility. The only way that internal auditors can really convince management that they should be part of the project from an early stage is to show that they understand what’s involved and what the inherent risks are – and that they realise that most mergers fail.”

Adding value

Other heads of internal audit say that their teams can take positive steps to increase their involvement in their organisations’ M&A strategies, while also demonstrating the value they can add throughout the process. David Finch CMIIA, director of group business risk and assurance at building supplies retailer Travis Perkins and a member of the IIA’s Heads of Internal Audit Service, explains that internal audit has a valuable role to play at several points along the M&A path.

“Before any M&A activity starts, internal audit can review the process that an acquisitive company might go through when undertaking a theoretical takeover,” he says. “This would include a consideration of funding potential – for example, does the organisation have the means to execute a M&A should the opportunity arise? It’s useless wanting to buy a business but not having the cash deposit available or the support of shareholders for the issuing of shares before you even start,” he says.

Finch also thinks that a review of the valuation modelling techniques used by the business to set its acquisition price is another important area for internal audit involvement. “Asset values, earnings multiples, discounted future cash flows and so on will all provide a different answer about the business’s value,” he warns. “This might affect whether the company decides to go ahead with the acquisition, because it may deem the target organisation too expensive or decide that the business does not hold the commercial value first thought.”

Finch says internal audit may also have a role in the validation of assets and liabilities. “Stock may physically exist, but does it hold a value? For example, surplus promotional stocks relating to a campaign run six months ago, obsolete packaging, time-expired stock and so on all hold a material value, but not quite the degree of value first thought,” he says.

Seal the deal

There are also competition issues that internal audit could investigate or highlight to management, Finch says, particularly if a merger of two dominant players in a market could adversely affect consumer choice. “Where an organisation is a leading part of its sector, the Office of Fair Trading will no doubt get involved. An appreciation of whether the regulator will refer the acquisition to the Competition Commission or require a compulsory divestment can influence the M&A strategy. This should be considered by the organisation before making a bid,” he says.

Neale Andrews, head of the corporate and commercial practice at law firm Mundays, which undertakes M&A work, also believes that internal audit can add real value by getting involved in the process before the acquisition. For example, internal auditors can help to identify how long the process might last. “Effective timetabling is an invaluable asset and can be a deal-breaker if management wants to capitalise on the merger quickly,” he says.

There are other areas where internal audit’s skills can be used to great effect. Andrews says that internal audit can identify potential hidden costs, such as legal liabilities, and help to arrange indemnities to ring-fence the acquirer from having to pay for them or to reduce the purchase price of the target.

The profession can also show its value during the implementation. “At particular stages in the acquisition, management should be stepping back and taking stock of what it planned to achieve by certain dates and whether those plans have crystallised,” Finch says. “Days one, 30, 60, 90 180 and 365 are the normal points. As with any project, there’s a danger that the benefits will be overstated and the costs understated. So internal audit can work with the M&A project manager to give some validity to statements that are made. Detailed planning for these milestone dates will give credibility to the M&A, so assessing the extent by which each activity has progressed can add real value,” he says.

Internal audit is also well placed to assess the M&A’s success when it’s completed. “Once the dust has settled, internal audit can clearly conduct a post-investment review,” Finch says. “This might be in the remit of internal audit, or line management could do it, with internal audit reviewing the effectiveness of the M&A itself. The purpose should be to see what could be done better in the future, rather than identifying victims of the activity.”

Yet, despite the skills that internal audit has to offer, some believe the status quo will remain: the catch being that, without experience, internal audit lacks credibility and so cannot gain the experience it needs in order to prove itself. David Coombs believes that whether internal audit actually gets more deeply involved in the M&A process or not depends on management’s viewpoint and the structure of the organisation.

“Management may call on internal audit for assurance and advice on specific aspects when it feels that the function can add value, but not necessarily call on it to have an ongoing role throughout,” Coombs says.

“If you already have skills in-house that can help to ensure success, these should be used,” he adds. “But internal audit is also a function that’s accustomed to challenging the thinking behind business strategy and standing up to management – and it’s certainly useful to have an independent voice that can take a more detached view of how the deal is going, the risks involved and the controls needed – and of what should happen after implementation.”


Source: Audit & Risk, Insights from the Chartered Institute of Internal Auditors, September/October 2012

How You Can Influence Internal Audit’s Value Proposition to Create a Unique and Sustainable Identity

13 Oct

Joint presentation with Tracie Marquardt (CPA) at the German IIA congress in Dresden on 8th October 2015. Please see the pdf-file attached.

Villeroy & Boch New Wave Cities of the World

DIIR Kongress 2015 Marquardt_Lenz

The presentation was well received. Three lucky winners got Villeroy & Boch’s coffee mugs, from Tokyo, Rio, and from New York.



#VolkswagenScandal. Why did nobody stop the malpractice at the People’s Car? Is the German two-tier board system part of the problem?

27 Sep



According to SPIEGEL ONLINE (September 27, 2015), Volkswagen was alerted by Bosch already in 2007 for what the wrongdoing is concerned. In the recent edition of DER SPIEGEL (September 26) reference is made to the European Union-Law No. 715/2007, which prohibits the use of systems that manipulate the analyses of car emissions; a law to be enforced by no later than 2009. That article is titled German Double Standards (“Deutsche Doppelmoral”) for German politics have not yet been enforcing that law in practice. In 2011, according to SPIEGEL ONLINE (September 27), Volkswagen’s Internal Audit department addressed the matter.

It is unclear at this point, who knew what and when. As a matter of fact, nobody stopped the malpractice. Another four years on, in September 2015, energy emission fraud eventually hit Volkswagen, the People’s Car. Then, all happened rapidly. The CEO was forced to step down. The share price dropped over 40% within two days. The stock value melted from EUR 80 billion to EUR 55 billion within a week. A lot of money lost. Even worse, reputation went downhill. Nobody likes fraud and fraudster.

Volkswagen is about to get back on its feet. Rebuilding trust will be more demanding than smoothening crumpled paper. That is expected to take a decade as a supervisory board member states (DER SPIEGEL, September 26, 2015) – if at all successful. I very much hope so.

I ask myself, why did nobody stop the malpractice at the People’s Car? I wonder whether the German two-tiers board system is part of the problem. The German corporate governance context is characterized by two-tier board structures with a Management Board (Vorstand or Geschäftsführer depending on the type of legal entity) and a separate Supervisory Board (Aufsichtsrat). In Germany, Senior Management is generally regarded as the chief stakeholder of Internal Audit as it is common practice for the Chief Audit Executive to report directly to the Management Board, while the Chief Audit Executive may or may not have direct access to the supervisory body or a sub-committee thereof, such as the Audit Committee. Thus, in the German two-tiers board system the risk is that Internal Audit’s reports to the Supervisory Board/Audit Committee may be filtered by Senior Management in such a way that only what is palatable to Senior Management is communicated (2tier).

I am keen on learning the information flow to the Supervisory Board / Audit Committee @ Volkswagen. What did they know? Who informed them? How was that done? What did the Internal Audit report from 2011 actually say? Etc.

In order to “get the boss right”, strategically positioning the Internal Audit Function closer to the Supervisory Board to help the Internal Audit Function’s performance and effectiveness, may be worthy of consideration.

What do you think?