Tag Archives: Internal Audit

Thank you for the opportunity to speak at the 2019 conference of the IIA Slovenia

31 May



Dear Polona Pergar Guzaj (President of the IIA Slovenia) & the organizing team, dear participants,

it was so nice meeting you in person in Ljubljana. Everything was perfectly organized. The audience was amazing with about 200 members of the IIA Slovenia and participants from neighboring countries. First class.

Thank you for inviting me as guest speaker at your annual conference 2019. It was a great pleasure contributing to the success of your event. Please find attached my presentation in PDF-format: 20190531-IIA Slovenia-Rainer Lenz. I am keen on learning more about the vote of the audience regarding the perceived significance of each component of W-R-A-P-S, a model to improve decision making (in internal auditing).

Glad we stay connected.

Best wishes



Ljubljana, May 31, 2019





INDEPENDENCE is a challenging concept for internal auditors

2 Feb



Recently, I was invited to share some thoughts about independence of internal auditors. I am basically challenging that concept …

The IIA definition positions internal auditing as an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes.”

To be blunt, in my view, independence is largely theory. It is overrated, I think. So is objectivity. But let’s stay with the subject matter of independence. There is nothing wrong with aspiring independence. But, who cuts the hand feeding him? There are inconsistencies among talk and action. Consequently, academic authors refer to the internal auditor’s “role dilemma” and “role confusion”, acknowledging for example the difficulties of internal auditors to strike the balance between being independent from operations and, at the same time, providing added value and benefit to operations. Being both watchdog and consultant is challenging.

Some authors view internal audit as a schizophrenic management function. On one hand, it needs to be completely integrated and knowledgeable. On the other hand, it needs a measure of independence required of all auditors. Thus, internal audit may have a built in cognitive disconnect. Organizations and Chief Audit Executives (CAEs) may cope at different levels of proficiency with such inconsistent demands. Those who can do that well may live longer. Thus, “organizational hypocrisy” may serve a useful purpose.

When you ask non-executive directors and audit committee chairmen what they think, how independent internal auditors are, what will they say? I recall surveys where those members of oversight bodies state that (some) heads of internal audit are not up to the job, internal audit lacks adequate independence, and internal audit has not properly defined the role that they wish internal audit to fulfill.

That points to the “who’s your boss” question. There is no congruence between what the board wants, what the audit committee wants, and what senior management wants. Aiming at satisfying all customer groups is likely to disappoint one or the other customer in some dimension, as all may expect something different from internal audit, such that no one is fully satisfied. In other words, internal audit may face tension from its attempt to serve – let’s say – its two prime customers: managers and the audit committee. The IIA acknowledges that there may be conflicts when internal audit tries to “serve two masters”. Thus, the “who’s your boss?” issue can present problems in terms of allegiances, independence, and effectiveness.

Academic studies confirm that role ambiguity and role conflict can negatively affect the independence of internal auditors. At the same time, CEOs (often) want the CAE to have no fear or favor. It is crucial that the CAE is able to work with other stakeholders in the organization and is not afraid to voice his or her opinion even in controversial situations. That draws particular attention to the importance of the CAE’s characteristics, possibly more important than the debate around independence.

There are authors who suggest that internal auditors must be independent of senior management, so that the board is to rely on internal audit to provide the assurance it needs; otherwise, the risk is that internal audit’s reports to the board/audit committee will be filtered by senior management in such a way that only what is palatable to senior management is communicated. Investing in these relationships and having a steady and robust dialogue is critical to the internal audit function’s success, given its organizational context.

My 2 cents about independence of internal auditors in a nutshell.

What is your perspective? Interested in your views.


Source: Lenz, R. (2016), Insights into the effectiveness of internal audit: a multi-method and multi-perspective study, LAP LAMBERT Academic Publishing, Saarbrücken, ISBN 978-3-659-85241-1, http://goo.gl/uw2pNz

Please see also: Careers in Audit, 12 Feb. 2018




Time is Ripe to Revolutionize the Audit (Forthcoming in November)

14 Oct

Big Ben 2017-10


Lenz, R. (2017), Time is Ripe to Revolutionalize the Audit, EDPACS, 56:4, 19-22




There have been doubts around the added value and relevance of (internal) audit. There have been question marks whether that profession truly focuses on what matters most. How can we make better? How can we make (internal) audit an even greater success in the eyes of its customers and stakeholders, too? In the digital age, more than ever, there is nothing as constant as change. It is time to revolutionize the audit. Process Mining has the potential to revolutionize (internal) audit. Let your data speak to drive learning and change.


“Insights Into Self-Images of Internal Auditors” is now available for free

11 Oct


“Insights Into Self-Images of Internal Auditors” is now available for free on Taylor & Francis Online:


Internal Audit Effectiveness: Multiple Case Study Research Involving Chief Audit Executives and Senior Management

10 Jan


Lenz, R., Sarens, G. & Hoos, F. (2017), Internal Audit Effectiveness: Multiple Case Study Research Involving Chief Audit Executives and Senior Management, EDPACS, 55:1, 1-17

LENZ, SARENS & HOOS (2017) EDPACS, 55:1, 1-17


The focus of this study is the relationship between Chief Audit Executives (CAEs) and Senior Management (SM) and its relationship with internal audit (IA) effectiveness. The study reveals differences between more and less effective IA functions and offers explanations by studying organizational, personal, and interpersonal factors within the German corporate governance context. The findings show that the pattern of interaction between CAEs and SM are a key determinant of IA effectiveness. This study highlights the danger of viewing customer satisfaction as the key measure of IA effectiveness since in practice expectations can vary significantly and as sometimes very little may be demanded. Moreover, CAEs typically adjust to expectations, upward and downward. CAEs can drive the agenda as well. When it comes to personality factors, “Fingerspitzengefühl” and swimming in the organization characterize the successful internal auditor. IA designations for CAEs were not found to be of added value. At organizational level, the findings show that companies that are considered as “hidden champions” demand and benefit from effective IA practices.

Keywords: internal audit, effectiveness, organizational factors, personal factors, interpersonal factors.


Additional author information

Rainer Lenz, PhD, CIA, QIAL, CIIA, is a seasoned financial and audit executive with over twenty years of international experience in global organizations.

Gerrit Sarens, PhD, CIA, is full professor in audit and governance at the Louvain School of Management (Belgium). He is the author of several books and articles on internal audit.

Florian Hoos, PhD, is assistant professor in accounting and management control at HEC Paris (France). He has won numerous awards, including the nomination as one of the worldwide 40 best business school professors under 40.

Internal audit can be an invaluable tool to provide assurance during mergers and acquisitions

31 Dec

Audit & Risk

Internal audit can be an invaluable tool to provide assurance during mergers and acquisitions, but management may not always be aware of the profession’s skills.


While the deals market is still far less active than it was before the financial crisis, organisations are always on the lookout for suitable targets to acquire or merge with to increase their market share. But mergers and acquisitions (M&As) have been notoriously difficult to get right once the money has changed hands. Studies and anecdotal evidence suggest that most M&A transactions fail to deliver their stated goals or achieve value.

Such deals would therefore seem to be ripe for internal audit’s input, but an international survey conducted in 2002 for IIA Global found a low level of involvement from internal auditors at the various stages of M&As – despite their willingness to help from the start of the process. The research found that internal audit’s contribution was limited to the due-diligence phase and the post-acquisition audit.

Ten years later, it appears that little has changed: internal audit would like to be more involved in the M&A process from start to finish, but rarely is. Why is this the case? A typical barrier is that internal audit lacks hands-on M&A experience and so it’s involved only at certain times and in specific roles.

“Internal audit has a strong case to argue for its involvement from the very outset of an M&A,” says David Coombs, an internal audit and risk management consultant. “But management is unlikely to include internal audit unless it has a proven record of adding value through the audit process or of being actively engaged in M&A work. In reality, how many organisations are there where internal audit can put its hand up and say it has that kind of reputation?”

Prove yourself

Some internal auditors have successfully forged that reputation. Rainer Lenz CMIIA is vice-president of internal audit at pharmaceuticals company Actavis – an organisation, he says, that has grown by acquisition since it was founded. “M&A is a core business process as far as we are concerned,” he says.

Lenz says that he gets involved in providing risk assessments when Actavis identifies companies to acquire, adding that he has a strong background in M&As because he used to work in finance. He agrees with Coombs that, while internal audit definitely has valuable expertise to contribute to the M&A process, the function will not be asked to participate unless it has a proven record of earlier involvement.

“Management wants advice from people who have been involved at all stages of the M&A process,” Lenz says. “More often than not, internal audit does not have that experience, so it lacks credibility. The only way that internal auditors can really convince management that they should be part of the project from an early stage is to show that they understand what’s involved and what the inherent risks are – and that they realise that most mergers fail.”

Adding value

Other heads of internal audit say that their teams can take positive steps to increase their involvement in their organisations’ M&A strategies, while also demonstrating the value they can add throughout the process. David Finch CMIIA, director of group business risk and assurance at building supplies retailer Travis Perkins and a member of the IIA’s Heads of Internal Audit Service, explains that internal audit has a valuable role to play at several points along the M&A path.

“Before any M&A activity starts, internal audit can review the process that an acquisitive company might go through when undertaking a theoretical takeover,” he says. “This would include a consideration of funding potential – for example, does the organisation have the means to execute a M&A should the opportunity arise? It’s useless wanting to buy a business but not having the cash deposit available or the support of shareholders for the issuing of shares before you even start,” he says.

Finch also thinks that a review of the valuation modelling techniques used by the business to set its acquisition price is another important area for internal audit involvement. “Asset values, earnings multiples, discounted future cash flows and so on will all provide a different answer about the business’s value,” he warns. “This might affect whether the company decides to go ahead with the acquisition, because it may deem the target organisation too expensive or decide that the business does not hold the commercial value first thought.”

Finch says internal audit may also have a role in the validation of assets and liabilities. “Stock may physically exist, but does it hold a value? For example, surplus promotional stocks relating to a campaign run six months ago, obsolete packaging, time-expired stock and so on all hold a material value, but not quite the degree of value first thought,” he says.

Seal the deal

There are also competition issues that internal audit could investigate or highlight to management, Finch says, particularly if a merger of two dominant players in a market could adversely affect consumer choice. “Where an organisation is a leading part of its sector, the Office of Fair Trading will no doubt get involved. An appreciation of whether the regulator will refer the acquisition to the Competition Commission or require a compulsory divestment can influence the M&A strategy. This should be considered by the organisation before making a bid,” he says.

Neale Andrews, head of the corporate and commercial practice at law firm Mundays, which undertakes M&A work, also believes that internal audit can add real value by getting involved in the process before the acquisition. For example, internal auditors can help to identify how long the process might last. “Effective timetabling is an invaluable asset and can be a deal-breaker if management wants to capitalise on the merger quickly,” he says.

There are other areas where internal audit’s skills can be used to great effect. Andrews says that internal audit can identify potential hidden costs, such as legal liabilities, and help to arrange indemnities to ring-fence the acquirer from having to pay for them or to reduce the purchase price of the target.

The profession can also show its value during the implementation. “At particular stages in the acquisition, management should be stepping back and taking stock of what it planned to achieve by certain dates and whether those plans have crystallised,” Finch says. “Days one, 30, 60, 90 180 and 365 are the normal points. As with any project, there’s a danger that the benefits will be overstated and the costs understated. So internal audit can work with the M&A project manager to give some validity to statements that are made. Detailed planning for these milestone dates will give credibility to the M&A, so assessing the extent by which each activity has progressed can add real value,” he says.

Internal audit is also well placed to assess the M&A’s success when it’s completed. “Once the dust has settled, internal audit can clearly conduct a post-investment review,” Finch says. “This might be in the remit of internal audit, or line management could do it, with internal audit reviewing the effectiveness of the M&A itself. The purpose should be to see what could be done better in the future, rather than identifying victims of the activity.”

Yet, despite the skills that internal audit has to offer, some believe the status quo will remain: the catch being that, without experience, internal audit lacks credibility and so cannot gain the experience it needs in order to prove itself. David Coombs believes that whether internal audit actually gets more deeply involved in the M&A process or not depends on management’s viewpoint and the structure of the organisation.

“Management may call on internal audit for assurance and advice on specific aspects when it feels that the function can add value, but not necessarily call on it to have an ongoing role throughout,” Coombs says.

“If you already have skills in-house that can help to ensure success, these should be used,” he adds. “But internal audit is also a function that’s accustomed to challenging the thinking behind business strategy and standing up to management – and it’s certainly useful to have an independent voice that can take a more detached view of how the deal is going, the risks involved and the controls needed – and of what should happen after implementation.”


Source: Audit & Risk, Insights from the Chartered Institute of Internal Auditors, September/October 2012

How You Can Influence Internal Audit’s Value Proposition to Create a Unique and Sustainable Identity

13 Oct

Joint presentation with Tracie Marquardt (CPA) at the German IIA congress in Dresden on 8th October 2015. Please see the pdf-file attached.

Villeroy & Boch New Wave Cities of the World© CHL

DIIR Kongress 2015 Marquardt_Lenz


The presentation was well received. Three lucky winners got Villeroy & Boch’s coffee mugs, from Tokyo, Rio, and from New York.