Internal Auditors as change agents:
What a difference a year makes!
By Dr. Rainer Lenz, CIA, CIIA
It was evidenced in a multiple-case study that the pattern of interaction between Chief Audit Executives and Senior Management is a key determinant of Internal Audit effectiveness (Lenz 2013). There are notable differences among Internal Audit Functions. The effectiveness of Internal Audit is largely determined by “soft factors”. Therefore, where Senior Management, possibly pushed by the supervisory board or the owner himself, truly supports the Internal Audit Function and wants it to look at the right matters, its effectiveness will be fundamentally different from cases where the management and/or board is passive, and does not push the Internal Audit Function to become effective by unearthing matters they may not wish to be found. In the upper echelon of Management, interaction with the chief stakeholder/s typically happens frequently, in a timely manner, and the communication is geared towards problem-solving. The relationship is strongly based on shared goals, shared knowledge and mutual respect. At the other end of this spectrum, interaction with the chief stakeholder/s happens in-frequently, is typically delayed, and the communication is rather geared towards finger-pointing. In this context, functional goals prevail, knowledge is preferably exclusive and relations can be impaired by disrespect.
This article provides conceptual and practical insights into features within the more immediate control of the Chief Audit Executives, helping or hindering Internal Audit effectiveness. Self-perception and external perception can differ greatly (Section 2). Positioning and communication are instrumental when identifying successful Internal Audit Functions; these make a fundamental difference as to whether the Internal Audit Function is positioned as police, servant, consultant, doctor or change agent (Section 3). Practical insights then demonstrate what a difference a year makes. Guided by the change agent, the more effective Internal Audit Function can prove also with hard data that there are fewer overdue findings, that reports are delivered more swiftly, and quantum leaps of productivity can be achieved (Section 4).
- Self-images of internal auditors: You have a choice
The literature on Internal Audit effectiveness indicates a significant disconnect between the “demand-side perspective”, – that is, the stakeholder’s expectations and perceptions – and the “supply-side perspective” – that is, self-assessments by internal auditors (Lenz and Hahn 2015). Self-perception and external perception differ greatly, (diagram 1), which can be attributed both in part to hubris on the part of internal auditors, and to a lack of understanding from management regarding the service Internal Audit actually provides.
Narrowing this expectation gap increases the effectiveness of the Audit, as customers measure the perceived benefit in relation to the expected benefit.
Within organizations, Van Peursem (2004 and 2005) regarded the role of Audit as enigmatic, meandering between the roles of watchdog and consultant. She reflects on the nature of the internal auditor’s role confusion, and alerts to the dangers of a “jack-of-all-trades” image of internal auditors. In this article I will reference metaphors and self-images used by internal auditors themselves. I will focus the analyses and reflections on what internal auditors control completely, that is, how they view and describe themselves. To find more out about the self-perception of internal auditors, I asked them: “If you were asked to write down a catch-line to sum up your role as internal auditor in your organization, what would it be?” I posted that question in LinkedIn, in the official global group of the Institute of Internal Auditors (IIA) and obtained 141 comments within 6 months, between March 17 and September 17, 2010.
All self-images received are clustered into five groups acknowledging that “metaphors create insights. But they also distort. They have strengths. But they also have limitations. In creating ways of seeing they tend to create ways of not seeing” (Morgan 2006). Thus, the clustering is normative. Some metaphors and self-images sow the seeds for non-acceptance of Audit, and contribute to its marginalization within organizations. Others may be the base for disappointment in the eyes of stakeholders. Five clusters of self-images are distinguished (diagram 2):
Negative self-images – as put by internal auditors themselves – like “An auditor is a watch dog and not a blood hound” may create distance and form the basis of non- acceptance (1. Police). Overly modest self-perceptions like “I am the one you want me to be” (2. Servant) and the use of self-evident and empty words like “Increase stakeholder value” (3. Consultant) can lead to marginalization in the eyes of the Audit stakeholder. Overly ambitious claims like “We are doctors” (4. Doctor) or “A modern day hero …” provide the basis for disappointment as Audit then risks over- promising and under-delivering. Eventually, there are also original and helpful self- images (5. Change Agent) that point to positive characteristics and differences; helping to create a unique and sustainable identity, and supporting Audit’s pursuit to become more effective.
- Internal Audit at Villeroy & Boch: What a difference a year makes!
Change Agent has been the leitmotif when assuming my new role as Head of Corporate Audit in Villeroy & Boch in May 2014.Those who take a look at the then newly created Corporate Audit page on the intranet may well rub their eyes in disbelief. What people expect to see is an objective, sober page describing the purpose and aim of the department, along with a couple of contact persons. Instead, the reader is greeted by an eye-catching quote from ex-racing driver Mario Andretti: “If you think you’ve got everything under control, you’re not fast enough.”
But how might this quote apply to Corporate Audit? Internal auditing is not an end in itself; it is designed to safeguard the success of the business as a whole. The Audit Function’s main task at Villeroy & Boch is to identify problems and risks in our business processes, offering support to the various operative units and to assist the company in meeting its goals. When conducting internal audits, the Corporate Audit department also plays an advisory role. For example, we discuss together with the units where there could be improvement in cross-departmental cooperation – between the various company divisions and headquarters or between headquarters and the subsidiaries.
“Cooperation” and “together” are words we often use when talking about Corporate Audit in action. Those who think the department distances itself from the rest of the company could not be more mistaken. The Internal Audit Function at Villeroy & Boch is part of the team. We pitch in – we do not just sit on the sidelines and watch. Ultimately, we are all working towards a common goal – we want to make Villeroy & Boch even more successful, and play our part in increasing the value of the brand and the company.
It is the readiness to implement change which is first and foremost here. The reports written after each audit, grading the various “findings” in risk categories A to D (very high to low), serve merely as a resource. We are pragmatic. The measures are based on common sense, keeping in mind what is realistic. For this, we need business acumen and a flexible approach to how we think and what can be done – and that is exactly the approach by which we want our work to be judged.
The work of Corporate Audit does not end once the report has been sent; steps need to be taken to ensure that measures are carried out and improvements made. We remain in contact with the units we have audited, because our work only becomes meaningful once the recommended measures are implemented.
The guiding principles of the Internal Audit Function at Villeroy & Boch since May 2014 have been twofold:
- We are performance-oriented. We focus on the timely delivery of meaningful reports and improvements. Our reports and communication aim at improving our business practices and associated controls.
- We are not the decision maker. We are not the one that will ultimately change things; we can only inspire people to change. That requires a healthy level of modesty; asking questions rather than assuming expertise; being open-minded and respectful in regard to the organization; and acknowledging that we are just one part of the organization, requiring the rest of the organization in order to succeed.
The units which have been audited respond to this pragmatic and active approach positively, as the latest feedback reports show. Also, hard data support the heightened effectiveness when comparing the situation upon assuming the role as Head of Corporate Audit in May 2014, and approximately one year later (diagram 3):
New processes and a cooperative and pragmatic approach have helped improve business practices and associated controls. The dialogue with Senior Management intensified resulting, for example, in an increase in ad-hoc requests and assuming project lead responsibilities. The heightened goodwill in the organization evidenced by positive customer satisfaction surveys has enabled the implementation of suggested actions. Further, computer assisted auditing techniques – especially Process Mining – have been instrumental when increasing the effectiveness of the Internal Audit service rendered.
While upon arrival most findings were overdue, this is now the exception to the rule. Delivery time of reports has been shortened from 8 weeks to less than 10 days. The productivity per full-time-employee (FTE) went up by 33%, from 6 reports per FTE p.a. to 8 reports per FTE p.a.; that is equivalent to one FTE. Most importantly, the improved acceptance and effectiveness of the Internal Audit Function was grounded in an overhaul of the overall positioning of the Function. We now have open access to Senior Management. Information flow freely in both directions; peers and auditees perceive the Function now as “Guide”, “Protectors”, and “Change Agents”, rather than as “watch-dog” and “police”.
Internal Audit is at a crossroads (IIA, 2013). The Internal Audit value proposition is still not commonly appreciated since having organizational relevance is still regarded a top challenge. The value of Internal Audit is questioned by many: the study by Ernst & Young (2012) revealed that the majority of Audit stakeholders – that is, CEOs, CFOs, Audit Committee Chairs and members – believe that Internal Audit is not helping their organization achieve its business objectives, and that about 80% of Internal Audit Functions have room for improvement, which is now expected urgently by most. Otherwise, as the study by PWC (2013) pointed out, “internal audit runs the risk of becoming a marginalized function”.
To become and remain a key player in the governance arena, the identity of the Internal Audit Function matters. There is a huge difference between positioning the Function as POLICE or as CHANGE AGENT, whilst acknowledging that the Function in practice may have elements of both. The more promising path as evidenced in the case study in Section 3 represents the positioning of internal auditors as change agents. Internal Audit is a support function, not connected directly to the profit and loss account. The case study presented demonstrates what a difference a year makes when internal auditors become more humble. Becoming agents of change is the (new) leitmotif of the IIA (2014): “To be effective, internal auditors must possess not only sound judgment and critical thinking, they must inspire (I suggest saying “inspire” instead of “compel” as in the original statement from the IIA) others to an appropriate and sometimes urgent response (…)”.
The claim that Chief Audit Executives and internal auditors shall become change agents is aspirational at this point in time for most Internal Audit Functions. Internal Audit agency presently is a rare phenomenon in practice. It is not the stereotypical model – yet – that internal auditors emerge as agents, who challenge the status quo and initiate to alter “the way we do things” in an organization. However, internal auditors may become change agents on a much greater scale. In doing so, the stereotypical model may transform from being reactive; responding, and seeking to meet others’ expectations, to being an agent who drives change. A change agent breaks with institutionalized practices and contributes to establishing a new pattern. That requires particular personal characteristics and competencies in, among others; liaising successfully with auditees, Senior Management and the board or audit committee; business acumen; leadership and communication skills; listening and influencing skills; and relationship acumen. When seeking to make a difference, and create a unique and sustainable identity, inspiring others to change may become the avenue of success.
The analysis of how internal auditors view themselves partly explains why some Internal Audit Functions are on a route to marginalization and disappointment, while others embark on a more promising path creating a positive, unique and sustainable identity. When getting the positioning right, helped by excellent communication, the expectation gap may be narrowed. Improved relations with key stakeholders and strong “soft skills” increase the chance that hard data can evidence the boosted level of Internal Audit effectiveness, including fewer overdue findings and higher productivity.
This article shows that some shortcomings and limitations of Internal Audit Functions are self-inflicted. The self-perception of internal auditors often carries negative self-images (Police) that create distance and form the basis of non-acceptance. Overly modest self-perception (Servant) and the use of self-evident and empty words (Consultant) display a lack of identity and may lead to marginalization in the eyes of the stakeholder. Overly ambitious “superman-like” claims provide the basis for disappointment in the eyes of stakeholders, as Internal Audit over-promises and under-delivers (Doctor).
Ultimately, the internal auditor has no formal mandate; they are a “leader with no title” (Sharma 2010). When acknowledging that, inspiring others to change may be the more promising path when emerging as agents of change. Possibly, internal auditors as change agents need to be more like farmers. Like farmers, internal auditors have little or no formal authority. Farmers work indirectly, they sow the seeds. They acknowledge that they only can work and be indirectly effective since plants grow themselves when conditions are favorable, and chickens lay eggs (or may not do so when it is too cold). Similarly, internal auditors are not the decision maker. Internal auditors do not change processes or people by themselves but can rather inspire people to change.
To resolve the dilemma between self-perception and external perception in order to best position the Internal Audit Function, ask yourself:
- What would Senior Management (the C-suite) say about you and your team?
- What would the Board (Audit Committee, Non-Executive Directors) say about you and your team?
- What role does your Internal Audit team play now?
- What role will you choose in the future?
You have the choice.
- Ernst & Young (2012), The future of internal audit is now, Increasing relevance by turning risk into results, July.
- IIA (2013), Rethinking the Future of Audit – Internal Audit is at a Crossroads, The Institute of Internal Auditors, The Austin Chapter Research Committee, March.
- IIA (2014), Agents of Change, Annual report, The Institute of Internal Auditors, Altamonte Springs, FL.
- Lenz, R. (2013), Insights into the effectiveness of internal audit: a multi-method and multi-perspective study, Dissertation at the Université catholique de Louvain – Louvain School of Management Research Institute (Belgium), 01|2013.
- Lenz, R. and Hahn, U. (2015), A synthesis of empirical internal audit effectiveness literature pointing to new research opportunities, Managerial Auditing Journal, Vol. 30 No. 1, 5-33.
- Morgan, G. (2006), Images of organizations, Sage Publications Inc., ISBN 978-1-4129-3979-9.
- PWC (2013), Reaching greater heights: Are you prepared for the journey? PricewaterhouseCoopers, State of the internal profession study.
- Sharma, R. (2010), The Leader Who Had No Title, Free Press, New York, ISBN 978-1-4391-0912-0.
- Van Peursem, K. (2004), Internal auditors’ role and authority – New Zealand evidence, Managerial Auditing Journal, Vol. 19 No. 3, pp. 378-393.
- Van Peursem, K. (2005), Conversations with internal auditors, The power of ambiguity, Managerial Auditing Journal, Vol. 20 No. 5, pp. 489-512.
Dr. Rainer Lenz is a seasoned financial and audit executive with international experience in global organizations including Actavis, Schlumberger, and ABB. Since 2014 he has been Head of Corporate Audit at Villeroy & Boch AG. His doctoral dissertation about the effectiveness of internal audit was the winner of the Advancement Award 2013 from the German Institute of Internal Auditors (DIIR Förderpreis). His co-authored book on the subject of combined assurance was the winner of the Larry Sawyer Research Foundation Project of the Year Award 2012 from the Institute of Internal Auditors in the U.S. Dr. Lenz has published articles in journals such as International Journal of Auditing, Journal of Applied Accounting Research, and Managerial Auditing Journal. He is trilingual with business degrees from Universities in Germany, France, and the U.K. Dr. Lenz is qualified as Financial Analyst (CIIA) and Chartered Internal Auditor (CIA).
 Independent Audit Limited (http://www.independentaudit.com) gave their consent for using the diagram in my PhD-thesis (Lenz 2013), “Looking good – I’ll sail through the self-assessment”.
 Lenz, R. and Sarens, G. (2013), Insights into self-images of internal auditors: “We need to be more like farmers”, Working paper. April.
 Villeroy & Boch currently employs a workforce of around 7,300. The consolidated sales for 2014 reached €766 million. Villeroy & Boch is represented in 125 countries around the world and has 14 production facilities in Europe, Mexico and Thailand (http://www.villeroyboch-group.com/en/the-company.html).