This has been going on for a little while, so I'll provide a quick "catch up" for any readers who missed the earlier postings or those of you who have lost track where we are (me included). Ultimately, it all started with a basic concept: If we have agreement up front, we will have fewer challenges throughout the audit process. At first glance, this seems self-evident and simplistic. But as we continued our explorations, we learned there was more here than we might have first thought. In particular, we have been spending a great deal of time talking about all the points of agreement that have to be considered – many of which internal auditors are either unaware of or ignoring. Shall we continue?
After the first post of this series
(which started all the way back on November 11), David Griffiths was nice enough to provide a comment related to what I had written. In those comments, he pointed out many of the areas where internal audit needs to obtain agreement with the customers, some of which were areas I included in Part 2 of this series
But at the end of David's comment was an interesting point about agreement which I had not really thought about before. A more-or-less accurate quote of David's comment: "I haven't mentioned the ultimate agreement – that Internal Audit is responsible to the Audit Committee which doesn't look kindly upon directors who refuse to co-operate – also known as the nuclear option."
I think there are two important areas of agreement referenced in this comment – areas that bear deeper inspection.
The first is our agreement with the audit committee regarding our roles and responsibilities. Part of this is contained in Internal Audit's Charter. But, unless there is that underlying agreement with the audit committee that the charter correctly states the relationship and authority of internal audit, then we are doing little more than waste time, people, paper, and resources. There is no foundation for our work and no reason for us to be doing any of the things we do.
But, assuming we have that first agreement in place, there is a sizably more important agreement – that the audit committee and executive management will support internal audit in the completion of those roles and responsibilities.
This is a big one. We are nothing without the backing of the powers that be. Without that agreement we are firing pin cushions at armor, we are broadcasting radio waves to television sets, we are setting fire to the ocean, we are just yellin' in the wind. We are sound and fury signifying nothing.
But knowing we have that authority – knowing we have the nuclear option available– does not mean we should be using it. Referring once more to the original thesis for all these postings – if we have agreement up front, we will have fewer challenges throughout the audit process – there is a point buried within the discussions we've been having. In all of this we have been implying that, with good discussion and an up-front and frank recognition of how internal audit will work with the customer, there should be little to no threatening, bullying, or pulling of rank. Power (and the reduction of challenge) comes from our position of strength. In other words, it is not the actual use of the threat that makes our jobs easier; it is knowing we have that power that reduces the challenges.
Let me share with you an example snatched from the pages of Farmers Insurance Internal Audit history.
For a number of years our audit schedule included the review of individual agency operations – a randomly selected sample of approximately 10% of up to 15,000 agencies annually. Per the agents' contracts, they had to let us in – no fights, no arguments, no "I'm the biggest selling agent in this state, you can't come in here." If we showed up, then a review would commence. Basically, that contract was synonymous with an audit charter which stated that audit had the right to go where they felt they needed to be, and don't get in their way.
Well, not every agent agreed that we should be let in. They had their reasons (some nefarious, some ill-advised, some because they were busy, and some for reasons obscure but neither defensible nor applicable.) And, if we really wanted to, we could have forced our way in with the following phrase, "If you do not allow us to do this audit, you will be in violation of your contract and will be terminated."
But, no one wins in a nuclear war and no one – auditor or auditee – wins with this attitude.
Recognizing this could be an area of challenge in our attempts to complete the audit process, we had already obtained agreement. We had talked to a lot of people – District Managers, Regional Marketing Managers, Sales Directors, Chief Sales Officers – you get the picture, individuals from all levels of the corporate ladder. They all agreed that we didn't need to fight for our right to audit.
So, if we ran into a problem – if, in spite of our nice explanation regarding our role and how we wanted to work with the agent to help make operations better – we were still not allowed to continue, we didn't have to threaten or cajole or whine or any of the other options that ranged from pop guns to nuclear arms. Nope, we just made one phone call and passed that phone to the agent. And then we would begin our review.
And knowing that (and having expressed this to all those people in charge) meant that the number of times we actually had to make such calls was anywhere from miniscule to completely absent. I can count on one hand (and a little less than one hand if required) the number of times I had to make such a phone call...and I did hundreds of these audits.
Our previous agreement is an important part of this story – but there is one more thing. Had we not had the discussions with senior management, had we not discussed what our purpose was and how it would benefit the organization, had we not had the agreement, we would have been in a sparklingly disagreeable position.
Imagine you have travelled to the wilds of Truth or Consequences, New Mexico where an agent has decided you will not be doing a review of his operations.
(Quick note: To the best of my knowledge this never happened with any agents in Truth or Consequences, New Mexico. I use Truth or Consequences, New Mexico as an example. So if you know any agents from Truth or Consequences, New Mexico, or are related to any agents from Truth or Consequences, New Mexico, or happen to actually be an agent from Truth or Consequences, New Mexico, then realize this is all fabrication and I do not mean to imply anything, directly or indirectly, about any agent from Truth or Consequences, New Mexico. Now, on the other hand, agents in Tucumcari...)
So, imagine being in the wilds of whatever small town you would like to imagine, when an agent decides he or she will not allow the review. In response, you make a phone call. However, there has been no discussion, there has been no understanding established regarding the implications of the contract, there has been no agreement.
In that situation, there is no one on the other end of the phone to back you up.
And so you drag yourself back from Truth or Consequences (or Tucumcari or whatever small town you picked) without having completed your work and actually having hurt the reputation of the audit department.
And now, let's make it a little worse. Let's say you have gone full nuclear option and moved forward with attempts to get the agent fired for contract violation...
And that doesn't happen either.
You now have all the authority of a casaba melon. And any reputation you or your department may have built has been snatched away like a ball of yarn from a defenseless kitten.
It is fine to talk about the nuclear option when it comes to audit committees. But David is right when he mentions it may be the most fundamental agreement. The audit committee has to agree that internal audit has value, it has to agree that it has the right to accomplish the work it wants to get done, and, most importantly, it has to agree to have the audit department's back.
But in all this, audit has to agree that certain actions are to be used only as a last resort.
While it seems we have plumbed every nook and cranny of this discussion (and, yes, I know it is a mixed metaphor – but it is getting late), we have one more installment to go (as far as I can tell.) And this time the agreement is going to come from an area you least suspect.