The Ratings Game
An audit manager finds himself caught between his staff and the CAE over whether internal audit should adjust its ratings based on pressure from the CFO.
John Sharp is vice president of the Audit Services Department at Grand Cane Optics, a large, publicly traded company with development, manufacturing, sales, and administrative offices scattered throughout North, Central, and South America. Shortly after John took his position in the department three years ago, the audit committee chairman asked him to improve communications with the committee, including written reports. “Don’t’ just bring us a pile of data at every meeting — we need you to be able to point out trends,” the committee chair said. “Tell us whether the results are improving, staying the same, or getting worse.”
To measure the company’s progress against its control objectives, John decided to establish a rating system — all audit reports and comments issued by the audit department have been rated ever since. It hasn’t been an easy task, but most employees have finally accepted the process and some of the more engaged divisions have actually embraced it. The senior management teams in all divisions have factored the audit ratings into employee evaluations throughout their divisions, incentivizing employees to perform well on scheduled audit projects.
During a recent meeting to review the final results of an audit project at one of Grand Cane’s largest manufacturing units, the unit’s chief financial officer (CFO) noted that the rating his unit received fell just below the highest rating available. After the meeting, the CFO asked John if he had a minute for a brief discussion and proceeded to meet with him in private.
The next day, after John and his team had flown back to their office, John met with the manufacturing unit audit-project manager, Rick, to discuss the report. “I reviewed the report again on the plane last night and have some suggested changes,” John told his manager. After their discussion, Rick realized the changes John asked him to make would result in the manufacturing unit receiving the best rating possible.
After the meeting, Rick asks his team to make the changes and to recirculate the report for one more review before finalizing it. The audit team is not happy. They don’t believe that ratings should be subject to “negotiation,” and they express concern that John has bowed to pressure from the CFO. Rick tries to explain that the recommendations will still be of value and hopefully implemented, but they believe the changes minimize the importance of the effort put into the project. “Why should we spend so much time analyzing and documenting when in the end all of our hard work is just negotiated down to insignificant points?” asked one of the team members.
Rick is in a difficult position. He runs the risk of alienating his team or clashing with John. Which is worse? Which is right?
Share your comments below.
The Ratings Game
As an additional last point to my prior post:
The internal audit activity should look at the situation and devise means to prevent its occurrence in the future. View it as a risk which had not been identified and provided for in the past but is recognised now. That, after all, is how risk management works. No one cannot identify all risks at the same time, but events show us what we had missed previously - all the time.
Posted By: Kaya
2013-09-10 12:44 PM
All About Timing
The action plan had not been implemented by management, so there's no question the ratings shouldn't be changed based on this scenario. Another options for the CAE is to discuss the action plan with the CFO, explaing the implications of how his/her action plan will improve the ratings in the follow-up audit, or if it will clear the findings out entirely if the action plan is performed timely and effectively.
Posted By: Adrienne Ommaya
2013-09-06 2:04 PM
The Ratings Game
I praise the courage of the audit staff. CAE should keep his independence and objectivity at all costs. But that doesn't of course mean that he can't change his mind. After all, rating is not 100% objective and some subjective factors can come into play. Provided reasons advanced by the CFO, he could change the rating. Now, if reasons are that clear, why not communicating these to audit staff?
Posted By: Guy Christel
2013-08-15 6:14 AM
The Ratings Game
This type of decision making happens too often in the corporate world. I think it warrants a visit to the CAE to give him a heads up on staff opinion, and ask him to share his rationale with the team. A good CAE would have shared his rationale instead of just instructing that the rating be changed. If the rationale is flawed, then he should think twice about the message it sends not only to his staff but the rest of the organization.
Posted By: Phil Caskanette
2013-08-12 8:11 AM
The CAE can find himself caught in the middle, but should be experienced enough to make a decision that is in the best interest of the key stakeholders. If the Management Action Plan is unchanged by the rating, then the objective of the audit should remain fulfilled and all members of the audit team should be content with that. However Employee trust is key to a high performing team, and repeated compromises can impact this if repeated over and over.
Posted By: Mark Shipman
2013-08-08 11:08 AM
The Ratings Game
I believe that audit rating should not be negotiable. It is an objective and independent assessment of the risk. Management needs to respect this assessment, although they may have a different view.
Posted By: Shilpa Yadav
2013-08-08 10:55 AM
Keeping it simple for the Board
The audit staff is correct. The ratings were a method of keeping progress (or lack of it) simple for the Board to understand. It appears the CFO is trying to get the highest rating because there is a personal or financial incentive for it. This would be a corrupting of the independence of the internal audit staff and make the ratings meaningless.
Posted By: Rick Ruhland
2013-08-08 10:42 AM
Audit Report Ratings
Internal Audit report ratings should not be subject to negotiation with the auditee. The rating is the auditor’s independent assessment of the system of internal controls. However, internal audit should have a quality control process in-place to ensure the accuracy of the ratings and support for the recommendations. When writing the report, the auditor should consider the audience and adjust the wording accordingly without significantly impacting the message. Changing significantly the wording and rating can impact the auditor’s image, objectivity, and independence. Reporting is always a challenge; and management may not always be happy with the results. But the CAE should always maintain an open line of communication with management, not only during the audit process to improve the receptiveness of the audit results.
Posted By: Wilfredo Tirado
2013-08-08 9:25 AM
I've come to find during my career that providing a rating of an audited area usually results in distracting management from the findings and the discussion becomes about the rating. In my audit department we work very hard to gain management's favor while still getting them to address the issues. We want to partner with management so they will seek our counsel when not being audited. The ultimate goal is to help management achieve goals while maintaining an appropriate control environment based on compliance with regulations and an appropriate level of risk. In order to do that, you may have to work with management in a way that shows you are willing to make reasonable accommodations (increase the rating slightly). The audit staff needs to understand this as well, otherwise they will never be viewed as helping management but as policing management. When people feel like their being policed, cooperation goes out the window.
Posted By: Al Crispell
2013-08-08 9:19 AM
I can believe this scenario is real, but I hope the names of the company and people have been changed.If the department developed guidelines for the ratings and the auditor in charge of the project followed the guidelines, I think the staff is correct and the rating should not be negotiable.
Posted By: Sherry McLendon
2013-08-08 9:05 AM
Who cares? Just like the title of the article, ratings are just a game. It's a number or color on a piece of paper that no one will remember a few years from now. Change it and move on with your life.
Posted By: Vince Schira
2013-08-08 8:08 AM
The Ratings Game
I agree with the audit staff that it hurts when the CAE negotiates the rating, but the CAE has earned the right to make those types of decisions.
If that right is badly abused, staff always has the right to move on.
Posted By: Roger Brown
2013-08-08 7:28 AM
COMMENT ON THIS ARTICLE
Internal Auditor is pleased to provide you an opportunity to share your thoughts about the articles posted on this site. Some comments may be reprinted elsewhere, online, or offline. We encourage lively, open discussion and only ask that you refrain from personal comments and remarks that are off topic. Internal Auditor reserves the right to edit/remove comments.
To make something bold:
<strong>Text to bold</strong>
To make something italic:
<em>Text to italicize</em>
To make a hyperlink:
<a href="URL">Text to link</a>