control, and governance
In My Opinion
An organization’s control environment represents the foundation of its internal control system. And in most settings, the principles that guide the control environment apply to the entire enterprise — including the internal audit function. One guiding principle, for example, is to ensure that personnel are qualified, performing their job duties ethically, and complying with laws, rules, and policies; another involves values-based leadership, or making certain the organization effectively communicates values of integrity and responsibility to staff members. Both of these areas typically are monitored by internal auditors and constitute important governance considerations. Yet despite playing an integral role in these aspects of the control environment, auditors often neglect to analyze the environment within their own function and fail to provide the values-based leadership necessary to set an example for the organization.
Internal auditors are susceptible to the same control weaknesses found in the organizations they audit. For example, staff shortages create pressure to fill vacancies and can easily lead to questionable decision-making in the hiring process. Moreover, budgetary and other constraints can limit audit management’s capacity to provide sufficient training. Both of these factors can ultimately hinder productivity, decrease work quality, and reduce audit effectiveness. Consequently, audits may be noncompliant with professional standards, and the audit function could receive an unfavorable peer review.
Maintaining underqualified, poorly trained staff hampers other aspects of audit management. For instance, it could force managers to focus more on supervisory review of work products and neglect monitoring of staff for compliance with audit policies and procedures. They may fail to examine adherence to internal policies such as time and leave, use of organizational resources, and conflicts of interest, or neglect to enforce the organization’s standards and values. These weaknesses can lead to diminished employee morale, inconsistent messages regarding ethical behavior, and high employee turnover. They might also cause internal auditing to function with ineffective leadership, incapable of serving as an exemplar of integrity for the enterprise.
Without values-based leadership, audit management cannot hire and train the personnel necessary to ensure quality audit products, strong staff performance, and ethical workplace conduct. Nor can it supply the services that render it useful and respected by the organization. Furthermore, audit management may fail to achieve the tone at the top goals to which it should subscribe, and it may eventually make the same mistakes as other departments within the organization instead of modeling good practice.
Ultimately, values-based leadership is the control network necessary for providing reasonable assurance that the enterprise operates effectively and efficiently. Internal auditors must “walk the walk” by contributing to this process and demonstrating the importance of a sound control environment.
Rachel Snell, CIA, CFE, CICA, is assistant city auditor at the Office of the City Auditor in Austin, Texas.
To comment on this essay, email the author at firstname.lastname@example.org.
The opinions expressed are solely those of the author.