Become a “Triple Threat” Internal Auditor: How Internal Auditors have the “Opportunity of a Lifetime” to Add More Value in a Triple Pandemic World

Regardless of the numerous blogs, articles, podcasts, webinars, or other virtual events that include “POST-COVID” in the title, I want to start by saying we are by no means “POST” anything. In fact, as I have heard on several occasions, we have found ourselves in a triple pandemic – a health, an economic, and a social pandemic. 

Because of this, the world is changing, and our organizations are changing… shifting… and maybe even rethinking entire business models or processes. And this means internal auditors HAVE to change as well. It’s time to make a fundamental change in the way we go to work. It’s time to add more, perhaps triple the value.

“If you don’t like change, you are going to like irrelevance even less.” - Retired U.S. Army General Eric Shinseki

That quote is where I began my Total Quality Auditing? book, and that’s the perfect place to begin our little chat here. This is NOT the time for internal auditors to become even more irrelevant than I believe SOME of our organizations already think we are. This is the time to show just how relevant we are.

“We cannot become what we want to be – by remaining what we are.” - Max Depree, American Businessman

Today is not “business as usual.” And yes, you guessed it, that means it is not “internal audit as usual” either. We cannot remain what we are and truly succeed. So, I would like to start by picking on where YOU usual start - that monotonous and (sometimes) irrelevant (yes, I said it) risk assessment and audit planning process. Because now, more than ever, it is time to start “upping our game” on determining where we spend our time.

Now here’s the thing… I was already starting to change the minds of internal auditors globally by presenting a new way to identify, reduce, and mitigate risks – what I refer to as the Risks the Total Quality Auditing Way or the TQA way - so now I get to simply outline the approach with specific takeaways to apply to the risks of today’s world.

I’m going to show you how to embrace change, increase your relevance, and truly become what you want to be to your organization. Let’s call that a “triple threat” internal auditor… and exactly what we need to be in this triple pandemic world.

The Total Quality Auditing? Way

I’m sure many, if not all, of you have heard of Total Quality Management (TQM) – the successful, proven concept that organizations have adopted for years in order to create a valuable, customer focused, high-quality organization. Well, I took the 14 principles of TQM and melded them into a similar framework to build a valuable, customer focused, high-quality internal Audit function. Yes, that’s Total Quality Auditing (TQA) in a nutshell. Not to brag (okay, maybe to brag a little), but I have spent the past two years writing the book (and accompanying workbook) on the subject, obtaining the U.S. Trademark for the concept, and spending much of my time training (and certifying – check out the cTQA designation here) internal auditors how to implement the TQA process. 

There are six points of focus for TQA:

I. Ethics & Culture

II. Standards (Codes) of Conduct

III. Feedback & Communication 

IV. Lean Audit Techniques

V. Balance of Audit (Assurance) & Consulting (Advising)

VI. Leadership: Ethics, Grit, Respect

The remainder of this article will explain the six points of focus as they apply to our new age of uncertainty and new risks within our organizations. 

Ready?

I. Ethics & Culture

In a recent webinar hosted by internal Audit 360°, I asked the participants what they think is the most critical/foundational aspect of an organization that ultimately leads to its success or failure. The choices were:

1) Ethics / Culture          

2) Finances / Profit        

3)  Product / Strategy

Overwhelmingly, the participants on that webinar (and many other participants in my past seminars) quickly responded “Ethics / Culture.”

Yet, ironically, internal auditors report focusing all of their time on finances (hello SOX controls) or products (hello inventory counts), and NONE of their time on the culture at their organization. Enter the most critical change that needs to take place to your planning process. Ethics is the primary RISK to our organizations, especially during and after a crisis of any nature, so if assessing and auditing culture is not on your audit plan, you better add it now.

All you have to do is read about the largest scandals and greatest fines that organizations have suffered recently to realize they are all about unethical conduct. There are plenty of examples where companies (and individuals at those companies) put the enterprise strategic goals (e.g., growth, market share), profits, or personal benefits before the interests of their stakeholders. And then inevitably, regrets follow. 

I believe there are three basic “character choices” we all face, two of which can create serious risks for an organization at any time, but, particularly in times of crisis.

More opportunity exists for unethical conduct - perhaps because of remote working, changing processes, disrupted controls, altered system access - sadly, I could go on and on. A crisis that disrupts plans to achieve enterprise strategic and financial objectives also creates the motivation to obtain the goals by cheating: i.e., “Get the numbers in any way possible.” And, a crisis itself provides the rationalization for unethical conduct – “everyone’s doing it,” “what else could I do,” “the enterprise existence was in jeopardy,” etc. 

Those with a background in fraud will immediately recognize the Fraud Triangle at work. 

So, I am here to tell you that current circumstances have led us to the land of the Fraud Triangle – with no end in sight at the moment. So, internal auditors… it’s time to pay attention.

Pay extreme attention to this first character choice: A “Big Me” (introduced by David Brooks in his book, The Road to Character); those who are prone to take advantage of the current pandemic situation. These individuals are willing to put personal interest before enterprise stakeholder interests. Opportunity, motivation, and rationalization are innate to them.

But also, don’t count out the second character choice: An “Ethical Rationalizer.” Those who are willing to come up with any excuse to justify anything, including their unethical actions. These individuals often don’t see themselves as “bad” because they are blinded by their own seemingly small or virtuous rationalization. 

Although the risks are high in this triple pandemic time, internal auditors have an opportunity of a lifetime to contribute to establishing and maintaining an ethical culture at a time when it is most needed at our organizations…. to be a proactive contributor to the cornerstones of an ethical culture… to, again, be a triple threat!

I have recently called this new “triple threat process” Total Ethical Auditing? - and it includes asking internal auditors to:

1.     Think like a Fraud Examiner - focusing on those that have the opportunity, motivation, and rationalizations to cheat.

2.     Execute like an Investigative Journalist - following tips through valued sources focusing on areas of greatest risk.

3.     Mitigate risks like a Coach - consulting, counseling, mentoring, training, and generally influencing others to achieve goals in the right way.

If you start doing these things, you and your organization will start seeing the benefit of the TQA way, right away. I promise.

P.S. If you are interested in what the third character choice, here is your clue: My next book is entitled “Becoming The Everyday Ethicist.”

II. Standards (Codes) of Conduct

Guess what? Because literally everything is changing right now, now is also an opportunity of a lifetime for internal auditors to contribute by making sure that the organization Standards (or Codes) of Conduct are keeping up with the change. 

Chances are, you have barely looked at this document in the past year, and it has rarely (if ever) been referred to during your previous audits. But isn’t this the standard for “acceptable behavior” within your organization? And shouldn’t we be ensuring that “acceptable behavior” is occurring as part of our reviews for management?

The answer before triple pandemic: Yes.

The answer during triple pandemic: Triple yes. A.K.A. Yes, Yes, Yes.

Now is the time to re-think the organization standards of conduct or, at the very least, to add to them to deal with all the new issues related to the crisis (whether the health, economic, or social crisis). There has never been a better time to update conduct expectations and to provide comprehensive communication and training of expectations of behavior. And there has certainly never been a better time to assist in making sure your organization is committed to uniform and consistent enforcement of their standards of conduct.

That’s where you, internal auditors, come into the picture. Similar to the ethics risks discussed above, if expected behaviors are not clear, communicated, followed, and enforced, there will be increased risk in all forms – affecting the health and welfare of employees, the consistency and control of processes, and the ability to meet all enterprise stakeholder needs, fairly and honestly.

One clear example of getting ahead of behavior expectations to minimize health and safety risks was developed by Lear Corporation: 

The Safe Work Playbook – An Interactive guide for COVID-19 Pandemic Preparedness and Response (Global automotive technology leader, Lear Corporation’s FULL Safe Work Playbook is available on its web site here.)

What’s your organization’s new health and safety protocol? Is there a new protocol? 

What’s your organization’s “playbook” for every area of change in the organization? What are the behavior expectations for remote work? Communication? Travel? Information Technology - connectivity, privacy, and security?... Just to name a few of the new, general pandemic risks. (More on these in the conclusion below.)

Remember, risks arise when there are no defined conduct standards for operating in the new world. Internal auditors, it is time to make sure you are working with organization leaders on identifying these new “high or higher” risk areas that need new standards, new administration, and perhaps new ways of enforcement. 

III. Feedback & Communications

In my training seminars, internal auditors consistently report that they are not spending time on the right, high-risk areas of their organizations. (Sad, I know.) 

The purpose of this TQA point of focus was to re-focus internal auditors on the needs of our customers – our auditees and all stakeholders of the organization. By obtaining regular and comprehensive feedback from these stakeholders, we can ensure that we are not stuck in the past but are focused on the challenges of the rapidly changing future. And today’s pandemics provide yet another opportunity of a lifetime for auditors to make sure that they start gathering the feedback and communicating with management on those rapid changes and implementing the right audit plan to match.

Now is not the time (although it never is) to present the internally created internal audit plan perpetuating the wasteful, low-to-moderate-risk audits of the past. Now IS the time to study, analyze, and focus on what your auditees, organization leaders, front-line employees, and all other stakeholders believe are the new, high risks of the triple pandemic.

As Alexander Larson, the President of Baldwin Global Risk Services said recently: 

“Good risk management will be critical for survival and internal audit has a key role to play in making that happen.”

Internal audit must get out of its comfort zone and start making a difference in the identification, assessment, and management of risks. To start, stop using inward focused knowledge to form risk assessments; use the knowledge of ALL stakeholders to the organization. Use all tools and methods available to survey those stakeholders regarding risks.

Don’t find yourself in a position that an organization crisis occurs because “no one asked.” In a time that remote work is prevalent and less face-to face contact is available, it is even more important that internal audit keeps open and expands the channels of communications:

• Survey all employees – no one knows the risks better than those on the front lines. 
• Survey all third-party vendors and suppliers – chances are they are all changing and under stress. And stress = risk.
• Survey all customers – they will tell you just how well they are being served in this time of crisis.

And lastly, internal auditors, take a good hard look at your whistleblower program. This is an extremely important source of feedback regarding risks, especially in times of crisis. Make sure the program is easy to use, provides multiple channels of access, and is safe (allows for anonymity and ensures no retaliation). Get involved and make sure that issues are investigated fully and resolved quickly.

The bottom line: Ask (A.K.A. communicate) and analyze feedback from all stakeholders regarding risks to your organization. Then build your more relevant, agile, timely, and superbly focused audit plan from there.

IV. Lean Audit Techniques

I’ll start with the good news: this section is a “lean” one. Why? Because once your risk assessment and audit plan are built to focus on your organization's needs of today (the right, high risks) – you are being more lean already.

A characteristic of lean thinking and leading is based on the just-in-time (JIT) concept. So, now is the time to put in place JIT auditing… to audit at the speed of the business. Pay attention to what is needed of internal audit right now to reduce and/or mitigate risks. Recognize when it is the right time to switch roles, take off your “audit hat” and to put on your “consulting hat.” (More to come on this topic in the next section.)

In our triple pandemic world, organizations, by necessity, are running lean. And those who survive will be lean. They will be laser-focused on their customers’ needs and eliminating waste. They will be agile, flexible, and embrace change.

And those internal auditors who survive will also be lean. They will be laser-focused on their customers’ needs and eliminating waste. They will be agile, flexible, and embrace change. They will help identify real risks and provide real mitigation tactics to the organization. They will work on the right things, at the right time, in the right ways. They will use surveys to efficiently get more feedback on risks, culture, policies, and processes. They will use predictive analysis for cash management and cost reduction. They will use data analytics in astute ways in order to work smarter, not harder.

We know that internal auditors are good at long lead time audit planning, performing thorough audits, writing (overly) thorough reports, and following up on (sometimes repetitive) recommendations year after year.  But, remember, this is NOT business as usual. It is an opportunity of a lifetime to show your organization that this is NOT internal audit as usual either. It is the time to show we can be lean and agile just like them, and we are there to add some real value.

V. Balance of Audit (Assurance) & Consulting (Advising)

As stated by the Institute of Internal Auditors in the International Professional Practices Framework (IPPF):

“Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization's operations.”

Notice the underlined and bolded words. 

I think too often we forget that internal audit is not only chartered to audit or provide assurance, but also exists to consult in order to add value and improve the organization that we serve and support.

We already established that the triple pandemic requires quick identification of the new risks and lean thinking to execute work. What we haven’t mentioned yet is that now, more than ever, resources must be proactively and openly communicating about real-time issues and helping permanently address and solve problems. Yet another opportunity of a lifetime for internal audit… to better balance the work we provide.

It’s time to consult and advise; it’s time to proactively:

·       Research new best practices and bring them to management’s table. (You always wanted that “seat,” right?)

·       Remind leaders about the importance of ethics and culture and conduct training or enhance communication efforts.

·       Guide management through the needed updates or improvements to standards of conduct.

·       Insist on better communication with employees, customers, vendors, suppliers to identify risks before they become an additional crisis.

·       Eliminate waste in processes and suggest lean thinking in meeting customer and enterprise needs.

Internal audit is usually viewed as a cost. It is time to be viewed as a benefit to the organization.

It is time to stop just providing assurance work and catching past mistakes. It is time to start coaching through consulting on future opportunities and facilitating permanent process changes to reduce or eliminate risks in the future. It’s time to bring some balance, even (and especially) when things are seemingly off-balance right now.

“Stop catching; start coaching.” - Amanda Jo Erven (Yes, I just quoted myself.)

VI. Leadership: Ethics, Grit, Respect

The first 5 TQA points of focus were all about what we need to be doing. This last one is about how we need to be doing it. Triple threat internal audit leaders:

1)     Embody ethics. They walk the talk and lead by example, showing just how important ethics is to organization success, always, but particularly during triple pandemic times. They are a key leader and facilitator of ethics from top to bottom of an organization. They have the courage to identify and communicate ethical issues. In times of crisis, there is a need for a strong voice – and internal audit leaders need to be that voice.

2)     Encompass grit. They have a passion to do their job effectively and to add real value to the organization. They have the perseverance to rise up during difficult times – like during triple pandemic times – and don’t shy away from challenge or adversity. (Highly recommend the great book by Angela Duckworth titled GRIT: The Power of Passion and Perseverance.)

3)     Earn respect. They are visible, active participants in providing solutions to the new triple pandemic risks. They don’t waste time on things that don’t count or don’t help. They take the low and moderate risk audits off the plan. They are not the bad cop; trying to catch past mistakes. They are  firefighter in the right place, at the right time, preventing any additional fires. 

“Great minds discuss ideas. Average minds discuss events. Small minds discuss people.” - Eleanor Roosevelt

It’s time for internal audit leaders to use our “great minds” and discuss “new ideas.” It’s not about the events that have occurred – that’s in the past. And it’s not about the people that weren’t prepared – that’s in the past. It’s about the ideas that we come up with to address the situation now and for the future. 

You guessed it, another opportunity of a lifetime for internal auditors.

The Conclusion: Unusual Times, Unusual Risks

A recent (June 2020) Fortune magazine survey of Chief Executive Officers (CEOs) indicates that it may take years before a return to pre-pandemic business levels. The structure of businesses is changing. Customers’ needs are changing. Vendor and supplier relationships are changing. Revenue streams are changing. The financial situation of all enterprises is changing.

There are and will continue to be new risks – risks that internal auditors have not seen before.

CEOs project that there will be a new normal regarding remote work – 40% expected to be working from home for another year; 26% working from home indefinitely. And working from remote, isolated locations has been a known risk for fraud and misconduct for a long time. 

The CEO survey also projected that we’ll never travel as much in the future as we have in the past. The way we conduct business and audit will change requiring new, innovative technical/communication solutions to assess and mitigate risks. 

And what about technology? CEOs project acceleration of technical transformation and internal auditors can surely expect new and greater risks associated with the swift, substantial technological changes.

In brief, here were the top concerns of CEOs for the future:

§  Keeping employees safe and employed.

§  Business continuity and serving customers.

§  Uncertain demand for products and services.

§  Employee benefits and work arrangements.

§  Supply chain continuity.

§  Technical transformation.

What does all this mean for internal auditors? It means audit plans should be constructed to address these concerns, the risks associated with the concerns, and solutions to reduce or eliminate the concerns. 

It’s time to start worrying about what your leaders are worrying about. And this is what Total Quality Auditing is all about – focus on customer and stakeholder needs with assurance that there are processes in place that identify, mitigate, and/or eliminate risks. 

Build your internal audit brand with a focus and emphasis on ethics, standards of conduct, feedback and communications, lean thinking and auditing, a balance of audit and consulting, and ethical, gritty, and respected audit leadership. This is the TQA Way.

“We are all faced with a series of great opportunities brilliantly disguised as impossible situations.”  - Chuck Swindall

There are many opportunities to become a triple threat in this seemingly impossible triple pandemic.

Internal auditors: This is YOUR opportunity of a lifetime!

About the author:

Amanda “Jo” Erven, CPA, CIA, CFE, is the President and Founder of Audit. Consulting. Education. LLC. After a successful career in external/internal audit and accounting, Jo is now an active Internal Audit Strategist, Management Consultant, Higher Education Professor, Author, and Trainer/Speaker, providing Continuing Professional Education (CPE) hours, live and virtually, to organizations across the globe. Jo’s motto says the most about her personal and professional outlook: “Good things come to those who wait… but don’t. You deserve better than good.” Every one of her books and presentations focuses on that proactive stance, and how we can immediately connect our actions to our values. Contact Jo at [email protected] to chat more or book your next virtual CPE event.