Internal auditors: the problem of attention seeking behaviors - October 1st, 2024

In my years as CAE or COO of the Allianz Group, managing hundreds of great professionals around the world, I have regularly observed a desire to feel noticed and appreciated, driven by the fear of being overlooked or irrelevant. This kind of need for the sunlight manifests itself in the different stages of the audit process, like the qualification of findings, the overall report conclusion and even in the way the audit activity is shared with stakeholders such as the Audit Committee.

Inconsequential findings: the auditor is not a bounty hunter

I have seen some of auditors feeling compelled to “find something” once an audit starts, like if the auditor is some kind of bounty hunter. And then once a deficiency is noticed I have also witnessed some auditors jumping to conclusions and exaggerating the significance of what later appear to be minor issues. I could equally observe auditors holding off on presenting findings until the timing ensures they will get the most attention to guarantee their work becomes the focus.

To an extent, I understand this behavior. We all look for some form of validation of the work we do, and we may fear to finish “empty handed” after long hours of hard work. It especially happens to auditors with less experience, and I have always tried to convince them that we as auditors are valued for our constructive impact. I have shared the following messages:

·?????? We all make findings qualification mistakes (high, medium or low finding?) as in most cases it is a matter of judgement, even with the best audit manual and taxonomy. Let’s make sure that the conversation with the client is on the root causes of the issues, on what is the possible remediation, and how and when it can be done. More than agreeing on the qualification of the issues, agreeing on the relevance and the urgency – or not - of the proposed remediation is what will be recognized.

·?????? A fast communication to the client supports a speedy remediation. Holding off is bad practice.

·?????? A “low” individual funding can be recognized as significant when flagged as a systemic issue across the corporation. A single, non-repetitive “low” deficiency might not really affect the risk and control profile of the company: as such, let’s not create a distraction relative the other observations made along the audit.

·?????? It is a good idea to keep a moderate language. An alarming or sensational wording for a finding that does not warrant such a response is counterproductive.

·?????? Auditors’ performance is not measured by the number of findings, but by the quality and the balanced impact of their work. Less is often more.

·?????? “When you look, you find” has been my experience. Now, the real point is: does your finding matter and to whom? Are you solving something material?

No findings can also be a good thing for the auditor. After all we are “on the same boat” as the rest of the organization, and we should celebrate an audit with few or even no material findings.

A “green” audit report can be a good audit report

Towards the end of the audit process, many audit functions use a color to illustrate the qualification of the audit results. I have always used four assessments levels: from Satisfactory, Improvement Needed, Significant Improvement Needed to Unsatisfactory, illustrated with colors – green, yellow, orange and red. I have sometimes observed in my teams a temptation to go for a “yellow” even if the audit revealed no real impactful findings.

The overuse of “yellow” and “orange” can be a way of seeking recognition and approval of others, or a way to justify the time spent by the team. This is in fact toxic:

·?????? In my case, when aggregating annually 1000 audit reports, this practice distorts the statistical view on the real status of the internal control system of the group. Training of the teams, communication, reviews and discussions around reports between the holding team and the local teams, but also regular quality reviews are the practices to be developed to ensure a proper calibration of all reports. Of course, an important consideration is to protect the autonomy of local CAEs in a group. Based on their professional judgement, they come to a conclusion. The interaction with the group audit team is not about second guessing them, but rather about making sure that a proper calibration is applied, and that we come to a shared conclusion based on collective intelligence and not only on an individual opinion.

·?????? ?The overuse of ‘yellow/oranges” creates an artificial sense of urgency for issues that would require immediate attention. The auditor may place himself at the center of a critical decision-making moments, with the risk of distracting company resources from potentially more important topics.

·?????? There is not necessarily a correlation between the initial risk assessment and the outcome of the audit. The risk assessment leads to define a frequency for the audit and a calibration (number of auditors and weeks), but it should not preclude its outcome, in my experience.

A green report is an indicator of health of the organization, not a signal of underperformance of internal audit.

The Audit Committee is not a beauty contest between control functions

An AC has always a busy agenda: CFO presentation, external auditor report, and then reports from internal functions such as risk, compliance or internal audit, depending on the organization and charter of the AC. There is time pressure, but internal audit should not feel that it competes with other control functions in seeking visibility.

In my experience, a golden rule is to not waste our stakeholder’s time, with a few practices:

·?????? Refrain from self-congratulatory presentations.

·?????? Focus on output, not input. I never saw an AC interested to hear about the hard work and efforts put into the audit process, aiming to receive praise for our dedication or sacrifice.

·?????? It is pointless to take credit for improvements in the internal control system.

·?????? Do not update management or stakeholders such as the AC on trivial developments. With a few minutes of their attention, get quickly to key and actionable points. Do not make unnecessary updates on past findings (follow up) if they do not truly matter.

When in the spotlight of the AC, we should be grateful for the opportunity to advise and to have a meaningful impact. It is not about our glory.

Attention-seeking behavior can manifest in subtle or more overt ways, despite the internal audit profession's usual focus on objectivity and behind-the-scenes work. The impact of our work combined with an attitude of humility, and the focus and effectiveness of our advisory work are what, in my experience, gets the true attention of the stakeholders of Internal Audit.

?