The contract killer
I’ve known quite a few internal auditors who took pride in the number of people they managed to take out as a consequence of their audit reports. The arguments? Most often they argued the people had failed to do what they were told to do by the procedures. Or they considered the people to be incompetent or bent in many ways. Whatever reason they felt justified them in approaching their job as they did, to me, it is still fundamentally the wrong way to look at our profession. Because we are not contract killers. Rather, I believe we are the primary care physicians of businesses. Let me explain.
A small town doctor
I would like you to think about a typical small town primary care physician. Yes, this is an older gentleman or lady, wizened with the years. This is someone who knows you and your family intimately. Perhaps they even assisted delivering you to this world. That’s the type of physician I’m talking about. Well, a good internal auditor should be like that.
Closeness breeds understanding
A good primary care physician knows you and has known you for a long time. A good internal auditor knows the environment he or she is working in. They know it intimately. They live in it, they work in it, they breathe in it. They are not entirely part of it, there is a significant and necessary amount of independence there, but they are very, very close to the organization.
By being so close to his or her patients, the good primary care physician cares deeply about them. Likewise, by being so close to the organization, the internal auditor cares deeply about it. We care so deeply about it, that we can be very harsh if we see significant failings that may threaten or significantly harm the organization. While a doctor may care about seeing one of the young ones of the family take up smoking, we may care deeply about a repeating pattern of procedural neglect in a certain area. Being harsh in our reporting is often a way to deliver a clear and concise wake-up call to the organization that has lost its way.
Forgiveness encourages evolution
A primary care physician is also forgiving. When he sees marked improvement, because someone is consistent in taking their medicin and doing their exercises, they will consider that as a positive element come the follow-up exam. The internal auditor, even seeing that everything is not A+ yet, will be considerate for the department that really made the effort to implement certain recommendations, even if they are not yet fully implemented yet.
Deep understanding creates perspective
A good primary care physician is close to the family, and knows the family stories and the family crosses. Some things need to be known, but only on a need to know basis. An internal auditor, confronted with some issues from the past that were correctly resolved, bears no grudge. It is not about what happened in the past, but what will happen in the future, taking in account everything that has happened in that past. This requires a deep understanding that many a hired gun – a contracted internal external auditor – does not have because he will never have access to that information. A good internal auditor engenders trust and earns it.
Awareness leads to relevant action
A good primary care physician also knows when to call the ambulance and transfer the emergency care to a specialist. An internal auditor, when confronted with a significant problem, will likewise immediately alert the correct people at the board level or even beyond. Some problems cannot be solved by internal controls, good risk management or governance improvements. However, that does not mean the good internal auditor hands over and lets go. Rather, he remains close and makes sure that the organization is comforted and supported during a difficult period.
Communication shines a light on issues
A good primary care physician communicates well, because he or she understands that communication is one of the most important keys to identifying whether something is wrong. A good internal auditor understands the value of excellent communication as well. The best among the internal auditors know that something is wrong in the organization because they feel the change in the air before someone has even communicated something to them. That’s experience.
A quick illustration
One of the key reasons for auditor independence is auditor objectivity. Think about that primary care physician now. He is close enough to the organization to objectively and with some measure of emotion assess that something is wrong. He is not taken by emotion in a way that it prevents him from functioning. Rather, he is the one that calls the ambulance when everyone else around is crying and wandering around aimlessly.
Much in the same way, the great internal auditor knows something is wrong but remains able to act and to assist the organization in getting all of its proverbial ducks in a row. He does not drown in the organizational emotional fear, but remains detached in such a way that he can advise on the most appropriate actions.