​Auditor, Audit Thyself

How many times have you heard someone ask, “Who audits the auditors?” It’s a question frequently posed to practitioners, and for many of us there is a ready answer: “We go through an external assessment every five years to attest that we conform with the International Standards for the Professional Practice of Internal Auditing.”

That’s all well and good, and worthy of the associated bragging rights. But the audit department that assumes the pursuit of audit quality ends with conformance is fooling itself, its audit staff, and its organization. Conformance with the Standards should be considered a given — the audit department that wants to be seen as a trusted advisor and an invaluable stakeholder resource must hold itself to an even higher standard. The best way to achieve that is to turn audit techniques on our own operations — review our efficiencies and effectiveness; ensure we understand the risks to our objectives; and evaluate how well our strategies, objectives, and controls work together toward success.

There may be no more impactful place to start than taking a good, hard look at the culture within the department. Organizational culture is a major topic for board members, executives, and other stakeholders — it is the foundation for success and at the root of almost anything that goes wrong.

Internal audit is not immune. Success for an internal audit department relies on any number of elements, but foundationally sustained success cannot be achieved without the hallmarks of a healthy culture, including honesty, open communication, accountability (at all levels), and trust.

I have worked with audit departments that bragged about having “passed” their external quality assessment review, but subsequently learned through private conversations about the auditors’ discontent, disaffection, and distrust. The auditors reveal they don’t get the support they need, they cannot be honest with those in charge, they work in an atmosphere of negative competition, and, overall, they are working in an unhealthy environment.
 
Internal audit leaders should take steps to ensure their rose-colored perception of the department’s culture is real. If they conduct employee satisfaction surveys, the results should be taken seriously, not dismissed as the feedback of a few malcontents. Human resources should be used as a partner to better understand what is really going on in the department. But most importantly, leadership should be willing to talk with the staff. If audit leaders think such discussions will not provide real information, or if they are convinced it is a waste of time, then, yes, there is a problem.

And one final note. If you are not in a position of authority but find yourself in a toxic culture, you can choose to live in pain or just escape. However, the more courageous tact may be to step forward, pointing out the deadly practices potentially destroying the department.