​Internal Audit May Work for the Wrong Individuals — But Not the Wrong "People"

​My role as the head of a global organization offers me the opportunity to interact with people who enjoy a certain amount of celebrity and fame. Serving as president and CEO of The IIA has afforded me the opportunity to meet the heads of states, members of the U.S. Congress, the secretary-general of the United Nations, and assorted diplomats, scholars, and actors.

While their knowledge of and excellence in their respective fields helped elevate them to the status of celebrity, their knowledge and appreciation for internal auditing is generally limited. One notable and refreshing exception is American Academy Award-winning actor Richard Dreyfuss, the keynote speaker at the recently completed 2019 IIA International Conference.

Dreyfuss' celebrated acting career spans more than 50 years, including his role as the infamous Bernie Madoff in the critically acclaimed ABC mini-series, Madoff. But it is his work outside of Hollywood that has cemented his views on the importance of accountability, trust, and transparency in the public and private sectors. His commitment to improve transparency and accountability, especially in government, is manifested in the creation of The Dreyfuss Civics Initiative. The nonprofit, nonpartisan foundation was formed in 2008 with the aim of reviving "the teaching of civics in American public education to empower future generations with the critical-thinking skills they need to fulfill the vast potential of American citizenship," according to the group's website.

In preparing to host the "Fireside Chat" with Dreyfuss that kicked off the conference, I got to spend several hours in deep discussion with him. During that time, it became clear to me that his passion for what we do is intense and sincere.

That was quite evident as he spoke to more than 2,500 conference attendees at the opening general session. On several occasions he addressed the audience directly and said, "You guys are working for the wrong people." His point: Internal audit's work providing independent assurance, accountability, and transparency is too important to be kept within the organization.

His comments were jarring to me, as I suspect they were for many in the audience. One of the fundamental truths about internal auditing is that our work is internal to the organization. My initial thought was that Dreyfuss didn't understand the workings of internal audit after all. But the more I pondered his comments — I frankly couldn't shake them for some time — the more I came to believe that he is correct.

Sometimes, we do work for the wrong people.

To be clear, Dreyfuss was referring to the structure of internal audit working within the organization and reporting to the board and executive management when he said, "You guys are working for the wrong people." I disagree. But I do agree there are times when "the wrong individuals" occupy boardrooms and C-suites.

Too often board members are chosen because of who they know, not what they know. Too often board members are content to go along to get along. Too often CEOs or board chairmen are motivated by what's best for themselves and not what's best for the organization. We have seen too many recent examples of this in corporate scandals around the world.

But it is important to understand that when this happens the deficiency is not with the structure but with the individuals occupying key roles within that structure.

Good governance is complex and requires each key player in the process to be effective. It requires a board that is inquisitive, informed, skeptical, and ready to support independent and objective assurance. It requires executive management that supports long-term success over short-term gains, and supports an independent assurance function whose sole aim is to enhance and protect organizational value.

When boards or executive management fail to uphold their end of the governance bargain, it makes the work of internal auditing that much harder.

I am often asked by practitioners how best to address taboo subjects that could cost them their jobs. My standard answer is that internal auditors must have the courage to take on the challenges that come with the role. In my second book, Trusted Advisors: Key Attributes of Outstanding Internal Auditors, I define courage as, "being brave enough, even in the face of professional or personal danger, to do the right thing." But it is especially difficult and disheartening to do so when those above you and around you are failing to do the right thing.

The number of recent corporate failures and scandals is driving dissatisfaction with boards, executive management, and internal audit. Investors and regulators are seeking greater accountability and transparency. But we can't examine this growing discontent and pressure on stakeholders in a vacuum.

Technology advancing at warp speed and increasing global interdependencies are accelerating risks and disruptions. The ability to cope with them requires all players in the governance process to be at the top of their game. Internal audit must support good governance by adapting to changing technologies, nurturing mutually supportive relationships with stakeholders, and having the courage to speak out when things go awry.

Our aim should be to cultivate ideal working relationships with our stakeholders that lead to effective and efficient internal audit, and high-quality governance. Only then we can say we are working for the right individuals and the right people.