You Want It When?!!​

This CEO was an incredibly strong advocate for internal audit. Prior CEOs had also been supportive, but nothing like this. We had a seat at every one of his tables. And he saw us as a partner and trusted advisor. (Let me note that all this was occurring well before those buzzwords had become all the rage.)

How the heck did something like that happen?

Well, I'd like to tell you there was some magic formula that can be easily translated within every organization. But, unfortunately, while the concept is straightforward, it isn't necessarily easy. Quite simply, years and years of quality work from the internal audit department — no gotchas, no "do as I say, or else," no wounded being bayonetted — led to the department being well respected throughout most of the organization.

It was this climate in which the CEO was raised. He began at Farmers Insurance as a lowly claims adjuster and, pretty quickly, worked his way up the ranks. Throughout that time, he continued to generally have positive experiences with internal audit, gaining trust and confidence in the work we were doing.

So, when he reached the lofty heights of CEO, he arrived with a belief in the value internal audit could provide.

As mentioned, at one point he announced that it was his expectation that any issue identified by internal audit be corrected within one month.

At this point, whenever I tell the story, there is usually an audible gasp from the crowd. Even internal auditors who would love to work in that kind of supportive environment take a step back commenting, "Wait a minute, let's not go crazy here." And I know exactly where everyone's coming from. I won't say we audibly gasped when we heard what had come down, but there was quite a bit of consternation and frantic discussion.

Let's take a second and look at why gasping is such a universal response. (And I know most of you already understand, but this will just put the Good Housekeeping Seal of Approval on the whole thing.) Let's say there is an issue that is going to involve IT — programming, hardware, etc. What are the odds that program fixes or system changes or software redesign or hardware configuration or LDAT Siteminders (that one was for some of my old Farmers colleagues) or anything else that requires involvement from the incomprehensible realm of IT can be completed in one month? It's been a while since I've had a hand in such projects (and I'm not saying I understood any of it even when I was involved), but I remember we were ecstatic if we thought something might get handled in six months.

This reality was a part of discussion between the CEO and the chief audit executive (CAE) and, after some deliberations, the CEO backed off, indicating that one month would be desirable, but not insisted upon.

However, in his conversations with the CAE (and in the message that our CAE brought down from on high) the CEO expressed the following. Internal audit has said there is a problem, a problem of such magnitude that it needs to be reported to the executives and the board, a problem that needs to be addressed. If it is that important, shouldn't we be working as expeditiously as possible to get it corrected? If it was enough of an issue to be reported, then it was something that needed to be fixed immediately. And, even if the real fix might take a while to get in place, the immediacy of the problem means an interim solution is necessary.

This was quite the wake-up call for our department. And, I would guess it might be a wake-up call for many of your audit departments, too. And it caused us quite a bit of soul-searching and a reevaluation of what and how we reported, all of which was eventually distilled into two concepts — things that were important for us then, and things that should be important for every audit department today.

First, if there is an identified issue that is significant enough to be included in the report (again, a report that is seen by a lot of important people), then doesn't it need to be solved…right now?!

That is not to say that a quick fix is the final answer. However, it does mean that a band-aid may be required until the surgeons arrive. Again, the real fix may take some time. But a risk is still out there, and it is not being properly reduced. So, even if we don't start out with the 100 percent reduction of risk our best solution will provide, we need to figure out how we can get 50 percent, 70 percent, 85 percent. Even a 20 percent partial correction is better than none. (Just be sure that initial fix is temporary and that no one loses sight of the need for the final solution.)

Second (and perhaps, most important), how significant is the information that is going to be reported? When you recognize the CEO is vetting each issue with a fine-tooth comb of immediate correction, ready to impale the nearest culprit with that comb, you realize a few unsigned approvals may not be as big a deal as you first thought.

One of the biggest complaints executives continue to have about internal auditors is that they don't have the necessary business acumen. And an important piece of that is recognizing what is really important — what should be reported, what should just be handled, and what should be thrown out with yesterday's fish.

That realization made us aware of the trivialities we sometimes included in our reports, and we began to try and view our findings, issues, and overall reporting through the prism of executive expectations.

You may not be lucky enough to work in conditions where the expectation is immediate remediation of the issues you identify. But that doesn't mean you shouldn't look at them that way. Taking corrective action requires a lot of work, and we have to be sure the issues we are reporting are worth that work.

And, if it is worth that work, that work better get done quickly.

(Note: Still more to come on all this corrective action stuff. And, as I was typing this latest, the word triage popped into my mind. Not completely sure why, yet. But there it is. Will that show up next time, or will this all go somewhere else? Again, even I'm not sure. Stay tuned.)