A QAR Should Never Be Weaponized Against Internal Audit

Unfortunately, stakeholders sometimes use a QAR as a weapon against practitioners who are simply doing their jobs. This may be the case in Dallas, where the school district butted heads this month with its chief audit executive (CAE) over work that identified overpayments to contractors.

The CAE, Steve Martin, was the subject of a hasty performance review after school district officials called for an early peer review of the function. The dust-up led the CAE to publicly accuse the district of attempting to quiet internal audit by "investigating the investigator," and to submit his resignation. The school district countered that there were concerns about the validity and accuracy of calculations in the audits, that Martin was not being kept from doing his job, and that some of the audit's findings already were under review.

I can't really attest to the quality of the internal audits in question, but as I've noted on several occasions, "If it walks like retaliation and talks like retaliation, it's usually retaliation!" 

The findings of overpayments in two projects, and possibly more than a dozen others, come at a time when the district is asking taxpayers to support a more than $3 billion bond proposal to pay for improvements in school campuses. What is unclear is how the peer review will be carried out now that Martin has resigned. Under any circumstances, only a qualified independent reviewer should perform the QAR. Sadly, the next CAE for the Dallas Independent School District will have to keep one eye over his or her shoulder, in the event the wrong toes are stepped on by an internal audit.

As an internal auditor who spent much of his career in the public sector, I am always troubled when I see conflicts rise to the level they have in Dallas. That is why we should try to glean some positive lessons from the controversy.

Lessons for Stakeholders:

• When used correctly, a QAR is a welcome review. Indeed, IIA Standards require a CAE to have in place a Quality Assurance and Improvement Program (QAIP), which continuously advances the internal audit function. As noted earlier, a QAR should be a trusted measure of a function's conformance to the Standards, and one that identifies opportunities for improvement.
• QARs affirm independence and objectivity. IIA Standards require the internal audit activity to be independent, which is defined as being free from "conditions that threaten the ability of the internal audit activity to carry out internal audit responsibilities in an unbiased manner." It is ironic that some would use a QAR to impair that very independence.

• A QAR should be used to improve the internal audit function, not to punish it. I have written on many occasions about unscrupulous tactics used by managers who are unhappy with or embarrassed by internal audit findings. Weaponizing a QAR creates rifts in a relationship that should be symbiotic and based on honesty and mutual respect.

Lessons for Internal Auditors:

• QAIPs are required for conformance. As noted earlier, the QAR affirms compliance to the Standards, including the existence of a QAIP. Every CAE should be eager to create and maintain a QAIP that continuously improves the internal audit function. 
• Speaking truth to power does not always mean falling on your sword. One of the toughest challenges for CAEs is telling boards and executive management something they do not want to hear. Conflicts and differences inevitably will occur. While a CAE should never compromise his or her independence, integrity, or honesty, I have found there often is room for compromise. Not every disagreement should be a fight to the death. 
• Learning to navigate politics is part of the job. An important part of every CAE's job is to understand his or her organization. That must include understanding its internal politics and culture, and learning to navigate and excel within that culture. The very idea of politicking puts off many internal auditors, but the alternative can be standing in the unemployment line.
• Educating stakeholders can help avoid disastrous conflicts. Navigating internal politics includes educating stakeholders, building mutually supportive relationships with them, and anticipating and discussing scenarios where conflicts may occur. Taking these steps before a conflict happens will make it easier to navigate through them when they do come to pass.

• Always get it right. This might be the most important lesson from the Dallas school district controversy. While no one has shown that the work of the Dallas internal audit function was faulty, any mistake in an engagement or finding erodes internal audit's credibility. I summed up this vital point succinctly in a 2018 blog post about speaking truth to power. I wrote then: "The key word in the phrase 'speak truth to power' is truth. So, make sure you get it right the first time and every time."

Finally, I must draw a parallel between my personal experience as a CAE and the circumstances involved in this case. According to an article posted by The Texas Monitor:

"(The CAE) and his staff concluded that officials broke contracts into sections of less than $500,000, so the contracts would drop below the threshold at which they would need board approval. The process is called "sequential purchasing," which violates state law. Convicted violators are automatically removed from their position." 

In my over 45 years of internal audit experience, the most vehement pushback I ever received from management over internal audit findings involved evidence in my report of "sequential purchasing," or what we referred to as "splitting contracts." So, please forgive my skepticism in the Dallas school district case. To paraphrase from Shakespeare's Hamlet: "Me thinks thou doth protest too much."

As always, I look forward to your comments.