Mind of Jacka: Caution, Fear, and Control

The attraction (they are never called "rides") consists of 18 giant teacups that hold up to four riders. The guests (they are never called "customers") spin the teacups by turning the giant disc/wheel in the center of the vehicle. The teacups sit on three spinning turntables that, themselves, sit on one giant spinning turntable. This may seem a bit much, but it doesn't move that fast. (And we won't talk about the time, back in my college days, when two friends and I did our best to keep our cup spinning at maximum velocity for the duration of the experience except to say that there were no protein spills, another Disney sobriquet, but finding the exit was a bit of a challenge.) There are no height limits and, in spite of what a group of young punks might have tried to accomplish lo those many years ago, it is considered a "beginner" thrill attraction for children.

The 2004 incident involved a disabled man who lost his balance and fell out of a teacup. The guest didn't require medical treatment, nor did he hire an attorney. However, the incident happened shortly after Disney hired a new safety team and the scuttlebutt was that the new team was trying to prove themselves. They had already made safety-related changes in other areas of the park — some good; some not-quite-as-good. And in response to this incident, they reduced how fast the teacups could be spun by tightening down the ability of the center wheel to set the cups in motion. Unfortunately, the tightening was so severe that the cups would barely turn.

I happened to visit the park about a month later. My friends and I got in a teacup and, no matter how hard we tried, we could barely make it spin.

It was still a decent flat ride (as they are called in the industry), but the fun had been diminished by those so concerned for safety, so concerned for guest well-being, so concerned about a lawsuit, and so concerned about proving they could make an impact, that the experience took a back seat to caution and fear.

"My, what a fascinating story," you are saying to yourself. "There is no doubt that overcontrol came from overreaction. Thank goodness we internal auditors would never take such drastic and ridiculous actions ourselves."

"Nay, nay, I say." (And I can tell by the look on your faces that a couple of you saw this coming.) Here are just a few snippets from my personal experience:

• There was the requirement (written into procedure) that the accounting department ensure the desk of the person opening checks was not next to the person receiving those checks.
• There was the requirement that check stock be locked up in branch offices, even though the only thing that differentiated this stock from any other paper in the office was a Farmers Insurance watermark.
• There was the finding that the height of the seven-foot-tall fence securing excess computers be raised to close the two-foot gap between the fence and the ceiling, a fenced area that was located in a parking garage that required various authorizations to enter and computers so out of date that the company could find no one who wanted them.
• There was the finding I wrote up in a rough draft stating that Home Office management would not know the Phoenix Regional Manager's travel plans because he was not completing trip request forms. (Thank goodness my manager yanked that one before it got any further.)
• There was…

Well, 30 years' experience; I've got a lot of stories. And I'm sure you have your own.

Why do we do this? What causes the overabundance of caution that results in Sisyphean controls? Why do we want a form filled out, paper locked up, desks separated, an extra couple of feet put on a fence? Why do we lock down the teacup in such a way that it can no longer provide the entertainment that is the purpose for its existence?

I'm sure there are lots of reasons. One I've talked about before is the fear internal auditors have that something will go wrong when they have been involved. We're in charge of controls. So, an error is a loss of control, and a smudge on our good name. (It isn't true. But it is one of those secret fears we harbor — nightmares of showing up for a test without having studied, being unable to find the room where the big meeting is being held, and reporting everything is OK when it isn't.)

But I think there is another issue that we overlook. It is one of the reasons the fears listed above take root, it is why the "gotcha" mentality still exists, it is why auditors hide behind their reports, and it is why internal audit, in many organizations, does not live up to the potential of our profession.

I believe that a sizable majority of internal auditors and internal audit shops suffer from an inferiority complex.

OK, I can already hear the outraged outcries against such defamation — the howls of protest, the screams from damaged egos, and the silent cry of hurt feelings. But ask yourself, how do you approach your organizational peers, how do you address questions about what the department has accomplished, how do you comport yourself in meetings, how do you act, and how do you work? Do you approach all instances with a quiet, unquestioned confidence? Or do you allow yourself to be defined by the questions that haunt us about our worth and how we are perceived?

Even for those of you who believe you have a strong audit department, strong people, and a strong brand, do these questions lie in the back of your mind, subverting your ability to step forward as boldly as you should?

Ask these questions … and be honest with yourself.

Even as we succeed, there seems to be the constant and consistent need to prove ourselves time and again. I don't know how this happens, but I see it in the actions of audit departments with which I have worked, and I hear it in the way people talk about the work they do. Maybe it is because we do not think we are seen as an integral function of the company, maybe it is because we are sometimes considered the ugly stepchild of accounting, or maybe it is because we seem to be in constant battle with the people with whom we are trying to partner — trying to help succeed. But it seems that there is an underlying attitude and need to constantly prove ourselves — to say, "Look at us, we're your friends, we provide value. Honest. Don't you like us?"

You want an example? I've always thought the involvement many internal audit departments have in the organization's U.S. Sarbanes-Oxley Act of 2002 projects is a problem. And it all stems from when Sarbanes-Oxley first reared its ugly little head and no one else wanted it. They turned to internal audit and we were so excited they noticed us cowering in our corner that we jumped at the chance. Now, too many audit departments are too involved in Sarbanes-Oxley. It has become an albatross around our neck that we cannot remove.

And this inferiority complex is at the root of why we always seem to find something wrong; it is why we have so much trouble issuing clean audit reports. Seriously, how many times have you reported controls were effective. And, if you did, did you hedge your bets by issuing memos or something about "unreported minor issues"? Did you still find something/anything? I know, we'd love to say that everything is clean, but there is always something to find, isn't there?

How often is what we find really important — even worth mentioning? And how often do we include it because our inferiority complex insists: 1) that we prove our value by finding something; 2) if we give them a clean audit and something goes wrong, they'll pick on us; and 3) a clean audit report means we didn't do anything?

I, like you, have preached that we provide value even when we issue a clean audit report –— that we are providing assurance. But we cannot seem to escape the belief that a report with no findings is useless; and if the report is useless, the work is useless; and if the work is useless, the auditor, the department, and the concept of internal audit are useless. So, we better report something.

In fairness to the team that took such drastic steps with The Mad Tea Party, this attraction has had a history of incidents. Much of the information I've provided about this attraction comes from the excellent book The People v. Disneyland by David Koenig, a fascinating book that discusses that strange world where Disneyland and attorneys intersect. And in the book Koenig notes that the attraction had generated at least 20 lawsuits. So, it may be that the safety experts were reacting to past incidents as much as the one under scrutiny.

And, after a while, the ability to spin the teacups was returned — the controls were loosened. But the damage had been done. And many people began to have second thoughts about anything that team proposed.

But the final outcome isn't the issue here. What matters is how it all happened in the first place. And how a team, in an attempt to make themselves look valuable, came up with stringent controls that resulted in The Teacup Folly.

Yes, we have to prove our value. But we cannot/will not prove our value by working from a place of fear and insecurity. We have to do the work we know is valuable, and let that work stand on its own — not frantically prove value in every step.

In every audit, in every engagement, stop and ask yourself, "What am I trying to prove?" Of course we are trying to prove that controls are in place to ensure effective achievement of objectives. But are you also trying to prove something about yourself and your department? This is not necessarily a bad thing, as long as you are trying to prove that value in a positive way. But when you are trying to prove it as a way to disprove the doubts that are within yourself, you are working from a foundation of weakness

Internal audit is a noble profession. Internal audit has value. And internal audit is an integral part of the success of any organization. And when we work from an understanding and belief in that foundation, then the work and the value will stand on its own.