Skip to Content

Building a Better Auditor: When the Leader Is Challenged

Articles Mustafa Yusuf-Adebola, CIA, CPA, CFE, CGA Aug 31, 2021

​Xi joined a government agency a few years ago and has a good working relationship with the head of the agency, Xyrl. Xi has been able to provide assurance on the agency's objectives in a way that the agency has never seen before.

Previously, Xyrl thought internal auditors only looked out for mistakes or what went wrong, but ever since Xi arrived, providing consulting expertise in addition to assurance engagements has really turned things around.

Xyrl has found the contributions very useful and has grown to trust Xi. Putting structures in place has eased her role as the head of the agency. At times, Xi highlights issues for the various departments to consider before, during, and after certain projects.

Such contributions have changed their mindsets so that they see the internal auditor as a business partner. But Xi never forgets to remind them that there is a difference between assurance and consulting engagements.

Recently, Xi has noticed that Xyrl has changed her habits. Where Xyrl used to respond to emails and recommendations and look forward to suggestions, she has become somewhat distant. At an internal meeting with other stakeholders, Xyrl suggested that Xi may "take a break," as the recommendation made was not feasible. This was something Xyrl had never done before.

At another encounter, when Xi tried to discuss something urgent she had observed, Xyrl responded, "I'm sure you know how to handle it." Another time, Xyrl decided to override the risk mitigation procedures the internal audit team had recommended in a show of power of who heads the agency.  There were rumors that Xyrl's tenure at the agency may not be extended in a few months, which may have led to the recent "I don't care attitude." 

Unfortunately, Xi also has noticed that motivation at work has been slightly affected and mistakes she never used to make when reporting are now occurring. The truth is there may be best governance practices, systems, and policies in place, but in real life, the human element could threaten all of these.

This scenario is typical during the last days of a leader's tenure — some handle their last days well, others burn the structures they had built over time, and some are in the middle. Xi's team noticed the behavior at the last meeting, and one of the junior team members said, "I don't like the way Xyrl talked to you at the meeting. How do you handle the situation?" Here are tips to address the problem Xi encountered.

Be Professional: Work Must Go on

Xi told her team member not to worry about the situation. "My job is to provide assurance on management's activities to relevant stakeholders and not to make enemies. Our work should be able to speak for us and end users must have confidence in our output," she said.

Xi wanted to make sure the junior staff did not see that event as an "us versus them" scenario where they take situations personally. She further assured her team that internal auditors are to conduct their work in a professional and competent manner. Do your job!

Assume Leadership

Every leader also is a follower of another leader. Thus, while Xi's team members were observing what is going on, Xi also has observed Xyrl's leadership style over time and noticed that her behavior has changed.

Xi is providing mentorship to her team by her actions during these changing times while trying to manage the challenges. Applying the philosophy of Theory U can help refocus the mind on performing core functions. Theory U is a method of addressing change that advises individuals to observe the environment, sense changes going on and let go of unnecessary/temporary distractions, reassess self-principles, and realign one's self with vision and intention. In assessing changes in behavior, internal auditors should remember that their responsibility is not to an individual but to the institution and stakeholders who rely on their work.

Be Self-aware

It is easy to read theories, scenarios, and case studies until these happen to you in real life and you have to make quick decisions. Rules are written in theory; principles are applied in contexts. Self-awareness is closely linked to principles and this can intersect with an ethical framework when situations arise. The IIA's Code of Ethics expects internal auditors to apply the principles of integrity, objectivity, confidentiality, and competency.

Keep Documentation

A compensating feature for internal auditors is documentation. While Xi may not have the power to make certain decisions that the agency's head can make, appropriate documentation of observations and issues provides evidence when the need arises. Documentation is not intended to present internal audit as an "I told you so" activity. Moreover, documentation helps when another individual assumes your role or during a handover period. 

Maintain Independence

Xi is fortunate that as the resident auditor at the agency, she has a dual reporting role. Her primary responsibility is to the government, the government's audit branch, and the agency. Thus, she was not afraid of threats.

Certain situations arise where this scenario occurs in a private organization and Xyrl is the chief audit executive (CAE) who interacts with the board. In that case, auditors cannot override their bosses or call them out if they are doing the wrong things. Nonetheless, self-awareness is important in defining your principles and guiding the actions you take.

Independence is a core feature of internal audit. While internal audit provides assurance to management that controls are in compliance with relevant regulations and laws, auditors do not perform management responsibilities or act as if they are part of management.

Handling Changing Situations

At a private organization, this scenario could be dicier. If Xi reported directly to the CAE, she should assume leadership should be handled with care. That is, while displaying leadership qualities and not letting the situation affect them personally, auditors must take care that their actions do not send a signal to the CAE who frustrates them.

Also, some exiting leaders do not mind destroying structures upon leaving; they can burn bridges that may cause problems for auditors long after they have left. Thus, auditors should not come across as usurping the actual role but instead provide support to the departing leader as much as possible.

Organizational politics are unpredictable. In certain situations, depending on your relationship with the person in question, you can engage by talking, connecting, and sharing experiences. After all, "what is not discussed is not understood."


Mustafa Yusuf-Adebola, CIA, CPA, CFE, CGA

Mustafa Yusuf-Adebola is a fraud risk consultant and systems thinker in Ontario.