Skip to Content

Finding the Findings Sweet Spot

Blogs Mike Jacka, CIA, CPA, CPCU, CLU Mar 09, 2021

In my last post, I wrote about those internal audit departments that do not feel they have proven their value unless they find something — anything — in every single audit. It was my premise that part of this comes from an inferiority complex — internal audit departments and internal auditors who live in fear that people think they are worthless and, as a result, feel they must use every audit to allay those fears, fears whose source can be traced right back to the auditors and audit departments themselves.

But there is another side of this equation, the audit department that, in an effort to be a team player and not make waves, does everything and anything to just get along. In response to the feelings of insecurity and inferiority they have built within their own minds, they shy away from the conflict that naturally occurs in any robust and effective internal audit department.

And here's the crazy part. Some shops manage to not only find something to report in every audit, but also make sure that those findings are of little consequence in the fear that any potential conflict might hurt the department's reputation.

The approach of reporting everything while reporting nothing has its roots in the worst of both worlds. There is the desire to keep executives happy — to not ruffle feathers by showing how something might be wrong. But the audit department has to prove its value by reporting something. So, the minor issues come out as major, and the unimportant evolve into important. And the report is packed with stuff — stuff that doesn't really matter, but makes it look like the internal audit department is "working real hard."

Obviously, this approach speaks volumes about what is wrong with the audit department. But it speaks even more loudly about the associated executives, their relationship with internal audit, and their desire to obfuscate the real goings-on within the organization.

With only minor things making it into the reports, the executives are off the hook. Any work that needs to be done to "make controls more effective" can be pushed way down the org chart. And the bigwigs can puff their chests, proclaiming, "Yes, there were a number of issues identified. However, we have been able to clear them up effectively, efficiently, and quickly. Further, while issues were identified, you can see the impacts are relatively small. There are no big issues, and no big concerns within my department and within the organization. And it once again proves that we have the finest internal audit department in the world. Look at all the things they are finding, look how they are providing so much assurance, and look how strong our organization is."

And life goes on within the organization. And the executives go on, unsoiled, hiding the bigger issues, risks, and projects from an audit department that, because of the praise and reinforcement it receives, thinks it is doing a good job by finding immaterial things and by getting the accolades of the big boys.

And one day, everyone is out of work. And the head of audit looks up from the line at the unemployment office, stunned, wondering what happened.

Take this one to heart: If they give you accolades and you have never made them uncomfortable, you are not doing a good job. And you may have temporary job security, but it won't last past the demise of the organization.

There is a sweet spot, a spot where it is not necessary to report everything, but important things — organization-shattering things, uncomfortable things — are included without hesitation. That sweet spot takes time to find. It takes time to figure what is right for the department and for the organization. You won't always hit that sweet spot. But the important thing is to try and find it. And to try and find it without the omnipresent fear of inferiority clouding your judgment.

And, with all that being said, what do you say we pivot this conversation?

In response to my last post, a reader on LinkedIn said that the words I had shared hit home for him. In fact, the type of situation I described in that post was why he left internal audit and why he hesitates even considering rejoining our profession.

Here, in part was my reply:

"I understand your pain ... My only comment to you is that you should not write off the profession because of your experiences. When in such situations, each of us can help make a difference … And to anyone still in the internal audit profession facing these challenges, persevere. No matter your situation, change can occur. It may be the need to change mindsets, or it may be the need to change the organization. But, as I said at the end of this piece, internal audit is a noble profession, it adds value, and [when done correctly] should be a part of any organization's success."

Ultimately, what this reader's comments made me realize was that, once again, I was falling into the role of the specter at the banquet, the sayer of doom, the jerk who keeps proclaiming that the glass is not only half-empty, but you don't want to drink what it contains.

In the previous post and in the piece you hold in your virtual hands, I've spent most of the time (maybe 90%) rending my garments in dismay over the negative traps into which internal audit departments fall. All those words, and yet the important part is that other 10%.

Allow me to repeat myself. We are a noble profession. Done correctly, no one — repeat it with me, NO ONE — can do what we do. Our independence and objectivity places us in a position that is unique in the organization. No one else has that position; no one else has that power. And, done correctly, we are an integral part of any organization's success.

Yes, many of us have worked in departments that weren't very good (some downright awful, in fact). But many of us have worked in ones that set a standard for others in the profession.

Most audit departments are probably somewhere in between those two extremes. That is why I rant so much about the low end of the spectrum. We always have to keep that in mind; it is what we are trying to avoid. But, just as I mistakenly do in many of these blog posts, that focus on the worst can make us feel we are failures. We have to get past our insecurities, our inferiorities, our failures. We have to realize that the past impacts what we currently are, but it belongs in our rearview mirror — something we want to keep in mind, but something we ultimately need not worry about as we focus on what's ahead.

We are a profession that, when we do it right, is invaluable to the organization. We just have to believe in ourselves and allows ourselves to make it happen.

Mike Jacka, CIA, CPA, CPCU, CLU

Co-founder and Chief Creative Pilot, Flying Pig Audit, Consulting, and Training Services (FPACTS), based in Phoenix.