An Internal Audit Dilemma: When Management Goes Rogue
January 12, 2015What Internal Auditors Can Learn From the Blizzard, Measles, and Underinflated Footballs
January 27, 2015In an effort to raise awareness about objectivity, I often pose a series of questions to internal auditors. Have you ever been called upon to direct or conduct an audit in a department where a friend or relative works? Have you ever participated in an internal audit of a program, function, or business unit in which you worked at one time?
How about an audit of a finance function that aligns under the same CFO as internal audit? Have you ever audited the expense reports of the CEO?
I could go on, but the point is this: Every day, internal auditors are faced with potential conflicts of interest that could impair objectivity. Even if we maintain an objective state of mind, would others in the company wonder if our results are accurate?
Like any profession, the reputation of internal auditing is influenced heavily by the confidence we inspire in third parties. This confidence is conveyed through the credibility we earn imparting objective assurance on the effectiveness of internal controls, risk management, and corporate governance.
Nothing is more critical to our reputation as internal audit professionals than credibility. Other skills may need to be developed or even refined over time, but credibility cannot waver. Without it, the reputation of the entire internal audit function can be tarnished and even the best insight and recommendations may be ignored. And, once credibility is lost, it can be exceedingly difficult for an internal auditor to recover.
My short Audit Channel video, Credibility: The Secret Weapon of Auditing Effectively, shares tips that can make a real difference in whether an internal auditor is perceived as credible. But as I look back at the video, I realize that I may have missed an important point: Credibility emanates from objectivity.
Credibility doesn’t just mean being honest. To be sure, honesty is essential to credibility, but stakeholders also must be able to trust the judgment behind a recommendation and have confidence in the accuracy of a report. This is where objectivity comes in. For internal auditors to be viewed as credible, we must have and exhibit an impartial attitude and avoid even the appearance of a conflict of interest. We should leave no room for even the slightest suspicion that we were biased when conducting the audit or communicating the results.
According to our professional guidance, objectivity is considered impaired if the auditor designs, installs, drafts procedures for, or operates a system that is being audited. We know that, but some of us may not consider that our credibility also may be perceived as impaired. Even if the engagement is performed in a truly unbiased manner, this lack of credibility may ultimately impact acceptance of our recommendations by management.
As internal auditors, we are expected to “trust but verify,” to report the good as well as the bad in the results of our audits. So we can’t just assume people are doing things right, even if they are well-respected and well-intentioned. Each of us is ultimately responsible for our own credibility and objectivity. But when it comes to being viewed as objective, internal audit management can help by organizing staff assignments to prevent the potential for conflicts of interest or biases, periodically obtaining information from the internal audit staff regarding possible conflicts and, when practicable, periodically rotating internal audit staff assignments. If real or perceived objectivity impairment is unavoidable, then I always urge full disclosure in the internal audit report. It is better to address such issues head-on than to risk being perceived as having concealed them.
We may not be able to control all the factors that impact auditor credibility, but the internal audit staff should always be viewed as objective. In internal auditing, credibility is impossible without objectivity. And, without credibility, internal audit will ultimately be ineffective.
I welcome your comments via LinkedIn or Twitter (@rfchambers).