After exploring the question of who the prime customers of the internal audit function are, the next point to clarify is what specifically provides value to them. Furthermore, lean asks us to understand how much added value specific outputs deliver, and also asks us to pay close attention to what does not add value.
IIA standards currently state that internal audit functions should be managed in order to ensure they add value to the organization. It is stated that “internal audit adds value when it delivers objective and relevant assurance,” and also when it “contributes to the effectiveness and efficiency of governance, risk management and control processes.”
With such a clear emphasis on the importance of adding value in the IIA standards one might imagine that all audit functions would comfortably do this. However, my experience is that:
One of the reasons for a gap in the value internal audit is seen to provide may stem from a view that by simply following the IIA’s high-level definition of adding value an internal audit function will be seen to be adding value in the eyes of key stakeholders. My experience is that whilst objective assurance might add value to the board and audit committee, it may not be particularly valued by senior or middle management. This is because they may be looking for help in addressing the current business issues they face, rather than receiving an assessment of the way certain processes were working three or six months ago. Over and above this, they may be sensitive to shortcomings for their area of responsibility being identified and then reported onwards to senior management and the board.
The following account by Richard Chambers (President & CEO of the IIA) emphasizes just how easy it can be for an audit function to lose contact with what stakeholders want, as well as the consequences of this:
“There was an episode when I was in a leadership position for the U.S. Army internal review (internal audit) function. We were trying to figure out why so many of our audit departments were being downsized. In the wake of the fall of the Berlin Wall, the Army was downsizing but the internal audit function seemed to be getting smaller faster.
I spent about six weeks talking to internal audit stakeholders, listening primarily to those who would be the equivalent of the CEO and CFO in the corporate sector. One commander explained how he made downsizing decisions. He said he needed the process to be collaborative in order for everyone to feel that they had been heard. His personal view was that internal audit was delivering value, but when he called in the directors of the different components, such as engineering and contracting, they were quite vocal about the lack of value that they were getting out of audits in their areas.
This goes straight to the heart of the importance of adding value. A particular department may not be your primary focus but, at the end of the day, they will be heard. Whether in a survey, in the executive boardroom, or on the golf course with the CEO, they will be heard. If they feel internal audit is not adding value, or is overbearing, or is not particularly user-friendly, they will be heard.
Another situation may not be as dramatic, but it can’t help internal audit’s reputation if these people have a sense that we’re not adding value for them. It is very important to make sure that every recipient of internal audit’s work has a strong appreciation for the value that they get – even if they’re not the ones we work for directly.”
Richard’s remarks emphasize the need to balance the demands of a range of internal clients and stakeholders, as discussed in the last chapter. They also highlight that adding value is not simply about what internal audit does but how internal audit does it (i.e. the managers’ dissatisfaction of internal audit being “overbearing” and “not particularly user-friendly”).
Whilst it is important to take into account the needs of key internal stakeholders, a truly lean approach would encourage audit to distinguish between:
Lean encourages an orientation towards the latter two perspectives where possible.
Being a lean, progressive, internal audit function starts with making a clear commitment to adding value, as well as driving out waste. Making this commitment often comes from recognizing that an internal audit function needs to demonstrate its value in order to thrive in the long run.
Ivan Butler (CAE, Denbighshire County Council) explains how he started his lean auditing journey:
“A few years ago, as part of a council-wide efficiency review, each department had to go before our corporate executive team to explain how they delivered their service, what value this added and whether this could be done more efficiently.
We were a service in our own right, when we went before the executive team one of the executives said: “What would happen if you weren’t here? What is the point of internal audit?” I responded with the usual stuff, talking about giving assurance, preventing fraud and helping managers. We were doing some good things, but it made me think a lot afterwards. In particular, I realized that if they said: ‘We just want you to do your core assurance work’ we could probably do that with a much smaller team.
So, from that point on, we have been on a journey thinking about the ways lean principles can help us deliver more, and over the years it has opened my eyes to different ways of thinking, and realizing there is a lot of stuff in audit that we can do differently.”
The principle that internal audit should see its role beyond just getting through the audit plan and delivering reports is central to thinking about adding value. In fact, I would argue that a focus on delivering audits can sometimes get in the way of an audit function delivering value. Nicola Rimmer (former President of the IIA UK) provides this perspective:
“With the corporate failures over the last few years, you can’t just say providing an audit is adding value. You’ve got to have the insight and business intelligence to know where to audit and also to be able to help management move things forward, provide them with a bit of direction, provide them with information about best practice, as well as challenge when appropriate. That’s where the added value comes in, it’s not just providing audit reports.”
In practical terms, therefore, a lean audit approach encourages an audit function to consider its remit, strategy, audit methodology and other ways of working, and to consider the extent to which adding value and productivity is highlighted as a clear priority.
However, lean, progressive auditing is not just about “bolting on” phrases concerning adding value and waste elimination, although that is an important step to take. It is about re-orienting all aspects of the audit function’s activities towards these goals, as will be discussed in later chapters.
Actions for Internal Audit to consider:
The lean mindset is simple: to become a valued part of the organization, it is essential to properly engage with key customers about what they actually value. One CAE offered the following advice:
“The first thing you’ve got to do, before you can say whether you are adding value, is get a definition of what added value means to your key stakeholders.”
At the outset it should be noted that different senior managers and different board members often have their own views about how audit can add value, based on their experience and a range of other factors. In my experience a number of common themes emerge. These common themes are summarized in Table 7.1 with reference to three key stakeholder groups, the board, senior managers and other middle managers.
Table 7.1 Common Themes
| Characteristic/Output | Board | Senior Managers | Other Managers |
| Advisory work | Some appreciate this but most want assurance | Some appreciate this (i.e. a satisfier and sometimes delighter) | Some appreciate this (i.e. a satisfier and sometimes delighter) |
| Assurance work | Creates satisfaction | Sometimes depends on the outcome | Sometimes depends on the outcome |
| Cost of audit | For some not a major concern if the quality is there | Would prefer lower cost (i.e. dissatsfier) | Would prefer lower cost (i.e. dissatsfier) |
| Cost savings identified | For many not a major driver | Many value this (i.e. satisfier or delighter) | Depends whether the savings benefit them or not |
| Report length | Require sufficient detail to be useful | Prefer shorter (i.e. dissatisfaction if too long) | Dissatisfaction if not balanced |
Other common themes are provided in Appendix A.
Understanding stakeholder needs through Kano analysis allows an audit function to be clear about specific ways of operating that may affect how it is valued. It is tempting to regard some of these perceptions of what adds value as rather irrational (e.g. if they do not appreciate the outcome of a specific assurance assignment); however, Richard Chambers (President & CEO of the IIA) supports the need for auditors to engage stakeholders on questions of what adds value:
“We should never lose sight of the fact that we do not define value. It’s our stakeholders who define what value is. You must start with the stakeholders as you work through this process.”
Where there are areas of alignment between key stakeholders, internal audit has at face value a clear mandate to deliver to those requirements. For example, if all key stakeholders want shorter audit reports, then making reports shorter will deliver added value and at the same time probably take less time and resource! Thus, being lean does not mean that everything should be cut equally. Some areas could be reduced significantly, or cut out completely, with no loss of added value (they may even elicit a positive reaction), whilst other areas may need greater audit attention to deliver untapped value.
However, alignment between key stakeholders (such as senior management and the board) in relation to what they want should not always be regarded as a clear sign that audit is adding value. For example, senior management and the board may want a lot of detailed compliance checking to be done by the audit function, but that might not always be the most value-adding thing to do when an external customer perspective is factored in, because, for example, another area of greater concern to them may not be working as well as it could be.
Actions for Internal Audit to consider:
As discussed earlier, stakeholders may have different views about what adds value and what does not. A key difference is often a management preference for advisory assignments, compared to a board preference for more assurance assignments.
It is very tempting and understandable to want to downplay the importance of these differences for fear of upsetting stakeholders, but lean principles demand clarity and alignment around adding value; for example, being clear during the audit planning process about the balance between advisory and assurance assignments.
This importance of paying attention to differences between stakeholders, rather than ignoring them, is endorsed by Richard Chambers (President & CEO of the IIA):
“If your audit committee says, ‘We want you focused on assurance over financial controls,’ and executive management says, ‘We really would like for you to give us more insight and advice on key operating controls,’ then you have a dilemma.
As a CAE, you have a responsibility to serve both management and the board. If the board is telling you one thing and management is telling you another, it’s a slippery slope. You can’t just say, ‘Well, management, I’m sorry but the board wants this,’ because, ultimately, management allocates internal audit’s resources.
My advice, when there are differences between key internal stakeholders, is to get a reconciliation of expectations. Pull management and the board into a conversation, and make sure everybody understands: ‘Look, we’re here to serve all of you, and we want to make sure that we do so in an open and transparent way, so all stakeholders’ expectations are known.’ ”
Some CAEs successfully manage stakeholders in this manner. However, in my CAE coaching work, I find some CAEs having to rethink the way they relate to their stakeholders, since for them a significant dynamic in their relationship has been simply to deliver what the stakeholders want without any serious challenge!
Maintaining relationships with key stakeholders whilst being able to challenge them is one of the delicate balancing acts that a CAE must achieve in order to be effective. Perspectives on how this can be done are contained in the next chapter, which discusses the relationship between lean and the attributes of independence and objectivity.
Actions for Internal Audit to consider:
As outlined earlier, lean does not favour any specific internal stakeholders in relation to the delivery of added value, since the ultimate aim is to add value to the external customer. However, it does explain why the board and senior management will often take precedence over line management (since in terms of materiality and impact their needs may be of greater benefit to external customers).
However, ignoring the needs of line managers can result in difficulties, partly because they may give negative feedback, but also because their needs may sometimes align more closely with those of the external customer (for example, line manager concerns about the functionality or reliability of a new system that will be customer facing or the way processes are impacting customer service levels).
Andy Weintraub, (experienced internal audit leader), and a former colleague of mine, outlines his solution to delivering added value to multiple stakeholders:
“How do you prioritize between stakeholders? I try to make all of the managers I work with feel important. Fortunately in many instances their requirements have different timescales to those of the board or senior management, so you can factor that in and meet most of what each wants. If we’re in an assignment, the senior manager that’s responsible for that area is my priority, but I can also be bearing in mind that there is an audit committee question that needs addressing as well – but that won’t need to be reported on until the next quarter.”
Progressive, value-adding auditing centres around an awareness of multiple stakeholder needs, alongside a recognition that audit has only limited resources and therefore boundaries need to be placed on requests of lesser importance. The best functions aim to manage these multiple demands with a degree of empathy, often giving something to management (even if it is just pointing them towards some guidance or best practice) whilst offering a clear explanation of why there are limitations on what audit can do.
Actions for Internal Audit to consider:
Some CAEs tell me that their board members value long and detailed reports. This is fine, but lean encourages us to consider both value and cost. Consequently, if the board member knew that the long report was taking four days to write, they might be content, but often they might prefer a shorter report taking one or two days. Thus a lean approach encourages greater clarity of choices being made and their impact on customer value: should audit use the time saved from a longer report to do two days more auditing (perhaps looking at root causes), or two days auditing elsewhere, or as a way of lowering costs?
Consequently the response to the question: “Does audit have enough resources?” should not be a simple “yes” or “no”, but rather “Well it all depends what you want from internal audit.” A good case study of how to get a better, richer, engagement with key internal stakeholders in relation to resources is provided by Richard Young, (CAE of the Universities Internal Audit Consortium (UNIAC)):
“We work with a large number of different audit committees and senior management teams, so there is a degree of change every year. As things change we organize time together, for example, a half-day away day.
We say: do you want to treat audit as an investment or an expense? We work together to help these stakeholders see audit as an investment. And if you want to invest in something you want the best possible return. And if you want to get the best possible return that’s about investing time on an ongoing basis where we can sit round the table and explore what we are planning to do for you and why. As a result we can see these stakeholders valuing more audit work in relation to business projects and other strategic issues, rather than just core compliance and financial control areas.
I think it’s fundamental that we continue to get the debate going on investment versus cost in relation to audit. That’s where lean comes in. Concentrating on the right areas first, then once this is clear cutting out the waste, the things that we’ve done because of tradition rather than because they are really important.”
Actions for Internal Audit to consider:
I sometimes ask auditors to consider specific occasions when they have delighted stakeholders. Often there is a pause and silence, with some auditors explaining that it should not be expected that internal audit should “delight” stakeholders.
However, some auditors are able to cite examples when they have delighted senior management, and when they do this, it is often notable that this may not have taken a lot of time and effort on their part. For example, one CAE explained to me that her relationship with a CEO had been transformed by doing two relatively short assignments directly for him that were time critical but highly sensitive, and handling these in a way that built trust between them. She explained:
“I was relatively new to my role and wanted to start things off in a good way with the CEO. I volunteered to take the lead looking at a couple of specific issues in the first few months, delegating other work, and taking great care to communicate with discretion. Some difficult issues emerged, but it shifted the CEO’s perspective of what I could do and the value internal audit was capable of delivering.”
Sometimes a simple output (e.g. a diagram in an audit report) or a minor innovation can add lots of value – the trick is to create a culture within internal audit that is on the look out for these new ideas, trying things out and getting feedback as to whether they are working.
Another senior auditor offered the following reflection:
“I think the profession needs to be prepared to do some things differently. I think we get stuck sometimes because something has never been done before. We’re not that adventurous as a profession.
Whilst being innovative might feel risky to some audit functions, if this innovation is informed by insights based on what stakeholders like and do not like, then the risk is going to be quite low, especially if new approaches are positioned as pilots. Indeed I would argue that the greater risk to audit in the long run is that it does not change with the times, and becomes stale.”
Actions for Internal Audit to consider:
As discussed in an earlier chapter, understanding the “Voice of the Customer” is fundamental to being a lean, value adding audit function. Thus, getting feedback after each assignment is essential. Of course, many audit functions do this through a questionnaire approach but often it is the “auditee” who has just been audited that is asked for feedback. However, the “auditee” may not always be the key customer. On a number of occasions, clients and workshop participants have recognized that feedback should be obtained from other stakeholders, not just “auditees,” on a more regular and disciplined basis.
I also hear auditors explain that response rates to questionnaires can be quite low, and the quality of responses can be disappointing (e.g. “they ticked the boxes and didn’t make any comments”). Auditors tell me this is to be expected given the workloads and other priorities of managers. However, delivery without feedback does not reflect a lean way of working. The spirit, the essence, of lean is to be passionate about understanding what customers think. After all, a low response rate may not be a neutral sign; instead it may be a sign of apathy towards what audit is doing. Likewise a pattern of long delays before managers give their feedback, or where audit regularly has to chase management for responses, should be regarded as a warning sign of potential disconnect from adding value to the organization, and not just accepted.
Looked at another way, an organizational culture in which poor or late responses to audit questionnaires is normal, is a culture that can and should be improved by lean ways of working.
Audit functions that strive to add value, try alternative approaches to getting feedback, rather than just sending a questionnaire. Successful approaches include (short) face to face debrief sessions (even immediately after an audit assignment), or through stakeholder meetings at intervals in which the performance of audit and the value of recent assignments is discussed. One CAE explained their approach to feedback:
“I’m an advocate of a qualitative approach. It takes time going round to see key players at intervals, but it’s a good discipline. What did you want from recent assignments? What did you get? How did you find the team? How quickly did we respond? Did our work make a difference? That kind of thing.”
In a recent External Quality Assessment (EQA) for an audit function, I noted that whilst there was a feedback process after each assignment, the audit management team only received updates of the overall feedback scores on a quarterly basis, with just a few qualitative comments included in summary form. My advice was that having a feedback process was good, and it was also encouraging that most managers responded, but there were signs that the feedback process was becoming something of an administrative exercise. Going forward, the CAE agreed that key strengths and weaknesses from assignment feedback should be “fast tracked” to him as soon as they were received, so that he and the audit management team could escalate and respond to any serious issues quickly if needed.
Andy Weintraub (experienced internal audit leader) sums up the mindset of progressive auditing, determined to add value:
“Recognize things won’t always go well in audit. There are bound to be times when you are going to stumble, when there are going to be issues. My personal approach is to ensure these don’t fester. My advice is not to let things wait, to take care of them right away, most especially if they are things that could impact the reputation of the internal audit function.”
Actions for Internal Audit to consider:
The dilemma facing many audit functions seems to be the need to reconcile professional obligations to deliver independent and objective assurance and advice, alongside the delivery of a range of other customer wants and needs, not all of which are in alignment.
I hope auditors reading this chapter will have noted the rigour of the lean approach to understanding what adds value (somewhat akin to applying an analytical audit mindset to this often quite subjective area). Furthermore, lean ways of working demand an ongoing engagement with the need to add value, and reduce non-value-adding work, as a key engine for driving effectiveness and efficiency.