During a session at this year’s IIA General Audit Management conference, an audience member asked for advice. His internal audit group had reported that the company’s accounting controls could be strengthened by developing written procedures. The accounting department’s response? “We don’t have the time; you write them for us.”
I’m sure every red-blooded auditor reading this reacted just as the crowd did — with shock, horror, and the phrase “we don’t do original work” bursting from their lips. I was right there with everyone else.
Much later, I looked back on the chum-filled feeding frenzy and realized we had spent a lot of time focusing on the wrong issue. Impassioned discussions about internal audit’s independence, objectivity, and integrity may make us feel good, but most of our clients believe these are nothing more than buzzwords that serve as an excuse to find problems without being part of the solution.
When someone asks us why we can’t write procedures for them, it speaks to the far too common misconception that controls are internal audit’s job. It shows that the client has not embraced ownership of controls and the related control structure. And it reminds us we have the never-ending task of explaining to our clients that internal audit is not responsible for controls. For that matter, it is not the job of executive management, risk management, compliance, the Sarbanes-Oxley team, purchasing, marketing, janitorial services, or even a department that happens to be named The Place Where All Procedures Get Written.
The message that should be delivered to any department wanting someone else to write its procedures — to effectively outsource responsibility for controls — is that they may as well let someone else take over their area. By abdicating control over controls, they are effectively saying that all processes can be turned over to someone else. And that means there is no longer any need for the department.
And as a side note, it’s important to keep in mind how the solution to this issue became evident — by stepping back from the client’s argument about writing procedures and reframing it in a way that addresses the root problem. The issue is not that internal audit should not be writing procedures; it is that clients should own their own controls. Any time auditors find themselves in a losing argument, they should take a breath, step back, and make sure they are not arguing about the wrong problem.
So the next time someone asks why internal audit can’t write procedures for them, remember that they are not questioning internal audit or even the need for controls. They probably just don’t understand what ownership of controls really means. And that is a problem we should be able to help them with.