Every month, Jorge Badillo, internal audit manager at SCM Minera Lumina Copper Chile, leaves company headquarters in Santiago and takes a two-hour flight followed by a three-hour drive to the organization’s mines in the Atacama Desert. Donning a hard hat, he inspects the mines and makes sure he understands the issues that arise in the pit and plant. “The mine site is where things in this business happen,” Badillo says. “Internal audit’s job is to fully understand the everyday challenges the company faces.”
Next year, for the first time, Badillo and his three-person audit team will carry out what he calls a water balance audit. Water is a key resource in the extraction industry, but a scarce resource in the desert, and the company must comply with statutory rules and regulations. The audit will look at how much water comes into the mine, how much goes out, and the level of recycling the mining process entails. This will provide third line of defense assurance to the continuous checks already carried out by management. His audit will aim to identify opportunities to improve how water is used and controlled. Badillo will use a subject matter expert from his cosourced audit supplier to help, with the understanding that there will be knowledge sharing between the service provider and his team.
“We’ll get a deeper understanding of the audit process, a more rigorous audit, and, in future engagements, we’ll be able to do more of it ourselves,” he says. “Building such business knowledge is critical to audit’s ability to serve the organization.” Badillo’s team conducts audits on explosives used to mine raw materials, but, he says, without in-depth knowledge of the type and nature of the explosives used, the team would merely be doing a purchase-to-pay audit. Management needs an assessment of the quality and effectiveness of the explosives, themselves, which takes the audit to another level in terms of its value to the company.
Badillo applies a risk-based audit approach in developing the rolling five-year internal audit plan. About half of all audit engagements have an operational focus, such as fuel management, reagents management, logistics and shipments, and other core business areas. For that reason, business acumen is a prerequisite for success.
Building business acumen within the audit team has never been so important. With fast-changing geopolitical events; disruptive business models; and the increased impact of digitalization on business products, processes, and services, internal auditors need to know their organizations inside out if they are to provide effective and relevant audits. Aligning with the business strategy and objectives, creating a culture of learning within the audit team, and rotating experts through the audit department can all help.
Before Badillo relocated to Chile from Ecuador and joined the mining industry, he worked in banking, oil and gas, and in a Big Four firm, but knew little about his new sector. Since then, he has put himself and his team through an intensive, continuous self-learning process to develop the business acumen needed to do their jobs well. That has included subscribing to industry newsletters, understanding movements in the copper markets and the cycles of the industry, meeting regularly with management, and going to mine sites where most of the 3,000 employees and contractors work. At one point, he enrolled in engineering classes. “I was the only accountant in the course — the rest were engineers who wondered what I was doing there,” he says. Badillo also has had to learn about the Japanese parent company’s audit culture and approach. And he cofounded the Internal Audit Group within the Mining Council — the sector’s industry body in Chile.
“Auditors need to recognize they have limitations,” he says. “So, the first step is to make the decision to acquire the knowledge you need to reduce those limitations. You can never know everything, but the more you show an interest in the business and seek to understand it, the more support and credibility the audit team will build.”
Business acumen has been a buzzword in internal audit for several years, but what does it mean in practice? “When we are talking about business acumen today,” Larry Harrington, vice president, Internal Audit at Raytheon Co. in Waltham, Mass, says, “we are talking about things like being able to help organizations deal with speed of change by having sound judgment, a quick mind, a sense of the business’s vision and strategy, and having the ability to select the right course of action in uncertain times.”
In Tune With the Business
With the amount of rapid change in the business world, Harrington says being able to build an audit team with business acumen is critical to its success. “Every major company is having to transform itself and needs an internal audit team with business acumen to help it lower costs, improve efficiencies, and see ahead so it doesn’t become the next obsolete business.”
Raytheon has been developing a culture of learning around the three main knowledge areas that Harrington says auditors need to be on top of. First, they need to have a firm grasp of their organization’s strategy and goals. Second, they need to understand the trends facing the industries in which they operate. Finally, they need to get up to speed with how technology is transforming everything from homes to production lines and global communications to personal relationships.
“Those tools will help the audit team build relationships, interdependencies, and networking opportunities within the business,” he says. “We need to help with the transformation of our businesses and drive positive change — and for that we need to have deep understanding and connections throughout our organizations.”
Raytheon is fortunate to have a large audit shop of 40 people. About one-third of its auditors come from traditional finance and accounting backgrounds — the rest are hired from the business and, over time, have come from every function in the company. It also has a wide-ranging audit charter that provides the remit to go well beyond compliance work.
“It is true that not all internal audit shops have a broad charter and some have to focus on financial controls or regulatory compliance,” Tom Sanglier, audit director at Raytheon, says. “But that should not prevent those auditors from having meaningful and insightful discussions with stakeholders about the business and its objectives.”
Lack of Focus
In fact, large teams sometimes fail to develop sound business acumen, often because they fail to grasp just what it is that internal audit can offer the business. Derek Foster, former CAE at the U.K. postal service Royal Mail in London, says how internal audit sees its role within the business can have a major impact on its ability to deliver insightful, business-oriented recommendations and advice.
For example, internal audit can be understood as a professional support service within an organization in the same way that legal, procurement, finance, and other departments are. “That can be a trap in itself,” he says. “It can lead the function to focus too much on its technical and professional proficiencies, rather than also taking a route that will lead to providing more of a commercial perspective on risk in light of the business’ strategy and objectives.” Some audit functions have failed to shake off their historic focus on compliance, where business acumen is less valued in audit findings than tick-box exercises revolving around the adherence, or otherwise, to established policies and practices, Foster adds.
Either way, these shortcomings in taking the needs of the business seriously can reduce the quality of audit work. Foster says the audit plan at Royal Mail was linked to the business’s objectives to ensure that often scarce internal audit resources were deployed most efficiently. “You cannot have a plan that is full, but that contains assignments of limited impact,” he says. “When we did our risk-based plans, we asked, ‘why should this audit make the cut?’ The decision to include it was based on the importance of the audit to the business’s key objectives.”
That lack of focus from limited business knowledge and understanding can equally feed into the scope of individual audit assignments. Within any audit project, auditors need to be constantly reviewing and spending time on high-impact areas. “Insufficient acumen will lead to time spent on processes that do not matter to management or the business,” Foster says. Finally, one of the hallmarks of an underperforming internal audit function is that its recommendations are not proportionate or commercially sound. “Again, a result of insufficient acumen,” he adds.
When the shortcomings of having too little focus on business acumen are written in black and white, they seem self-evident. So, why do too many chief audit executives (CAEs) fail to develop their teams’ understanding of the business to a high enough level?
“Throughout my whole career, internal auditors have been criticized for not understanding the business well enough,” Bob Rudloff, senior vice president, Internal Audit, at MGM Resorts International in Las Vegas, says. “It’s certainly true that some CAEs do not structure their teams well enough, so there can be too many junior auditors on an assignment who don’t have even a simple level of business knowledge.”
That can easily happen when CAEs get so caught up in delivering their audits that they fail to maintain an effective development program for their auditors. Rudloff says such programs are crucial for helping auditors improve their understanding of the business and need to go well beyond any onboarding initiatives that aim to give auditors an initial orientation of the department and its role in the business.
At MGM, Rudloff has created a program of events, such as bringing in speakers from different parts of the business to share knowledge and answer questions. He encourages staff members to attend local IIA chapter meetings and often arranges panel discussions within the business that can be attended by anyone from the head of legal to the chief financial officer or chairman of the board. Past learning exercises have required individual staff members to read the latest business thought leadership books, summarize the contents, and share them with the team.
That program goes hand in hand with more formal training. “At MGM, we have had a big push for internal auditors to become certified and go through the CIA learning process,” he says. “We make the tools available for classroom and self-study, exam preparation, and so on. A CAE cannot be shortsighted and fail to provide that ongoing education.”
While he sees such dual-track programs as essential prerequisites to developing auditors who are both technically proficient and business savvy, he says younger auditors require more coaching and encouragement than in the past. That can put more of the onus for bringing them up to speed with the business onto the CAE and the senior audit team. In addition, the team at MGM Resorts has grown from 25 to 75 auditors in Las Vegas and another 25 located throughout the U.S.
“The business dynamic may be different in Michigan than in Las Vegas, and that needs to be reflected in how auditors at those sites understand the business and what it is trying to achieve,” Rudloff says. “As a leader, you have to be committed to doing this in the limited time you have, despite these difficulties, because if you don’t do it, you will be selling yourself and the business short.”
Building business acumen is not easy even in a small team, especially in an organization whose activities have little to do with finance or accounting — traditional internal audit educational backgrounds. Using cosourced internal audit services and recruiting from outside the audit function (secondments) to share knowledge on such issues as cyber risk and IT are two ways to build acumen.
“We have always had engineer secondments in our audit shop, and it has always been successful,” Jade Lee, director of Internal Audit at AltaLink Management in Calgary, Alberta, says. “Those engineers come out at the end of the secondment and invariably move into a more senior position within the energy infrastructure company.” Some move out of audit and become managers within the business. Junior engineers tend to secure more senior engineering positions after serving in audit.
In AltaLink’s audit function of six people, one is a secondment from the business. Currently, there are another two internal hires from other departments. Those people come into auditing with no technical audit skills, but they bring business knowledge at a level of granularity that is difficult for auditors to acquire.
“We can teach them the audit process, but they have to come with the right mindset and personality,” Lee says. “They need to be inherently curious, be able to ask good questions, and they often have a good sense of what is risky in the business because of their hands-on experience.”
She says it also can add credibility because the auditors can speak to engineers in the business on a more equal level in terms of knowledge and understanding. “It gets us away from people feeling that the auditors don’t understand the technical side of what they do but are asking them to change it. It’s more of a conversation,” Lee says.
Secondments are supposed to last 12 to 24 months, but Lee has had someone stay for four years. The benefit is that they are working on cross-functional projects across the business and often are speaking to executives with whom contact would be rare if they were still on the shop floor. At the end of their time in audit, they do an open-door lunch-and-learn where anyone can hear what audit is about and what to expect from such a placement. The events act as a showcase for others in the business who may be interested in joining the audit team for a while.
Making It Happen
Audit teams with strong business acumen deliver more detailed, nuanced, and transformative audits for their organizations. But learning what’s important to the business takes time and effort, and it has to become part of the audit team’s culture — not an add-on project that will inevitably fizzle out. “People without business acumen become extinct in today’s environment on a regular basis,” Raytheon’s Harrington says. “Those who don’t go extinct refuse to accept the status quo on their supposed limitations and make positive change happen.”