Audit ratings may be the most misused tool in the auditor’s tool belt. Instead of motivating management to fix problems, ratings more often serve as a demotivator, answering the question, “How bad is it?” This is the wrong question, and it erroneously imposes a “stick” mentality. While ratings may get the attention auditors are looking for, they undermine any attempt to build strong, professional relationships and fail to encourage constructive behavior. If we believe in our mission as stated in The IIA’s International Professional Practices Framework — “to enhance and protect organizational value” — then the goal of any audit is not to demonstrate just how bad things are, but to encourage positive action in support of the organization’s goals.
Many internal auditors report long lists of open audit recommendations and management’s resistance to implementing them, ranging from passive-aggressiveness (ignoring the recommendations) to outright denial that any problems exist. Auditors will say that it’s not personal, that they are just doing their job. They often think the client should be mature enough to not take being audited personally. But when you are the subject of an audit that could potentially expose your weaknesses all the way up through the C-suite to the board, it’s unavoidably personal. Add to that the audit ratings — essentially bright flashing arrows pointing out problems — and you have the makings of a difficult relationship with management. How can auditors transform this stick into a carrot? To begin, it helps to understand a few basics on motivation.
What truly motivates people has been studied for years by University of Rochester researchers Edward Deci and Richard Ryan. Their research has culminated in what they call the self-determination theory (SDT), which posits that human motivation is optimized when three basic needs are met: developing one’s skills (competency), exercising free will (autonomy), and feeling connected with others (relatedness). According to SDT, motivation through common meaningful goals will trump negative reinforcement every time. The researchers also found that while negative reinforcement can be effective, the impact is often temporary and can incentivize undesirable behavior.
Instead of rating audit findings, internal auditors should prioritize recommendations. In other words, don’t focus on what is wrong — bring attention to the most important actions required to manage risks. The chief audit executive for the County of Los Angeles, Peter Hughes, explained at the recent IIA Western Regional Conference that he uses this strategy to great effect. Brilliant in its simplicity, the approach is future focused on solutions rather than looking backward at past mistakes. Most importantly, as SDT points out, by focusing on developing common goals via prioritized recommendations, management will be far more motivated to take ownership. Instead of grading their level of incompetence, give them the opportunity to implement solutions and demonstrate their competence, autonomy, and relatedness.