Recent surveys show a continuing gap between what executive management and board members expect, and what internal audit delivers. Audit professionals insist they want to close that gap. So, why isn't it happening?
People are not comfortable with change, often hiding their resistance under a veneer of excuses. If it weren't for one reason or another, they say, they could change. Internal audit is no different. Several excuses, from specific to more general, are evidence of a department that may not be willing to accept the risk of — and need for — change.
It takes too long to issue audit reports with corrective action. Sorry, no matter what you think, the audit is not complete until the client agrees on corrective action. You can say you issued the report, you can say you hit your milestones, and you can say the department is successful because departmental metrics are being met — but until agreement is reached with the client, nothing has happened. Find out why you have trouble establishing that agreement, find the root cause of the problem, and then solve it. Be an auditor.
We report to the audit committee; we don't need to report administratively to the CEO. Reasons for this one abound. For example, the CEO doesn't have time, internal audit has a better relationship with a different member of the C-suite, or the current relationship has no impact on the department's effectiveness. Unfortunately, without direct communication with the CEO, internal audit does not have access to the strategic information necessary to accomplish its objectives, is not considered an equal with others in executive management, and is fooling itself if it thinks it can become a trusted advisor.
We don't have time for [blank]. Fill in the blank with just about anything. We don't have time for training, for nonfinancial audits, for special requests, for anything out of the ordinary. To prove there is always time for something important, try reducing your audit schedule by one audit — just one audit. First, you may notice no one really misses it. More importantly, notice you now have time to accomplish that project you didn't have time for.
You don't understand, we just can't do that. Try explaining what it is we don't understand. In the process, you will realize that you are just making excuses. You can, indeed, do it. You just have to get past the fears — fear of your superiors, fear of lost security, and the fear of trying something new.
The primary impediment to progress is resistance to change. And internal auditors must recognize that their excuses are nothing more than a subterfuge that allows change avoidance. Just as internal audit refuses to accept clients' excuses, it must recognize and eliminate the excuses that keep the department from moving forward.
What excuses are you making that keep you from effecting real change?