Recently, I’ve been talking to anyone who will listen about the role of internal audit policies, procedures, and standards, and how they impact the success of both the profession and individual departments. Although I believe all such guidance is fundamental to audit effectiveness, I contend that the foundation for our success is really composed of three basic rules — by focusing on them, all other policies, procedures, and standards become even more effective.
The first rule comes from the Hippocratic oath: “Do no harm.” The second is taken from the Nordstrom Employee Handbook’s single instruction: “Use your good judgment in all situations.” And the third is one that I just felt needed to be added: “Do all of this with your brain somewhere nearby.” Together, these rules cover the areas of ethics, critical thinking, and common sense. I think they embody much of what internal audit strives to achieve in its strategies, in its planning, and in its day-to-day activities.
Recently, while I was discussing these concepts with a colleague, he argued that they would only work if our stakeholders followed the same principles. He seemed to be inferring that we should only treat others with the fullest of respect when we are similarly respected. I cannot disagree more.
I have a recurring conversation with my kids where I ask why he or she (I have one of each) is behaving a certain way toward the other. Generally, each one tells me that the other treats him or her in a similar fashion. I try to explain that, if either were willing to behave differently, the other might respond in kind. I am trying my best to send a message: Model the positive action that is desired, not the negative action of others.
In response, I get a look that every dad in the world knows — the “don’t be so stupid” look. (At this point I am loathe to point out that my kids are 28 and 30 years old. Sigh.)
It is not internal audit’s responsibility to model the specific behaviors of its stakeholders; it is internal audit’s responsibility to exemplify professionalism in all it does. We have to approach our work with the intent of doing no harm. We have to use good judgment, rather than follow meaningless rules and procedures, in all we do. And we have to use common sense at all times.
Internal auditors must set higher standards of behavior, rather than fall into the trap of lowering ourselves by practicing the poor behaviors of others. We have to act as professionals, no matter how unprofessionally we may be treated.
I have yet to see a situation where being a professional, even in the face of the most unprofessional behavior by the highest levels in the organization, did not work to the benefit of the department and of the organization as a whole.