As culture has become a strategic focus for organizations in recent years, internal auditors have looked to support this strategic objective and the risks associated with it. Among the many implications of 2020 on organizational culture, there is an opportunity to shift the narrative relative to diversity, equity, and inclusion (DE&I). The past year has created a dramatic wave of momentum following several high-profile, racially charged events. In its wake, company after company made public statements decrying racism, calling for action, and committing to DE&I in their organizations.
There is great value in a highly diverse, inclusive workforce guided by equitable standards that reinforce and celebrate differences and unique capabilities throughout the organization. It can build, strengthen, and solidify the culture that has become a seminal strategic catalyst to achieving corporate objectives. So does that make the events and behaviors during 2020 a threat to an organization’s culture, if not taken seriously? Or, is there an opportunity for organizations that embrace these actions and make changes to lay a foundation for sustainable DE&I in the future?
The answers to both of those questions is “yes.” To further that point, internal audit and its leaders have an obligation to be part of the change in three areas.
1. Ensure DE&I Is an Organizational Focus
Ensuring the organization is effectively managing behaviors and practices to achieve strategic objectives and mitigate risks is a core tenant of internal audit’s role, but it can be challenging. Many auditors have heard a chief audit executive (CAE) note that a risk such as culture that is challenging to address is “critical for the company and a key risk management must focus on, but it isn’t really auditable.”
Internal auditors should stop overthinking how culture must be audited and recognize their role in ensuring the organization’s actions are operating effectively to accomplish the strategic objective. To ensure the organization’s culture is founded on DE&I, auditors should:
- Actively use forums of executive dialogue, such as CAE meetings with executives or risk assessment sessions, to broach the topic of DE&I and the opportunities and risks associated with related practices.
- Collaborate with the organization’s enterprise risk management personnel to ensure dialogue around culture risk has enough “teeth” to drive action toward tangible mitigating practices and pervasive DE&I change.
- Conduct a brainstorming session with internal audit staff to assess observations within the organization that can support future DE&I practice considerations or risk mitigation. Internal audit can use its depth of knowledge and integration in the organization to facilitate productive discussions.
- Put DE&I in the audit plan. It can be an audit, risk assessment, maturity assessment, or consultation. Auditors should find the right fit for the organization, but put some time intentionally and formally toward it.
- Talk to the audit committee about it. Committee members are hearing about DE&I, thinking about it, and actively engaged with other companies dealing with it, so they likely have thoughts on how DE&I should be considered at the organization. Internal audit should actively build this into the one-on-one sessions with the audit committee chair or consider this a perfect topic for executive session dialogue.
2. Champion Key DE&I Initiatives
Internal audit draws its influence from being an independent, objective function that is appropriately positioned in the organization and reports directly to the audit committee. That structure is necessary because internal audit will inevitably face contentious, challenging issues such as DE&I that could drive or derail the success of the organization.
It is for that reason that DE&I should be in the audit plan. For example, in 2018, a previous employer established a prominent role in the company to head DE&I efforts. The CEO made it clear that being a diverse, equitable, and inclusive company was critical to its future success. Internal audit could not stand by passively and just hope this all came to fruition, so it put an assessment in the plan.
At the time, I was candid with the CEO, noting that internal audit’s goal was not to audit DE&I, because the position was just being filled. Instead, our goal was to monitor plans and progress as well as consult on formal practices and processes the organization could put in place to support that new leadership role. Internal audit built a deep connection with the new head of DE&I to the extent that he would carry a memo internal audit had drafted demonstrating a call for action and supporting key DE&I initiatives and efforts.
For the next year, the new DE&I champion faced challenges garnering resources and marshaling support. Internal audit helped keep DE&I on the front burner, maintain it in the company discourse, and facilitate dialogue. Moreover, it helped the DE&I champion navigate some of the political and social headwinds he encountered.
3. Be a DE&I Leader
In laying out how behaviors, processes, controls, etc. should function, auditors also must adhere to these expectations. Internal audit’s own hiring practices, staffing approaches — who works together on various engagements — and development programs must practice what the function preaches. This extends to how auditors treat others in the organization, too. Auditors should be sensitive, empathetic, compassionate, and focused on collaboration.
For many organizations, 2020 brought about candid discussions with employees on race. My previous employer made some of its first public statements on social issues, then followed up by forming strong, leadership-supported teams to recommend DE&I actions. Internal audit was involved, including one passionate individual who became one of the leaders of these efforts.
DE&I isn’t simply about racial issues, either. Internal audit leaders should focus on how they lead their people, confront implicit biases, ensure they are not getting in the way of how they lead the team, and challenge those same tendencies in the organization.
For example, many women are facing challenges as the pandemic has shifted the work to home, specifically the implicit biases regarding mothers needing to take primary responsibility for caring for children. Additionally, more organizations have increased the number of women in leadership roles. However, the attributes expected of women with leadership aspirations often are to lead with traditional “male attributes” such as assertiveness, demonstration of confidence, and display of a command of the issues. This can be a fantastic opportunity for internal audit to discuss the variety of ways in which people can lead and confront the biases that often stand in the way of DE&I success.
DE&I Is Key for Success
None of these three actions is easy, but they are necessary because DE&I can either be a threat or an opportunity for the organization. Either way, it is going to affect the organization’s culture and long-term success. Internal audit must actively play a role in supporting the achievement of those objectives.