Imagine you have just spent months working on an important audit. You have thoroughly documented your work, developed thought-provoking findings, and handed the department a number of solid recommendations. You congratulate the team on a job well done and move on to the next assignment. Six to 12 months later, you follow up with the department to find that only the simplest of your recommendations have begun to be implemented. The rest are subsequently added to your open audit recommendation log. Thus begins the months-long battle of outstanding audit recommendations.
Most, if not all, of us have been here before or will experience this at some point in our career: complete frustration that months of good work results in little actual change. Can we meet our mission of enhancing and protecting organizational value if recommendations are not being implemented? More importantly, are we taking the time to understand the root cause of the lack of implementation?
Recommendations are about change and change is hard. Countless resources on change management exist and many of them state that about three out of four change initiatives fail. Based on my own research and experience, I offer the diagram below to summarize why change initiatives, including audit recommendations, most often fail.
On the diagram, the x-axis,
Organizational Commitment to Change, refers to the overall attitude in your organization toward making changes. In other words, change either energizes your organization and people jump on board the train (High), or change stresses your organization and everyone takes a step back to avoid the train as it rolls by (Low). The y-axis,
Individual Commitment to Change, refers to whether or not the individual responsible for actual execution of the change is on board and committed.
As you can imagine, it's possible to have an organization that embraces change, but also have individuals who just don't have the wherewithal to get the change rolling. I call these
lofty goals — they sound good, the organization is behind them, but no one is stepping up to drive the train.
The reverse of that I call
occasional heroic achievements. Those are the situations where an individual, through the sheer force of willpower, is sometimes able to push a change forward despite limited or no organizational interest. This, of course, takes a tremendous amount of effort and rarely leads to full implementation.
When you have neither individual nor organizational commitment, I refer to this as call a plumber, because your audit recommendations have already gone down the drain and the only way you're getting them out is with a plumber.
The final quadrant, the
tide may turn, is where change can begin. Note, however, that just because change may happen, it is not a done deal. There are still three areas that must be addressed affirmatively for change to be truly successful:
- Alignment: Is the change (recommendation) aligned to the broader strategy?
- Resources: Are there skilled resources available to implement and maintain the change?
- Capability: Are existing systems capable of supporting the change?
All of this explains why change is so hard and why internal auditors need to spend sufficient time considering how we can incorporate change management techniques into our processes to increase the likelihood of recommendations being implemented. Here are five tips to turn the tide:
Understand and demonstrate how your audit recommendations support the big picture. Given that organizations often have multiple priorities, where do your recommendations fit, and can you demonstrate how your recommendations support the achievement of key objectives? If you are just adding more to management's plate without giving them a sense of how your recommendations will make things better for them, you are fighting a losing battle from the start.
Fine tune your approach with an understanding of your organization's attitude toward change. Who are the key influencers and who are the key resistors? Have you developed plans for leveraging key influencers and minimizing the impact of key resistors? With that, have you done a root cause analysis of why past audit recommendations have failed to be implemented and learned from those mistakes?
Identify agents of change. Have you built a strong relationship with management either before or during the course of your audit? Have you identified who will be responsible for implementing your recommendations? Has that person embraced your recommendations or are they resistant? Does he or she possess the necessary skills, competencies, and influence to make the change that is necessary?
Recognize what resources are required to support your recommendation. Do your recommendations account for available resources and acknowledge whether the skills and competencies to execute your recommendations are available?
Evaluate related systems. Have you assessed supporting systems? Are they capable of supporting the changes you are recommending? Depending on the scope of changes, have you included a cost/benefit analysis? Finally, does your IT department have the capacity to support whatever changes need to be made?
Internal audit's job is not just to release audit reports and recommendations but to effect positive change that helps the organization achieve its goals and be successful while protecting organizational value. If you are sitting on a long list of open recommendations, are you truly having that positive impact?
That's my point of view, I'd be happy to hear yours. For more thoughts on dealing with open audit recommendations, check out
"When Recommendations Go Unaddressed" in the December issue of
Internal Auditor magazine.