Internal Auditor’s blogs reflect the personal views and opinions of the authors. These views may differ from policies and official statements of The Institute of Internal Auditors and its committees and from opinions endorsed by the bloggers’ employers or the editors of Internal Auditor.

Don't Just Do the Work - Sell It​

Comments Views

A consultant walks into a bar … I mean, board room. That consultant begins his sales pitch. “Let me tell you what I got here. I have the magic elixir that will solve all your control problems, all your financial problems, all your compliance problems. Just one swallow of Magic Consultant Elixir and your board can sleep easy, your customers die happy, and your employees never again worry about the regulators busting in to shut down the place. And all for less than you currently pay for that old, tired, useless, costly remedy that you call your internal audit shop.”

Well, that’s not exactly the way it happened. But, as an internal auditor working in the 1990s, it sure felt like there was a lot of snake oil salesmanship going on when internal audit shops increasingly began to find themselves outsourced.

So far, I’ve provided a quick context for this whole discussion, then talked about the push for outsourcing that was occurring, as well as one of the ways many boards responded. That specific response was exactly what every internal auditor hoped their board would say to the consultants. “Thanks, but no thanks.”

But it didn’t always go that way. There were two other ways boards responded, neither of which boded well for the individual audit departments or the profession as a whole.

The second reaction came about because, in spite of having an internal audit shop that did much more than what was considered “typical” auditing, the board did not recognize this was occurring. They saw an opportunity to save money and did not see how much extra they were getting from their internal audit shop. Those internal audit shops were outsourced.

(In case there is any doubt in your mind, “outsourced” is the phrase that was used, which basically meant that a lot of internal auditors suddenly found themselves searching for new jobs or careers.)

You cannot blame those selling the outsourcing service; they wanted to work just like anyone else, and they had found a way to help ensure continued employment. And you cannot blame the boards; there was only so much they were willing to pay for the services they thought they were receiving.

No matter how victimized those audit shops felt, the fault, dear Brutus, was not in their stars. No, the fault was with the audit departments themselves.

These internal audit departments were doing good work. They were building relationships, they were providing consulting services, and they were providing extra value. But internal audit’s stakeholders did not understand the full value the department was providing. All because the internal audit department assumed this extra value was understood by the organization at large and did not take the extra effort to ensure that such work was effectively promoted.

So, with no reason to think anything different — anything of extra value — was coming from the internal audit department, the boards found it to be a very easy decision to just find someone to do the mundane part of the job (the only part many of the customers saw as occurring) for less money.

Remember in the last post when I mentioned the value proposition? Well, here it is raising its ugly head. These internal audit shops provided a value beyond what was expected, but they had never identified that value, they had never sold that value, and they had never let anyone know that value was being delivered.

Auditing is a marketing department. And if you aren’t selling what you do, someone else will come in and do it for you. (Much to the detriment of your department, as those shops in the 1990s learned.)

Now, in many cases where these outsourced internal audit departments were doing more than most knew, a very interesting thing happened. Much like in “Big Yellow Taxi”, the board realized “Don’t it always seem to go that you don’t know what you got ‘til it’s gone.” (Joni Mitchell; look it up.) The outsourcers came in and provided a service — the service the board thought it wanted and thought it had been getting in the past. But, over time, the board realized something was missing. Sure, the basic internal audit stuff (compliance, financial, basic controls, etc.) was getting done. But somehow the added value was gone.

I have a feeling that most of those boards couldn’t really identify what was wrong. (No one told them the value proposition, so they couldn’t articulate what was missing). But those boards knew they had lost something. And, funny thing, many of those outsourced audit shops found themselves being asked to come back. Internal audit took a hit, and, in some instances, came back stronger because the board had learned about the value that internal audit may not have recognized itself.

Now, I could go on for quite a while about this whole marketing auditing and value proposition stuff, but it’s a conversation I’ve had before. (You could start by checking out my August 2015 article in Internal Auditor magazine, “5 Steps to Marketing Your Audit Department.”) In addition, none of that is really the main point I want to make here. No, the only reason I’m discussing these first two board reactions is to lay the groundwork for the third (and most detrimental) reaction.

In addition, I want to talk about an event that quickly followed, one that, while at the time may have seemed like a quick and easy solution for internal audit, may have done us more harm than good.

This time, your homework has a nastier edge to it. If you can articulate the value you provide, how much of that value is tied to things like compliance, regulations, and basic control verification? In other words, is that value truly different? The answer to that question may help you understand if your board’s reaction would fall under our last blog post, this current blog post, or the much less friendly reaction we’ll be talking about next.

Internal Auditor is pleased to provide you an opportunity to share your thoughts about these blog posts. Some comments may be reprinted elsewhere, online or offline.



Comment on this blog post

comments powered by Disqus
  • Idea-September-2020-Blog-1
  • Galvanize-September-2020-Blog-2
  • CIA-September-2020-Blog-3