Let’s suppose you have a lawn service take care of your
lawn. (An easy assumption for me because my wife learned quite a long time ago
that, if she wanted a neatly manicured lawn, she better hire someone to do it.)
Once a week they mow, they water, they trim, and they make everything look
nice. Now imagine that someone else shows up who promises (and provides
evidence) that they can supply the same service, but at a significantly cheaper
Do not lie. Unless that lawn service is provided by your
brother-in-law (and you want to stay married; note that both conditions must
exist for this premise to hold), then you will switch providers faster than you
can say “Who do I make the check out to?”
And that, in an allegorical nutshell, is what happened to
many internal audit shops in the 1990s. They were happy mowing the organization’s
lawn. Then a cheaper lawn service (one with lots of experience, credibility,
and global reach) came in and pushed them out of their jobs.
In my previous posts, I’ve talked (here and here) about two
of the responses boards had when approached by these consultants — the
responses that actually turned out okay for internal audit. But let’s now talk
about the response that didn’t bode quite as well. And we’ll talk about the
important point those shops had missed, as well as lay a little groundwork for
a later discussion about problems all internal audit shops could be facing
today. (See, I’m eventually bringing it all back to that very first post.)
The third response chosen by a significant number of boards
started out much like the second. The board looked at the services it thought
it was receiving from internal audit, it looked at the proposal from those who
would outsource the service, it saw a savings (no matter what you tell
yourself, folks, it is always about the Benjamins), and it signed on the dotted
And a wave of internal auditors found themselves looking for
new organizations or careers.
The reason this response went so differently than the second
— the reason the boards in these situations did not eventually call the internal
auditors back into the fold — relates to the point these particular audit shops
were missing. In these cases, the internal audit shops weren’t really doing something
no one else could do. They weren’t providing a value that no one else could
provide. These departments were just trimming the lawn. And so, these internal
audit departments remained outsourced.
Now, don’t get mad at the boards. They made a good and
fiscally responsible decision. They got the same service they had been
receiving (maybe just a little bit more) at a much lower cost.
No, there was absolutely no one to blame but the internal
audit shops that were outsourced. These audit shops had never changed, never
recognized the need to provide more, and never saw themselves as anything more
than a controls/compliance/finance function.
They never saw a bigger picture of what an effective
internal audit shop could be.
And an interesting thing (in a very bad way) is how many of
those internal auditors never, even after the cataclysm, recognized that they
had done anything wrong. They did the basics believing that was all any audit
shop should do. And they saw no reason to change. (Side but related note: For a
good time, ask someone about the battle to get the word “consulting” added to
the definition of internal audit. The fact that there was even a fight about it
shows how many professional internal auditors were not understanding the
evolving and more effective role for internal audit.)
There are still a lot of those auditors out there — still employed
by organizations as internal auditors. I’ve met them. I’ve had the opportunity
to provide training to some of them. They are scary.
So, you may well ask, if the work being done by those internal
auditors can be done more cheaply — if they can be outsourced in a minute — why
do they still exist?
Well, not every board wants change, even if it is the fiscally
responsible thing to do. In addition, there are only so many consultants, so
their board may have never been approached. With no impetus to change (in this
instance, impetus meaning standing in line at the unemployment office), that
type of auditor didn’t change.
However, there is an additional, important reason these
auditors still proliferate. And it has to do with an event I alluded to in an
earlier post — an event that seemed to be internal audit’s salvation, but may
be a current source of significant harm. We’ll talk about that piece of history
Until then, a relatively easy homework
assignment. Can you figure out what blessed/cursed event happened?