I'm going to start with an apology. I'm about to use a sports analogy, and I'm tired of sports analogies. And I'm guessing many of you are, too. They are used under the supposition that they refer to things that are universal. But it ain't so, Joe. The world is not comprised solely of sports fans, let alone ones who have even a passing knowledge of the most basic rules of most games.
A quick aside as example. We had some visitors from our European operations and we took them to a baseball game. The gentleman from Italy was tabula rosa when it came to the sport. I described the rules as best I could, including that the inning would end after three outs. Unfortunately, the home team was not playing well. In short order, the score was 4-0 and the inning continued. The gentleman turned to me and asked one of the most logical questions about baseball I've ever heard. "How many safes do they get?"
How is a sports analogy supposed to resonate with that individual, let alone the millions of others who may have a passing knowledge of a sport, but just don't quite get what the analogy is all about?
But I'm going to give it a shot because I heard something interesting on sports talk radio this morning. (I'm a fan; I listen to their inconsequential rantings and ravings; we all have our peccadillos.) The hosts were in deep discussion about our local professional basketball team, the Phoenix Suns, who tonight (as I type this) have the chance to eliminate the Los Angeles Lakers in game six of the first round of the playoffs.
(Because of the timing between my initial drafts and when this winds up out in the real world, everything except this paragraph was written before that game 6. Good news for us Suns fans, they won. And I'd like to feel sorry for the Lakers fans but, well, it ain't gonna happen. And that I believe.)
Don't know exactly what all that means? Don't worry, it just means it is a big deal for the team and the fans.
One host, a former professional football player (so he knows of what he speaks), began talking about the mental mindset a team needs to succeed. And then he talked about belief and doubt.
In sports, the slightest incident/occurrence/action/result can swing momentum — a perfect shot, an impossible save, a diving catch, a perfect pitch. The host went into depth about how a player's belief in his or her abilities leads to success and a positive shift in momentum. But, he went on, the minute doubt creeps in, that doubt can become reality. You cannot make a shot, make a save, make a catch, or make a pitch without belief in your ability to do it.
And, of course, success breeds success. And belief breeds belief. And failure breeds failure. And doubt breeds doubt.
Excuse me if I repeat a thesis from many previous blog posts, but a trait I see lurking within too many internal auditors is an insecurity in their ability to accomplish their work. I don't know exactly where this comes from. But what it leads to is that internal auditors seem to have a fear of confrontation.
I know at this point you are proclaiming, "Nay, nay, not me." And good for you. But in spite of these numerous protestations, there is a significant portion — I'd venture to say a majority — who still step back when things get rough, all in the name of "getting along."
I think there are two primary reasons for this fear — no, let's be nicer than that, let's call it avoidance — this avoidance of confrontation. The first is that we are seldom experts in the field that we are reviewing. We may have a working knowledge, but we will be talking to people who know it in depth. And we are afraid of showing our ignorance, thinking it undermines the authority we are trying to maintain. We are fearful of taking a stand — fearful of the landmine of mistakes that might lay in our path.
The second reason for avoidance is that, no matter how much sturm and drang we bring to our results, we have absolutely no authority. Yeah, there may be a charter and an audit committee, but, ultimately, we cannot force anyone to do anything. And so, because that haunts our psyche and our confidence, we are afraid to push things too far — we avoid that potential confrontation.
Of course, there are solutions to each of these. When it comes to expertise, we have to go in explaining we don't know the process as well as they do. But we follow that up with the explanation that we are bringing the expertise of process analysis, risk assessment, and controls. And what we want to do is bring our expertise together with theirs to make things better.
And when it comes to having no authority, well, that means building rapport and the client's confidence in the department to the extent that, when it comes to the confrontations, our power is in the relationships that have been built, not the power of a title, a charter, or a board. Yeah, occasionally it may wind up with a trip to the principal's office … sorry, I mean the audit committee. But those should be few and far between
But here's the bigger thing. And it comes back to that sports analogy. We have to believe in ourselves, and we have to believe in our team. You see, everything I listed above — and quite a few others I didn't delve into — are caused by doubt. I don't know the business, I don't know the customer, I don't know how to ensure this gets done, I don't know if they will believe me, and so on.
But the power to make change starts by our belief in our skills, knowledge, and expertise. And we need to reinforce that often. I'm not saying you start holding weekly internal audit rallies where everyone yells and cheers and pats each other's backs as they talk about how great they are. (Then again, maybe there is a role for that sometimes.) But how about taking the opportunity to make sure the department knows about its successes; about things done well; about how skills, knowledge, and expertise made the department better? And how about making sure that every individual internal auditor knows about what they've done well — how individual skills, knowledge, and expertise made the department better?
And here's one more thing that needs to be done to ensure there is belief rather than doubt — upskilling, upknowledging, and upexpertising. Training needs to be constant, ongoing, and built on what has gone before. I can't tell you what your specific needs are, but find out. Where are the gaps? Where are the insecurities? Where are doubts creeping in? Where does belief need to be bolstered? What is keeping you from building the momentum that is the foundation for a successful department?
(And as often happens with these, I want everyone to know I am not just talking to the leaders. There is not a single thing in anything here that cannot be applied at the individual level. You know your insecurities; you know your doubts. Figure them out, and then flense them out.)
I would like to say that internal audit never really faces a game 6 elimination. Yet, there are points in every internal audit department's life cycle that will either raise the department's esteem within the organization or relegate it to pencil-pusher status. Don't focus on whether an event/review/audit/project is a make-or-break situation. Instead, maintain focus on belief. Then, when those moments come (sneaking up when you aren't looking), it won't matter. You will already have the confidence to succeed.