Each path to the chief audit executive’s (CAE’s) office is unique — like a fingerprint or a snowflake. Each starts at a precise point on the experience spectrum, and each has a specific career endpoint in mind — although those are subject to change beyond any individual CAE’s control. They also incorporate topical specifics that can vary widely; some CAEs started as staff auditors or go through rotational audit programs, while some were in finance or accounting earlier in their careers. Too, each journey takes place in a unique setting, perhaps a one-person department at a small company or as head of a massive internal audit function spanning multiple corporate entities worldwide. Though each journey can be quite different, they all exhibit elements of commonality.
Every great CAE, for example, is — or learns to be — a great communicator. The essence of internal audit is understanding stakeholder needs, and then helping them understand the implications of the results reported back to them. Flexibility and adaptability are essential, as well. Internal audit is changing, and corporate expectations of it are continually increasing. CAEs, in short, have to be quick on their feet and able to keep moving forward when executing internal audit’s mission, even as the terms and conditions that govern its day-to-day operations shift. That means great CAEs tend to their professional flocks, too. Building a team, keeping the best of the best, and — when appropriate to their career development — strategically deploying internal audit employees with specialized skills throughout the enterprise, are all critical components of a great CAE’s approach to the position.
Because of its consultative nature, internal audit is, foundationally, all about communication. CAEs must communicate well with their teams or nothing gets done; if they can’t communicate with business units, no audit exists; and if they can’t communicate with stakeholders, what was the point of the audit if results remain unused facts and figures, more like raw data than useful information the enterprise can use to chart a forward course?
“Communication is key,” says Christy Wood, chief internal auditor at Denver-based energy firm QEP Resources. “Although it’s important that I share information with my team, and that I understand project status and any concerns,” she adds, “it’s also important that I get to know the people I work with.” Avenues of communication at her shop include weekly management meetings, monthly staff meetings, and regular one-on-one meetings. “Some folks are comfortable stopping by on their own,” she explains, “but others need the formally scheduled meetings.”
It’s important to do that efficiently, especially in a large organization; you may need to learn to manage by exception, using the right measures and triggers for escalation; otherwise, a CAE can get bogged down in daily minutiae and lose sight of the bigger picture.
“Dealing with the exceptions promptly is critical to keeping the team from spinning its wheels,” too, says Kevin McCabe, recently retired CAE at Wells Fargo. Knowing what merits CAE intervention is just the first step; the successful CAE also knows the importance of intervening efficiently. McCabe recommends regular meetings with senior business heads and operations staff to make sure the audit team is focused on the right issues.
Of course, the best-intended communications fail fully if the listener won’t listen. Sometimes, disputes come down to the CAE’s opinion, McCabe notes, and “that’s where you have to have trust.” He was a consensus manager, he explains, and at times, when he was close to making a decision, he’d stop to “check for a land mine.” In those collaborative cases, he recommends stating your position clearly and letting people know whether you’re brainstorming or ready to make a decision and just want to know the landscape. “Otherwise, people approach every instance as a discussion,” McCabe says. “I found I had to consciously declare where I was.”
A successful CAE doesn’t go it alone; team building, management, and, often, an open-door policy can be key elements of a successful journey to greatness. For example, the volume of data most internal audit departments are deluged with can be overwhelming, but an effective CAE still needs to know the details. “It’s critical that you have team members who can turn data into information,” McCabe says. They should test enough to ensure they’re accurate and adequately insightful, for one thing, he adds.
Members of the team also should feel they have your ear, emphasizes David Curé, vice president and chief auditor at WellCare Health Plans Inc. in Tampa, Fla. “I make an effort to get to know my employees,” he says. “A personal connection helps both sides work better together.” He also makes a point to talk to staff about what’s working well — and what changes could be made to improve the work environment or processes. “It would be foolish of me to think my ideas are always the best,” he adds. “I have an immense amount of talent on my team, and my job is to pull the best ideas from each of them to make our entire department great. A CAE cannot be effective if he or she stays locked in the office all day.”
Greg Pellicano, vice president, Global Compliance Monitoring & Investigations, at Wayne, Pa.-based Shire, a biopharmaceutical company, emphasizes approachability, as well — by all team members, regardless of level. And team-building conversations can include work and nonwork subjects, he adds. “Also, because we have a small shop, I give all individuals the opportunity to work with me on various assignments,” he says. “This allows me to connect more directly with the team and help them better understand my philosophy and approach.”
Sometimes, notes John Carroll, vice president, Corporate Audit and Assurance Services, at Merck in Whitehouse Station, N.J., being a great team builder and leader means knowing when to let go. “I am a key supporter of developing people in a way that puts them out into the organization,” he says. “If we find the right people, they provide the support I need to carry out the work here and then bring that knowledge back into the company at large.”
Common Attributes of a Great CAE
- Excellent communication skills that include communicating the staff’s role in achieving internal audit’s vision, the ability to communicate with the audit committee and management, and an awareness of how audit findings should be written.
- The ability to see the entire organization and the associated existing and emerging risks.
- A strong understanding of the business environment.
- Recruiting, developing, and retaining talent and moving employees into other areas of the organization to help them understand their part in the organization’s success.
- Strong technical knowledge and capabilities from a subject matter expertise perspective.
- Ability to lead and drive an organization, not just the audit function.
- Ability to influence company leadership as well as the audit committee.
- Analytical thinking.
- A passion for internal audit.
- A continuous learning mind-set.
- Concern for others.
- Recognizing and thanking staff for their efforts, especially what’s “above and beyond.”
- A healthy and productive skepticism.
- Willingness to work long hours.
- Ability to remain objective at all times.
- Courage to report significant issues and risks to the audit committee.
- A sense of crisis.
Another characteristic of a great CAE is an understanding of the overall risk environment at the company. “Success is helping guide the business — and business leaders — to be one step ahead of the risk,” says Kathleen St. Louis, vice president, finance, and general auditor, at Eli Lilly and Co. in Indianapolis. “Internal audit, she adds, “is about looking in the past and focusing on individual transactions, but also helping the business understand where the emerging risks are, either in our industry or in general, like cybersecurity. It’s about helping the business understand and think about business decisions from a risk and control standpoint.”
An example particular to her industry is clinical trials. “Doing a clinical trial in-house, where it’s Lilly employees from top to bottom, is one risk profile,” she explains, “versus hiring an outside company to manage that on our behalf.” Pellicano agrees. While metrics are important, he says a CAE’s success is primarily determined by the value his or her team brings to the organization — including the audit committee. “How each organization defines or determines value can be different,” he adds, “but it is clearly linked to core assurance responsibilities and providing proactive advice and counsel on risk, mitigation activities, and process improvement opportunities.”
Successful CAEs also accept assistance from their audit committees. Martin Coyne, compensation committee chair and audit committee member at Akamai Technologies, an Internet content delivery company based in Cambridge, Mass., says his peers should support CAE greatness by demanding a lot from internal audit. “We can support CAEs by setting very high expectations,” he says. “Those expectations must be very clear, as well. And we can demand internal audit independence.” Audit committees should provide feedback after each meeting, he adds, and they should do so at the highest levels — usually through the chair. That’s a good way to “continuously improve the interaction between the audit committee and the CAE,” he adds. Importantly, he stresses that audit committees should demonstrate visible support for the internal audit function, not just in words, but in budgets, too. “We should communicate that to management, the chief financial officer, and the CEO, so there’s absolute clarity that the audit committee believes in and supports the function,” he says.
The view of CAE success from the audit committee is focused on three best practices, Coyne continues. One is “when internal audit creates an annual audit plan and reports back on a management dashboard to track remediation,” he says. “There always are outstanding action items. If there’s a dashboard for tracking progress, that helps.” He also suggests internal, one-on-one meetings between the CAE and the audit committee to make sure the CAE is not inhibited by management in comments to the committee — and so its members can hear about problems firsthand. Coyne adds that audit committees want CAEs to work well with external auditors. “The relationship is absolutely critical,” he says. “There’s got to be trust, as well as complementary testing of controls.”
Great CAEs have a seat at the table, and they use that access to make their voices heard — and to use their voices to educate their stakeholders. “I don’t think a CAE’s success should be determined by the number of engagements or by staff reviews,” says Arturo Reyes Figueroa at Grupo Aeroportuario del Pacífico SAB de CV, in Guadalajara, Mexico. A better benchmark is the CAE’s involvement on a corporate-level steering committee, working with other senior executives. Indeed, Carroll emphasizes, “it’s important to remain visible in the organization and close to all critical parties — and identify who the appropriate parties are to make sure your message is getting out.”
That message is important, Pellicano agrees. “Do not let complacency set in, no matter how rock solid your shop is,” he says. “Be a salesperson as well as an internal auditor.”
The Right Mix
What else is important to CAE greatness? A cornucopia of traits, skills, and activities, according to successful CAEs. One, McCabe says, is technical knowledge. “Companies often want to use the CAE role as a development tool,” he explains. “But nothing ruins a strong internal audit department like a business manager who does not really understand internal audit’s role.” He also recommends a clear vision for the department. “If the CAE does not know what he or she wants the department to be, who will?” he asks. As well, he advises a willingness to work late and, importantly, to focus on recognizing and thanking staff for their efforts, especially, as he puts it, “the going above and beyond efforts.” St. Louis emphasizes the importance of being able to lead and drive the organization, and not just the audit function. “You need to influence the leadership of a company as well as the audit committee itself,” she says. And Figueroa advises having “a sense of crisis.”
Wood cites a passion for internal audit and a continuous learning mind-set, as well as persistence and concern for others, and Curé emphasizes remaining objective at all times. Curé says, “Honesty and integrity are so critical and ingrained in us as internal auditors that I would classify them as core requirements. It would be impossible to be an effective CAE if you were perceived as being dishonest or not having integrity.” Great CAEs also need to have the courage to report all significant issues and risks to the audit committee, he says. Pellicano stresses the ability to proactively deliver business advice and counsel to improve both business operations and the control environment as a critical aspect of greatness, while Carroll emphasizes adaptability and innovation. “I will never be a checklist auditor,” he says. “My teams are trained to be adaptable to whatever environment they see.” Coyne notes the value, important to any investigator, of a “healthy and productive skepticism.”
A practitioner’s definition of success — of being a great CAE — includes the quality of the work he or she does; the correctness, thoroughness, and relevance of the reports he or she produces; and the supporting documents he or she creates. And it likely incorporates a focus on understanding and effectively communicating to the appropriate stakeholders the business risks the enterprise faces and the credible alternatives that exist to manage them. And it almost certainly touches on the CAE’s team, including the quality of the internal audit staff recruited and retained.
But the precise mix — a CAE’s personal approach to being the best he or she can be — won’t mirror anyone else’s. What determines success is what lies between the starting point and the desired endpoint. And that journey is different and personal for each CAE.