When a former Secretary of State speaks, it makes sense to listen. They don't give these jobs to just any Tom, Dick, and Henry. And so, with Madeleine Albright the first speaker at this year's conference, I decided I might want to pay close attention.
It was an interesting and entertaining session as she provided the history that led her to such an august position and proceeded to outline the challenges she faced in the past and the challenges the world faces today and into the future. This was followed by a Q&A that gave even further insight into what it meant to be Secretary of State and what it means to be Madeleine Albright.
The overall presentation was fascinating and compelling. But some of the sound bites were every bit as revealing as the overall presentation. And, while not always couched in such terms, they provided insight related to the work all internal auditors do. Following are some of the ones I noted.
"It is easier to demand change than to implement it."
I think most people would agree that the minute an audit department waves the audit charter around insisting that the auditee listen and take action, the war is genuinely lost. But, without actually resorting to the charter, many departments still seem to think that what they say is the law of the land. Oh, we don't put it that way, and many of us would be shocked – simply shocked – at such a suggestion. And yet, how often do we believe that, because it is in the report, then it must be so.
In other words, without realizing it, we are demanding change. This is yet another reminder that we must often sell our findings to the various customers. But, maybe more importantly, it is a reminder that, just because we think a change should be made, it does not mean the change can be accomplished as simply as putting pen to paper.
We used to have a CEO that insisted that, if a finding was important enough to be reported, it was important enough to be corrected within one month. Nice idea, but it was hard to implement changes in such short order. It really made internal audit more cognizant of what we were reporting.
Whether we explicitly demand change (corrective actions) or imply it in the way we write, we must always take into consideration the effort that is necessary to get that problem corrected.
"Compromise entails risk."
We spend a lot of time talking about risk – financial risk, reputation risk, regulatory risk, etc. risk. But I have never heard the concept of compromise risk. Okay, maybe it doesn't belong in the pantheon of organizational risks, but it is an important consideration in looking at how an organization operates. Compromises might be needed to move forward. Compromises might be needed to determine how success is achieved. Compromises might be needed while determining where an organization wants to go. But there is compromise in almost every decision, and understanding those compromises helps ensure the proper decisions have been made.
And auditing must remember the comprise risk associated with all it does. To achieve our overall purposes, we may have to make compromises. And that means recognizing the associated risks. And remember that, as the organization comes to agreement with the work we do, they may require compromising, also – on both sides. If we properly understand and evaluate that risk, then we will have a better understanding of the value (if any) we are providing.
Ultimately, for the audit department or the organization as a whole, this means understanding what is being given up. Compromise means losing something. That lose may well be necessary – balancing it against what might be gained. But evaluating compromise risk is important toward ensuring any compromise is worthwhile.
"[Internal Audit's role is to] Tell the truth, the whole truth, and nothing but the truth – which makes it important and unpopular."
In this case, Ms. Albright was actually talking about internal audit. There are two interesting points in this one. The first is that I don't think I've heard our mission stated in such a way. Yes, we have all heard the oath, but never in an audit context. I think it provides us a really good challenge – truth, whole truth, nothing but the truth. And, truth be told, I wonder how well each of us (in our personal and professional lives) does in living up to these exacting standards. Nice challenge.
But the second point may be more interesting. Here is someone taking an outside look at internal audit. She is looking at this from the aspect of governmental agencies (with her prior position) and within private industry (with her current endeavors). We like to hear when someone from the outside calls us important. (Again, good to hear someone of Ms. Albright's stature say so.) But we are never happy to hear we are unpopular. Now, I can spend a lot of time arguing how, done right, our popularity can climb. But at its heart, the statement is (as much as we don't want to admit it) probably true. At various times, in various situations, we are not popular. But we must learn to accept those situations. The bearer of bad news cannot expect to be popular all the time. And if we are not, at least in some situations, bearing bad news, then we are not doing our job. (And we will no longer be important.)
"I'm an optimist who worries a lot."
I'd like to think this could be written across the doorway of every audit department. We should be optimists. We are helping our organizations. We are contributing to success. We have and add value. Optimistically we face every day knowing that our work will make a difference.
But we must always worry...a lot. Are we finding the right risks? Have we identified the important issues? Do our customers understand the role we are playing? Is our acceptance within the organization continuing to grow? That is just the start of a very long list.
It is the worries that keep us on our toes, focusing on the important work that must be accomplished. It is the optimism that keeps us waking up each day to do that important work
And, with that in mind, I am optimistic my attendance at the conference tomorrow will continue to provide me insights, new ideas, and the chance to continue valuable networking.
And, I worry the morning's alarm will not go off.