Before diving right in……let’s try to figure out, why do Boards matter to Internal Auditors? What is it with the Boards that concerns Internal Auditors? Well for the answer you could obviously make a keyword search on Google and gets loads of information listed down from Acts, Rules and Regulations. But what if I say that the answer is right in the question…. you only have to reverse the order of the query to find it.
Yes, Boards matter because Internal Audit matters to the Board.
I agree that probably most of the time, the Internal Audit is in there only because of the Acts, or more appropriately the applicable requirements on an organization…. indeed, checking out a requirement, but then it starts to matter, either for its nuisance value or when something goes wrong, and the Corporate Governance people are trying to find a scapegoat. The IA profession did right to seize this ‘opportunity’, introducing the 3 Lines of Defense Model (now the 3 Lines Model) ensuring a place for the Internal Audit as the one providing independent assurance to the Governance people over the consistency of efforts of first and second lines with the expectations from them.
Then came the Directors committees and responsibilities. The US SOX Act is the single most fundamental piece of legislation that triggered either entirely new regulations or significant tweaks in the existing rules and codes around Corporate Governance. It won’t be wrong to say that Corporate Governance is now well understood because of SOX Act.
The SOX Act requires Boards to play an effective role governing the corporate body. It mandates setting up of focused and even technical committees of the Boards to provide oversight on specific issues the corporate faces, for instance, audit, risk management, HR, growth and investment, etc. Amongst these, the audit committee, concerns the Internal Audit profession as the function reports to this committee in every Organization required to follow the Corporate Governance Rules and Codes. This Committee decides the resource and planning of IA function, approves governing guidelines pertaining to it, finalizes the audit delivery and assesses its performance.
That’s how the Audit Committee and the Internal Audit function are stuck with each other!
But when the Boards (read Audit Committees) become too bogged down at theory and not the substance, keep themselves confined to the literal side of things written in the codes and rules and strive to adhere with the requirements in a checklist manner; precisely that’s when the Internal Audit loses traction and stops short of delivering value. The Board becomes gullible and takes a significant toll on the internal audit’s effectiveness, thereby reducing it to a mere compliance-necessitated cost center.
Let’s now try to define Gullibility in the context of Boards and what are its tell-tale signs.
Simply put, a gullible Board is one which does not have a mind of its own! Moreover, if you notice that the words coming out from the Board are those that have been put in it, you’re experiencing an advanced state of gullibility; “a cherry on top!”
The telltale signs include:
- Board echoing the viewpoint of management on every audit report.
- Board never differing from the management’s action plan on audit findings.
- Board guiding audit planning and strategies in the same direction as management.
- Board agreeing to management’s assessment of audit findings significance.
- Questions asked from auditors are answered by management and Board agrees to these.
Other then the approach towards Internal Audit, signs are:
- Board failing to give any strategy direction other than what the management wants to hear.
- Board not giving any diversification/investment advice.
- Board rubber stamps all important decision making concerning the Company, restructuring, HR planning, Tech planning, treasury management, etc.
- The Board members struggle to understand specific business, operational and financial statement issues.
- Board members more focused on their meeting remuneration than the meeting business.
- Board members strategizing what should be recorded from their meetings rather than the meeting itself.
This gullibility spells disaster for the audit function. Simply put the auditors are better off with sharing findings only with management instead and to customize them to management’s ‘expectations’; even better to not provide an effective and through coverage of the audit universe!
So, if you’ve also witnessed these signs or any of these; have solace in the fact that you aren’t alone. If it comforts you more; understand that some corporate entities must make news for the wrong reasons and only then we get to have more tweaks to regulations, rules and codes; that at times make our job even more significant. If the root cause is not addressed, the doomsday is a field day for us, the internal auditors.
As for the root cause, it’s always better you make your own efforts to identify these. Maybe there are those that could enable you to better understand and adjust your audit planning and strategies. And if you’re lucky enough, maybe you get a chance to set a course correction in motion! However, my take on the root cause is that unless the Acts, Regulations, Rules & Codes move from the theoretical side of things to enforcement; the practical side and especially around Board’s performance, things won’t improve.
Presently, we’re not even close to assess meaningful compliance of the Board’s working with those requirements; assessment for improvement is a BIG ASK!
So, sit back and enjoy your position, for you’ve, at least on paper, ticked all the boxes!