Even the best corporate executives need some wise guidance, especially in these scandal-tinged times. Often such help can come from internal auditors.
The work of external auditors is well known. They "verify" the reliability of a company's financial statements. At least, that's what they usually do. Internal auditors, on the other hand, work primarily with management to verify that the enterprise is running efficiently and honestly.
Given the increasing need for more checks on corporate processes, internal auditors ought to play a more prominent role in ensuring that the corporate reports external auditors examine are put together in a straight-ahead fashion. The Institute of Internal Auditors, a trade group, recently underscored the need for amping up the internal auditors' role. In a publication, the group said: internal audit is "a function that can provide assurance to an organization that controls are adequate to mitigate risks; that policies and procedures are being followed throughout the organization; that processes are efficient, effective, and economical, and that management and the board are meeting organizational goals and objectives."
That sounds like a recipe in demand, not only for companies, but for investors seeking more assurances about corporate financial reporting. External and internal auditors, when performing their functions properly, work in a complementary fashion. An external auditor will examine accounts receivable to determining if they are collectible. The internal auditors are concerned with whether all of the company's customers have actually been billed for the company's services or products.
But internal auditors often find themselves boxed in by a management structure that doesn't motivate them to report fishy business. While good corporate governance may recognize the direct relationship between the internal audit department and the stockholders through the company's board of directors (and/or audit committee), too often the more defining relationship is between internal audit and top management. And, in order for internal auditors to play their watchdog role effectively, they must be set free from a position that often makes them too beholden to the managers they are examining.
A Case to Consider
How does internal audit work when reporting priorities are mixed up? Let's look at an example.
A company's board audit committee requests a private meeting with internal auditors. The audit committee has heard rumors concerning misuse of the corporate jet. The audit committee asked the internal audit department to investigate.
The internal auditors discovered a pattern of trips to resort locations, which included passengers, not known among the normal customers or suppliers. The company's President and Vice President of Finance went on each of these trips. While the findings may not have been a "smoking gun," the implications were of great concern.
The manager of the Internal Audit Department delivered a copy of the report to the President and Vice President of Finance 24 hours before the report was given to the audit committee. The manager didn't change anything in the report, but the maneuver suggests concern about management reaction, and, perhaps fear that the board's audit committee may not protect him and his team if management decides to take "action" related to the internal investigation. Dicey business, internal auditing.
It's vital for companies to mandate that internal auditors act with zeal and without fear. The internal auditors must think about the shareholder, regulators and other external factors, not about cozying up to management. This kind of focus is not possible without a strong organizational charter that clearly outlines the independent role of internal auditors.
Also, companies' audit committees should always have unfettered access to the internal auditors so that they can fulfill their responsibility to assure that top management is behaving properly. Internal auditors should meet with the audit committee privately without management present. If done on a regular basis, this would limit the perception that there was a specific problem.
As was stated in the Report and Recommendations of the Blue Ribbon Committee on Improving the Effectiveness of Corporate Audit Committees, "Independent dialog between the audit committee and the auditor should lose its 'taboo' nature and no longer imply treason against management. The audit committee must establish and support a culture that promotes open disclosure on the part of the internal auditor."
Unfortunately, many company employees fear being "written up" by the internal auditors and view the process as being punitive. The internal auditors can and should provide the pipeline which allows lower-level supervisors to get the attention of top management about problems that are troubling them. It is essential to keep this pipeline open. This means that the internal auditors must possess good diplomatic skills as well as auditing skills. Otherwise, they will not be able to get the trust of those employees who will perceive any negative comments by the internal auditors as punitive rather than constructive.
So while internal auditors continue to answer key corporate questions such as, is corporate travel being managed economically or are company credit cards being abused; we also hope they recognize their responsibility to stockholders and boards of directors.