Raising strategic issues through an Internal Audit Review
“Internal Audit may serve both assurance and advisory role. At present, while the emphasis on the need for assurance is high but advisory role is also gaining ground. This advisory role also broadens the scope of Internal audit to raise business and strategic issues while doing regular reviews. However, an internal auditor must face challenges in terms of highlighting and helping resolve strategic issues. These challenges might include, auditor’s own knowledge and expertise stiff resistance from business management. However, a smart auditor will be able to sail through these hurdles to not onlyadd but create value. Read on…”
Dual Role of Internal Audit: Assurance and Advisory
Internal Audit may serve both assurance and advisory role. At present, emphasis on level of assurance might be high but advisory role is also gaining ground. Auditors are gaining confidence in providing suggestions which are more of improvements from the current state of running the business and a better way of corporate governance rather than merely giving assurance. A pertinent issue arises, whether it’s within the preview of internal audit to raise a business or strategic issue? If yes, then what are the problems auditor might encounter while raising strategic issues?
Whatever law specifies such for any specific purpose,are the bare minimum which needs to be complied or adhered too. Roles listed for Audit committee or that of internal auditor under any law or rules, are bare minimum requirements as a part of corporate governance. The state of the audit committee and prescription of the law may differ from country to country.
Advisory role of internal audit may include review of strategy, if mandated by Board. This advisory role also broadens the scope of internal audit to raise strategic issues while doing regular reviews. By broadening the horizon of internal audit, governance get a different and fresh perspective to look at business operations.
Strategic issues are in the nature of the best tactics deployed to achieve the strategy. They may surface in terms of vision, mission, values, resources, processes, delivery of products and services or their mix, market penetration, its reach (whether interms of geographical spread or depth) and structuring of the organisations etc. Short term occupation/ myopic indulgence with topline and bottom line may also lead to actual erosion of strategic direction and arising of various strategic issues with grave consequences for sustainability of business and corporate governance.
Hurdles in Identifying and Raising Strategic Observations
While identifying and raising a strategic observation during the regular internal audit review, may pose number of hurdles. These are listed below:-
A. No logical explanation by operating management:
Operating management is responsible for the operationalisation and implementation of various action plans to achieve strategy. In fact, they might not be fully aware of the true strategic intent, leave aside rationale/reasons for adoption of strategy. When auditor confronts operating management with strategic observations or alternatives, one might hear explanations or responses such as,“this is management/ board decision.”Even if details are available, operating management may be hesitant to share due to ambiguity attached with such details. Such details if shared, will give rise to further prodding from auditor. Hence, such details get cloaked under the cover of secrecy, either unintentionally or deliberately.
B. Stiff resistance from business owners:
Responsibility for strategy formulation and direction rest with top leadership of the organisations with approval of board of directors. It is long term in nature, and with consequent rigidity. This rigidity is due to various factors such as efforts required, allocation of resources, time and uncertainty attached with other alternatives. Usually there is resistance to change, once committed. These reasons lead to refusal of any weakness in the current strategy and resistance to accept alternatives suggested to strategic direction/ path chosen, giving rise to a strategic issue.
C. High in importance and difficulty in quantification:
Such issues noted, will have high importance due to their strategic nature and wide spread impact. For the information auditor has to depend upon auditee, who might supply this with filtration and biases. These issues are future centric, so difficult in quantification in terms of anticipated cost and benefits of suggested alternative. This will pose difficulty in convincing top leadership about the workability and superiority of the recommendations and proposals.
D. Ego – I am right syndrome:
Top leadership/ management of the organisations have carried business successfully over a period of time. They might have implemented few decisions right or wrong despite stiff resistance from counterparts and board of directors. These circumstances, over a period of time, tend to reinforce over commitment/ bulldogging oppositions and developing I am right /ego in the executives at the helms of the affair.The presence of such a mindset, hinders from finding the hard truth highlighting any weakness in their current strategy. This poses another issue for auditor to deal with while coming up with any strategic alternative or suggestion.
E. Lack of auditor’s knowledge and experience:
Most of their career, auditors are trained to work on assurance assignment. They look and work mostly on control issues, which are visible and easy to convince and address. Most of the issues which deviate from above criteria are snubbed off as management prerogatives or management decisions or policy decision. Strategic issues are offshoots of these management prerogatives or management decisions or policy decision. Due to this, auditors learn to look other way round. Courage to take up such issues could also be one of the reasons, they might lie unattended.
F. Availability/ access to data and information:
Strategy formulation is tedious and long drawn process. It involves lot of data digging and information prodding from different sources including proprietary one, involving high cost. Having access to these resources is difficult for auditors. Internet might provide dated and limited data/ information. Convincing for a strategic issue based on limited information is almost next to impossible.
G. Where to take in case of disconnect:
Main ownership of the strategy rest with top leadership. Board is entrusted with oversight responsibility. Audit committee role is restricted to minimum specified in company’s act to the maximum of any delegation by board. Audit committee is responsible for the review of Internal auditor’s work, may review strategic issues raised in a report but as oversight responsibility for strategy rest with board or any separate special committee constituted by board, it might not be able to act in a decisive way as is the case with various controls issues highlighted. On the other hand, board has a mentoring role with limited ability to influence in case of strong and proven leadership team. Such situation board acts as more of a rubber stamp, clearing decision of the top leadership rather challenging them. Due to above, issues may get parked in cold storage without being addressed unless until first being sold off to those responsible for implementing the same.
H. Political repercussions:
Politics is ubiquitous in every organisation whether someone accepts it or not. Usually the political repercussion of the decision at the top are far more serious for them than at the lower echelons of the hierarchy. Any strategic issue may hand over lever in the hands of political opponents to grab upon the opportunity to pull down or resettle the throne with changed power equations. It goes without saying, auditors need to stay away from becoming tools of political exploitation between warring factions of organisational power politics. This further complicates situation for the auditors raising strategic issues since it runs the danger of taking sides.
I. Uncertain outcomes:
Even if,strategic issue gets recognized and acknowledged by leadership team, arriving at agreed action plan is another uphill task. When recommendations for the normal control issues are drafted, its patently clear as to the outcomes that are expected for both auditee and auditor. However, in case of strategic issues outcome of recommendations is uncertain. Under such situation, it becomes hard for both auditee and auditor to get committed to the solution in terms of agreeable recommendations, which departs from current course of action. Maturity is required on the part of all players to arrive at consensus in terms of solution.
J. Will to challenge:
Strategy is driven by highest level in the organization. If auditor decides to challenge any part of strategy, he must counter those highest level in the organisation. With these leaders, auditor might be seeing his future within organization. To put forward his perspective and not getting sold off to the current solution by leadership, auditor needs deep inner will to challenge current status quo.
Conclusion and Professional Imperatives
Strategic direction is of great importance to the very existence of the organisations. Auditor needs to consider all objective and subjective evidence available before formulating strategic issue. If any strategic issue noticed during a review, overlooking the issue and not reporting would amount to dereliction of moral duty on the part of an auditor. However, auditor needs to be smart enough to sail through any hurdles specified above with his experience and acumen.
In the end auditor must remember ultimate responsibility for running business and overall strategy rest with top business leadership and board. Auditor can only expect the time and mind share of leadership and board on such issues. If this is forthcoming, the auditor will act as motivation and he should feel happy and satisfied of having discharged his duties of highlighting risk inherent in current strategy discord.■