Internal Audit: Time to stop worrying so much about independence and objectivity?

Note: This article was finalized during the exposure period for the newly proposed “Standards” revisions. It is intended to be a thought piece, and not intended to be an encouragement to not conform with the Standards in their current or any future form.

Without taking up space citing Institute of Internal Auditors (IIA) authoritative Standards and Guidance, most anyone who knows anything about internal auditing knows of the importance of the words “Independence” and “Objectivity.” These two concepts are the core underpinnings of what makes internal audit unique and effective. They form the pillars from which the assurance work we do can be most relied upon.

We internal auditors will fall on the proverbial sword sometimes to fight for our independence and preserve our objectivity by working hard to have our unique dual reporting line be one that can enhance our independence. And avoiding any work that might be construed as operational, lest our objectivity be compromised.

In my past, I took and strongly advocated for some rather prescriptive and draconian measures to raise concerns about my independence; and say no to requests for assistance that might impair - or even hint at impairing - my objectivity.

I am sensitive to the fact that I am being controversial when I suggest that maybe we need to be a bit more pragmatic about this independence and objectivity stuff in today’s rightful calls for strong 3rd line assurance.

Let me explain…

Terms and Conditions

So, let’s start with how The IIA defines each per the Glossary to The International Standards for the Professional Practice of Internal Auditing...

Independence - The freedom from conditions that threaten the ability of the internal audit activity to carry out internal audit responsibilities in an unbiased manner.”

Objectivity - “An unbiased mental attitude that allows internal auditors to perform engagements in such a manner that they believe in their work product and that no quality compromises are made.”

So, what is the bottom line here?

While I will admit to, in past internal audit roles, using both “independence” and “objectivity” as the proverbial soccer (or football, as you wish) “red” and/or “yellow cards,” screaming foul if either were ever put in jeopardy (and falling and writhing in feigned injury), I think in this modern era we need to stop saying NO. And, perhaps, say YES (or at least YES, BUT), and understand what that means in terms of our future work.

In other words, to add the most value to our organizations, maybe we do what needs to get done in the best use of our resources holistically, and deal with any independence and/or objectivity issues separately. Did I get your attention? OK, let’s go a bit further…

Begin with the end in mind

I love the saying, “begin with the end in mind.” So, for your internal audit function, what is the end point, or goal you are striving for? Is it to be viewed as a trusted advisor? Is it to have a seat at all the right tables? Is it to be invited to consult on all major strategic and operational initiatives? Is it to be in the information flow of all key matters such that you can make continuous and dynamic changes to your enterprise risk assessment and resulting audit plan? Is it to be less despised? Is it all of the above?

If the answer is “all of the above”

I’ll bet the answer is yes to much of this. Well then, the “I’m from internal audit and I’m here to help” blabber won’t be believable if all you do is remind everyone you report to the Audit Committee of the Board or say no to most requests for assistance because it might impair your objectivity. See where I am going with this?

So, let’s take “independence” and “objectivity” separately and see if I can convince you to think a bit differently

Regarding Independence

To be independent, you must have the freedom to do what you want and need without influence from some other party redirecting your efforts elsewhere, especially if it is over your objections. Ideally, we elevate our independence as internal auditors by reporting functionally to the board or a board committee and being able to have full, free, and unrestricted access to exercise our duties and fulfill our mandate.

But what if what the organization chart depicts, and the reality are something different? The words all say we are “independent,” but actual behaviors in the governance structure act to preclude our real independence. Well, then our independence has been impaired and that’s a problem. If that’s the case, we should raise the issue and anticipate that it is appropriately and swiftly worked out. And, if not, then we must evaluate if those restrictions are impactful enough to make us consider looking for employment elsewhere.

Now, what if the opposite is true? So, maybe you don’t have a strong functional reporting line to the Audit Committee, is that the end of the world? Maybe, but maybe not. If you can do what you need to do, when you want to do it, and have full, free, and unrestricted access to what you need, and issues are being addressed without interference, then maybe it really doesn’t matter. Maybe we should not scream for what I would call structural independence if you had it anyway. If it’s working, don’t mess with it.

Regarding Objectivity

Let’s start with what seems like an innocuous question: “What is more important, the needs of internal audit or the needs of the organization?” Sheepishly for some of us, we’ll have to admit, the organization should come first. Yet, when confronted with an opportunity to help, we tend to shy away because of fears that our objectivity might be impaired or impacted in the future, and we put internal audit first. Not such a collaborator are we now, at least in other’s minds, right? Oops.

Of course, there are extremes to this, just as we should never say “no” to everything, we should not say “yes” to everything either. If we can truly be helpful, and we have the skills and competencies to aid in furthering the request, we should, in my humble opinion, strongly consider it. And, maybe we can’t do exactly what is being asked of us, but we can do something else that would be even better and more helpful. Then do that. If we build a track record of being really helpful, then when we do come along to do our more traditional assurance work, we will be valued and trusted more. And what is going to help the organization more, in both the short-term and the long-term, than being the valued, trusted, and experienced team player?

Yes, there is a great risk our objectivity will be impaired with certain projects and certain situations. But awareness that our objectivity might be impacted is more than half the battle, and we need to play the long game here, positioning us to add real value to the organization and enhance relationships and improve perception of us. So, just manage the situation accordingly by being strategic with resources in the future to minimize the risk. Most likely, if you tell the Audit Committee what you plan to do (or have done), and why you did it, they will be pleased. And, if you feel so obligated (and you should), also tell them how your objectivity could be impaired and what you are going to do to mitigate the risk.

What is the greatest risk here?

To me, it is that we are blinded by our inability to see how our objectivity IS (see, I said “is,” not “might”) be impacted. If we’re blind to it, and it negatively affects our work, that could certainly be a problem. (Psst, sidebar here, I got news for you … you are biased right now and blind to your objectivity issues. We ALL are, me included. If you are telling yourself that you can be fully and completely objective in all you do, then you are lying to yourself.) So, if you’re so good at being “devil’s advocate” with others, be “devil’s advocate” with yourself and your audit team members. Be critical of yourself, and your team members, and ask tough questions about objectivity impairments. As silly as it sounds, try to be objective about the things you might not be objective about.

Conclusion: Play the Long Game

Look, just evaluate what’s in the best interests of the entire organization, decide what you are going to do, and get on with life. When confronted with independence and objectivity issues, ask yourself what is best for the ENTIRE organization in the long run, even if it’s not best for internal audit in the short run. That might include not being in full conformance with the Standards. (Yes, I said it.)

I promise, as important as Standards conformance on the foundational internal audit underpinnings of independence and objectivity is, it’s more important to have strong, trusting relationships, have all the right seats at all the right tables, and add value in everything you do. Executive leadership, the board, and your audit committee will love you for it. So, stop saying NO, and at least say “YES but …”