Page 1 of 5

5/21/2010 5:31 PM

Citrayudha Komaladi

From: Goh Kheng LengSent: Monday, April 13, 2009 3:36 PMTo: Heng Cheng Chiang Eddie; Citrayudha Komaladi; Tham Hoe

Ming; Nick Lim; David SongSubject: 6 Cultural Pillars of Successful Audit DepartmentsAttachments: image001.jpg

Importance: High

Below is an article from IIAs April Issue of Internal Auditors magazine. Please read it as it is useful.

6 Cultural Pillars of Successful Audit Departments

Internal audit functions can elevate their stature by mastering soft skills trust, emotional intelligence, performance focus, courage, support, and shared learning.

Bruce Adamec, CIA, CPA Vice President-Audit Services OfficeMax Inc.

Linda M. Leinicke, PHD, CPA Professor of Accounting Illinois State University Joyce A. Ostrosky, PHD, CPA Professor of Accounting Illinois State University

An internal audit department's culture is the manner in which the department does business. It encompasses the social norms and shared values of audit management and auditors and sets the tone for the work they perform. Culture influences how individuals in the department view themselves, colleagues, clients, the audit committee, and customers. It establishes how the department performs its work, the expectations and aspirations of staff, whether departmental results are long-term or short-term, and how much openness and candor exists. In sum, it establishes how courageous, successful, and influential internal auditors will be in applying their skills and upholding the profession's foundational values of integrity, objectivity, confidentiality, and competency.

When auditors are among clients, they can feel pressure to conform to the client's values rather than upholding those of the internal audit department. In such situations, a robust culture based on strong, shared foundational values can aid the auditor in taking the right course of action. Additionally, because audit department personnel turnover can be relatively high when compared to other departments, a positive environment can be essential to attracting and assimilating replacements for departing members and sustaining superior performance.

Every internal audit department must adhere to the profession's four foundational values. Similarly, all audit departments need the right infrastructure: technical expertise, a clear charter, a risk-based audit approach, audit expertise, soft skills (such as negotiation and collaboration skills), and appropriate technology. However, even audit departments that have these qualities may not have sufficient clout, influence, and enterprisewide leadership roles. Six cultural pillars differentiate the truly influential audit departments from those that do not possess enterprisewide influence:

Trust. Emotional intelligence. Performance focus. Courage. Support. Shared learning.

Understanding the audit department's proficiency in each of the six cultural pillars can provide a chief audit executive (CAE) with a starting point from which to assess and improve the department's culture (see "Cultural

Page 2 of 5

5/21/2010 5:31 PM

Pillars Checklist" at the end of this article). However, challenging an individual or group to master skills in even one of these areas can be difficult. It takes a passionate CAE and receptive audit management and staff to ignite a department's desire to improve.

The appropriate cultural elements also can pave the way for the department to establish a sphere of influence. Both credibility and empathy, important basic factors in establishing the influence of an audit department, can be enhanced through the six pillars.

TRUST

Trust, mandatory in any professional organization, is essential for a successful internal audit department. Trust is a corollary of the profession's foundational values particularly integrity. Integrity means keeping one's word, or making good when one is unable to keep it. Establishing trust with clients is predicated on, and indicated by, integrity within the department. Overlooking missed intra-department commitments, refusing to confront team members who do not keep their word, or accepting excuses about missed commitments are all indications that trust in a department is weak.

The importance of trust can be illustrated by the interdependence of team members' work. Because the work auditors perform depends on their teammates' efforts as well as their own, interdependence of efforts and trust are crucial to the department's success. Moreover, auditors don't have time to check each other's work, so they must be confident that their colleagues will perform their work completely, competently, and on time. As auditors experience positive results from trusting each other's actions, they build relationships and learn to count on one another to meet commitments to timeliness, professionalism, and quality.

Many consultants and practitioners believe that questioning or verifying that someone has appropriately performed his or her work actually erodes or violates trust. There are two problems with this point of view. First, trust should not be confused with blind faith. Simply assuming that everyone has the skills to perform work acceptably, without guidance and feedback, is a prescription for failure. Second, it is not a violation of trust to review others' work or to question the work or missed commitment of a peer. Reviews ensure a high-quality work product and contribute to the department's reputation for doing excellent work. Reviews also provide important educational feedback to department members, given the feedback is well-delivered and received.

As trust is woven into the internal audit department's culture, it pervades the department and spills over into its dealings with clients. When it is true and genuine, trust can improve the department's influence with all its various stakeholders.

How does the CAE create a climate of trust? First and foremost, the CAE must be a trust role model. This individual must listen to department members' points of view carefully, listen to what clients have to say, and provide candid and professional but not emotional feedback when reviewing the work of others. The CAE then must instill these same behaviors into the department's members. Open discussions of trust can help members understand its importance as a cultural pillar and how it can be accomplished. Further reinforcement can be accomplished by evaluating each member on the dimension of trust perhaps as part of an annual evaluation process. Because trust can be an elusive trait to observe and measure, survey questions can be answered by supervisors, colleagues, and clients to provide a 360-degree perspective regarding how trustworthy team members are and what corrective behaviors might be warranted.

The CAE cannot leave trust to chance. He or she must clearly articulate, and frequently reinforce, that mastering trust, both inside the department and with clients, is an important element of the department's cultural fabric.

EMOTIONAL INTELLIGENCE

There is a large body of literature that deals with the second soft skill. In Working With Emotional Intelligence, author Daniel Goleman defines emotional intelligence as "the capacity for recognizing our own feelings and those of others, for motivating ourselves, and for managing emotions well in ourselves and in our relationships."

According to Goleman, emotional intelligence is a key characteristic of successful business people. Emotional intelligence skills often enable individuals to outperform other individuals with higher IQs, better educational backgrounds, and more experience. He identifies five competencies related to emotional intelligence:

Self-awareness. Knowing what a person feels in the moment, and using those preferences to guide decision-making; having a realistic assessment of one's own abilities and a well-grounded sense of self-confidence.

Self-regulation. Handling emotions so that they facilitate rather than interfere with the task at hand; being conscientious and delaying gratification to pursue goals; recovering well from emotional distress.

Motivation. Using one's deepest preferences to move and guide the person toward his or her goals, to help take initiative and strive to improve, and to persevere in the face of setbacks.

Empathy. Sensing what people are feeling, being able to take their perspective, and cultivating rapport and attunement with diverse people.

Page 3 of 5

5/21/2010 5:31 PM

Social Skills. Handling emotions in relationships well and accurately reading social situations and networks; interacting smoothly; and using these skills to persuade and lead, negotiate and settle disputes, and elicit cooperation and teamwork.

Self-awareness, self-regulation, and motivation are personal competencies that determine how individuals manage themselves. Empathy and social skills are social competencies that determine how people handle relationships.

Internal audit departments should create an environment in which auditors practice the five emotional intelligence competencies as part of their normal work routine. Informing staff members that practicing the five competencies is a goal of the department is a necessary first step in creating this environment. This step should be followed by training that introduces the concept to department members. To help instill this behavior as a permanent fixture of the department's culture, department members could receive feedback on their emotional intelligence competency from clients, subordinates, peers, and superiors. Where these evaluators do not feel qualified to assess someone's emotional intelligence, the department may hire a qualified consultant to facilitate information gathering to enable this feedback. By nurturing these skills, the internal audit department can become a birthplace for future business leaders and establish empathy and credibility with its clients.

PERFORMANCE FOCUS

Performance focus is essential in running a strong internal audit department because it guides the department as it crafts its goals. Several definitions of performance focus are used in business today. Some people believe the term is synonymous with work ethic and means that internal audit professionals will work long hours. Some believe it means that auditors should focus on client and customer needs first and secondly on what their audit supervisor tells them to do, while others believe that auditors should first focus on what their audit supervisor tells them to do and secondly on the needs of clients and customers. Still others believe performance focus means concentrating on meeting the needs of the audit committee or some other stakeholder group.

While all of these ideas have merit, The Wisdom of Teams, by Jon Katzenbach and Douglas Smith, provides a broader definition that is applicable to internal audit departments. An adapted version of Katzenbach and Smith's definition is: A strong performance focus means everyone in the internal audit department relentlessly pursues common performance results that will benefit four groups:

1. Customers who pay the company for goods and services.

2. Shareholders, the board of directors, and the audit committee.

3. Clients employees of the company or internal customers for whom auditors perform work.

4. Members of the audit department.

This definition charges the internal audit department to serve all four types of stakeholders, which may lead them to rethink their goals and how they measure success. The CAE should initiate a process to develop performance goals and metrics for each of the four stakeholder areas. It is important that all department members have meaningful input into determining these goals so that everyone is encouraged to accept and commit to them.

An example of a performance goal for customers might be that when performing internal audits, the department will provide assurance that all customer information is safeguarded adequately and kept confidential. During operational audits, another customer goal may be to verify that operational activities are effective and efficient to ensure a quality product or service is provided to the customer. A performance goal related to the audit committee would be to report material weaknesses and significant deficiencies in the company's internal control system to the committee. A client-related goal would be to always provide professional, high quality, and timely service. Finally, a department-focused goal would be for all auditors to attempt to become certified internal auditors.

Performance goals that the auditors have identified should be pursued with passion. To be successful, internal audit departments must seek outcomes that are balanced across all four stakeholder constituencies. The CAE should evaluate and update the department's performance goals periodically.

COURAGE

Courage lies at the heart of everything an internal audit department does. Auditors must critically analyze functions they know little about. They may have to challenge powerful people in the organization. In all cases, they must be honest and ethical and pursue the truth, no matter the political or personal consequences. They must be able to withstand the social pressure that comes when they question a client's "sacred cows" and when they shed light on the organization's shadow. To perform their jobs successfully, they must have self-confidence and an unshakable inner compass that holds them to their true course. In the face of contentious disagreements, auditors must be willing to hold fast to their beliefs and take whatever action is necessary for truth to prevail. If the

Page 4 of 5

5/21/2010 5:31 PM

department does not value and support this moral position, internal auditing won't be professionally practiced in the enterprise.

Courage, however, involves more than standing up to powerful external constituencies. It also involves teammate and peer relationships. This means having both the courage to provide critical feedback to teammates and to accept critical feedback from them. It isn't easy to provide constructive criticism meant to help a teammate, and it takes immense personal fortitude to suggest how he or she may improve. If an auditor doesn't provide constructive feedback to a colleague, chances are no one with that peer perspective will, and that colleague may have lost valuable insight on performance improvement. Auditors take large personal risks when they rely on peer feedback to improve their own performance. It's easy for them to become defensive. Internal auditors must be strong enough to listen to the input, understand what they are being told, evaluate the input, and then act on the criticism appropriately. It may be easier to act on feedback received from a boss who has power over the auditor's future. It's harder for auditors to act on a peer's constructive criticism, and it takes a great deal of courage to accept it from a teammate.

Courage must be communicated by example, especially by the CAE and the internal audit managers. It must be articulated, practiced, and supported by everyone. When it is, courage enhances the department's reputation, credibility, and sphere of influence.

SUPPORT

Building and maintaining strong internal and external support for the internal audit department is critical for its long-term success. From an internal perspective, auditors must support each other. Some examples of internal support are providing encouraging feedback to teammates, recognizing and celebrating individual and team successes, and covering for a sick colleague. Such support helps build camaraderie and a cohesive department.

External support is equally important. The audit department cannot be successful by itself auditors must reach out and build strong bridges to their constituents. Support is available from many external sources: the audit committee, top management, clients, the legal department, and human resources. To develop support from these constituencies, it's important for auditors to understand and meet their needs. Obtaining feedback from constituents through questionnaires, interviews, town hall meetings, and other methods is an important step in developing and maintaining external support. The second part of supporting and being supported by the external community is evaluating constituents' feedback carefully and honestly, articulating necessary changes both to the feedback providers and within the department, and then executing the promised changes. As the audit department reaches out to its constituencies, that support is frequently given back in kind. This mutual support allows for synergistic working relationships that benefit the entire organization.

SHARED LEARNING

Learning is more than an individual taking a class or earning a degree it is a desire to take risks, experience victories and defeats, and learn from the experiences. Shared, or group, learning enables individuals to learn from these risks and experiences and then share these lessons with colleagues. Shared learning can make a group collectively smarter than it otherwise would have been. Shared learning is an attitude that can be role-modeled and learned.

Shared learning is essential for internal audit departments to rise to a high level of achievement and continuous improvement. To be successful, all department members must commit to a shared-learning model that encourages them to take chances, make and learn from their mistakes, and share their successes and failures. Through appropriate incentives and use of tools, audit management can foster shared learning.

Learning occurs daily as internal auditors perform their work. When they tackle a new job, try a new technique, or attempt to apply lessons learned in other work experiences to their current audit assignment, they encounter potential learning situations. If their current assignment goes well, auditors will eagerly share their success stories with their colleagues. However, if the current assignment doesn't go well, auditors can be reluctant to acknowledge their mistakes. Professionals often believe that if they admit their mistakes, they will lose face with their team, audit management, and clients. Some people are willing to acknowledge mistakes privately; others simply try to hide them. However, in our experience, admitting a mistake and explaining what went wrong did not diminish our credibility it enhanced it. Acknowledging and discussing errors gave colleagues the opportunity to learn from our mistakes. Audit management must have the fortitude to endure good-faith errors, the ability to evaluate the efforts of auditors honestly, and the patience to intervene only when absolutely necessary.

CAEs can take steps to encourage shared learning. Role-modeling behaviors is essential. First and foremost, the CAE and internal audit managers must share their successes and acknowledge their mistakes. Without this candor, shared learning is not likely to develop. Second, the audit department should develop a nonthreatening atmosphere, such as a monthly group meeting, in which to share both successes and mistakes. To avoid repeating mistakes, the audit group must remember them collectively and use their shared knowledge in appropriate situations. Third, incentives, such as cash awards and prizes, can be provided to auditors who publicly share errors.

Page 5 of 5

5/21/2010 5:31 PM

ELEVATING THE DEPARTMENT

The six cultural pillars are characteristics that successful and influential internal audit departments practice. CAEs should honestly identify their department's capabilities in each pillar and focus on improving one area at a time until performance in that pillar is acceptable. When the department has achieved an appropriate level of mastery for all six pillars, it can elevate its stature in the organization to its highest potential.

To comment on this article, e-mail the authors at bruce.adamec@theiia.org.