One of the great advantages of using rotational auditors is that you begin to infiltrate the business with managers who think like auditors. Sound audit thinking in the company equates to big-picture thinking and better risk management.
While two children and nine adults were caught in a dangerous riptide off the coast of Panama City Beach, Florida, responding officers waited on shore for the rescue boats that arrived too late.
People on the beach had a better, faster plan. Holding hands, the beachgoers created a human chain more than 70 people strong that stretched out across the sea to reach the stranded individuals and pull them to safety. The idea was at once unconventional, creative, and above all, resourceful.
When it comes to auditing, how do we take full advantage of our resources to manage risk and improve the business? Just like these beachgoers, it might require using assets you have on deck.
Enter rotational auditors.
Rotational auditing is a system that brings outside talent into your internal audit group to improve individuals, the audit function, and the company as a whole.
And where companies may do some variation of a rotational program, perhaps using rotational auditors is an untapped resource in your company. If rotational auditing sounds like something you’d like to try – do it. We put together a few steps to get going in that direction.
1. Determine if the culture fits
A rotational program may require a subtle shift in company culture or audit culture. Too often, auditors get stuck in a rut of controls and assessments and give little heed to development in others. Instead, begin to create a culture of improvement.
Brad Ames, Internal Audit Director at Microfocus, has almost 30 years experience in internal audit. Ames knows internal audit, but in his heart, he’s a developer of people and their talents. For Ames, you have to have the right type of culture to make a rotational program work.
“If you’re just trying to cover a hole in assignments, rotational auditors is never a good idea,” says Ames. “It has to be more about the development of the individual coming in. You have to have this concept of ‘relational auditors’ that are invested in the development of another person. So if your shop isn’t relational and is more project management, then you’re going to have a difficult problem with a rotational program.”
Rotational auditors can be excellent assets to the audit team with new ideas and understanding of the business, but they’ll need some fostering from fellow auditors before they can contribute.
Improvement is change, and change can be a little uncomfortable at first. Sometimes you have to wear the shoe a little bit until it fits well.
Key takeaway: Create a relational culture between people in audit so the program can thrive.
2. Redefine internal auditor
An internal auditor is in finance. An internal auditor likes numbers and formulas. An internal auditor is structured.
Perhaps the view of what an internal auditor “is” is too myopic.
What if we expanded that rigid definition of an internal auditor? Tony Redlinger, Internal Audit at IHS Markit and Security Ambassador for MISTI, makes the point that anyone can learn to be a good auditor when they’re trained. “In nowhere in the IIA definition of internal audit does it say compliance and nowhere does it say finance. [Internal Audit] is an independent assurance and consulting function.”
Redlinger says to think smart when looking for rotational auditors – they don’t have to come from finance.
“I think it’s important we get these diverse backgrounds. We don’t just need finance backgrounds. We need a marketing background. They will approach things far differently than those with a finance background.”
Think of rotational auditing as a symbiosis with the business. As you work together, rotating professionals through internal audit, the risk management of the entire company can improve. And you need risk management in all aspects of a company – not just finance.
Key takeaway: Auditors come in all shapes, sizes, talents, and areas of business.
3. Determine type
Depending on your company size and culture, you’ll gravitate more toward a formal or informal rotational model. The more complex the company, the more formal it may need to be.
Programs don’t have to be formal. In one research study, Steve Goepfert, retired VP of Internal Audit at United Airlines, says that rotational audit programs should be created organically. “Organizations shouldn’t just build a rotational program to build one. But should build leaders first for the organization. The first step is to hire really good people and develop leaders and then building a rotational program will take care of itself.”
Types of rotational programs include filtering new hires through internal audit and rotating professionals through who is on the management track. Nestle likes to hire college talent and filter them through their internal audit program first. Each year, Nestle launches about 25% of their audit team into other careers that are better matched for passion and talent. Companies, like Hewlett Packard, have cycled management through internal audit so managers can gain an overall understanding of the risk framework within the company.
Not only do employees rotating into audit benefit the company, but also internal auditors can rotate out into the business for a year or two.
“It’s really important for internal auditors to understand the business,” comments Redlinger. “The biggest criticism we get is, ‘you don’t really understand my business.’ So I think there’s a great benefit in exchanging people for a year or two. You bring someone in, you train him or her, and they learn the audit mindset. At the same time, if you’re swapping people, then you’re kind of infiltrating the whole business with the risk mindset.”
A formal rotational program will ensure that you’re bringing in new talent, but if you get the conversation started informally at first, you might have some new talent knocking on your door.
Key takeaway: Tailor your program using use new hires, management hopefuls, and auditor exchanges to infiltrate the business with a risk mindset.
4. Determine length of time for rotational auditors
If you’re going to get your toes wet, then you might as well jump in. Pulling in a guest auditor or rotational auditor for too short a time may prove ineffective.
“We have to make sure that the person is in audit long enough that they actually learn something about controls so they will go back out and become managers with that control mindset,” states Redlinger. “How long does that take? Takes at least a year. I think we see that either on a rotational basis or someone being brought in. It takes at least a year.”
For Ames, the magic number is three. “You have to have at least three engagements to benefit the person or the audit department. First time you’re figuring it out, the second, you know how to get to the end [of an audit], by the third audit you’re adding value and learning and can take it back.”
Key takeaway: Rotate auditors in for at least a year and expect at least three audits to solidify learning.
5. Market your program
Yep, marketing is for internal audit too. If the business doesn’t know what you do, how can they be interested in being a rotational auditor?
Tell the company what internal audit does. You can’t have a successful organization without letting people know what you do. The organization has to buy into the product of rotational auditing. So people can see what audit does and the value it adds to the company. To market, look for talent and talk to audit customers and others who may be interested. Keep a pulse on your own auditors – promote interest and sharing interest and finding passion.
Leadership support for movement to and from internal audit is essential to keep the program operating.
Your Chief Audit Executive can help acquire support from other executives. Even if the program is in the seedling stage, start the conversation inside and outside of internal audit. Keep the subject on the table regularly in meetings and ask for ideas and potentials.
Key takeaway: Get support from executives and talk to others about using rotational auditors.
Rotational audit can serve as an excellent talent pool and great experience for the rotational auditor. No matter what you do in business, you can focus on people to create powerful change. Enjoy the process of getting out of the audit box, training people to be good risk managers, and contributing to lasting change in the company.