It’s summer in the United States. Let’s have some lemonade and go fishing. We’ve all heard the maxim, “Give a person a fish and they’ll eat for a day, teach a person to fish and they’ll eat for a lifetime” (or something like that).
Many audit shops have steered their boats away from the gotcha waters and toward the consulting waters. As internal audit hones its brand of being an internal consulting agency, it may behoove the audit shop to teach (potential) managers in the company to fish. In other words, the auditors could just tell a company where their risk is, but it would be better to teach them how to understand and mitigate the risk on their own.
Paddling deeper into audit’s consulting waters, rotational auditing could provide this fishing venue for teaching risk awareness.
Rotational auditing has been a fishing hole for yearzzz. The pros and cons have been fished around too. And then fished around some more. Auditors have a way of fishing.
Let’s start with the bummer side. Authors in one peer-reviewed article in the CPA Journal concluded that audit shops that use a rotational model have lower internal audit quality and tend to have higher turnover and outsource more of the internal audit function. The synopsis continues:
“Lower internal audit quality and higher risk of inappropriate or aggressive financial reporting suggest that internal audit functions using the rotational model are, on average, less effective than those with career internal auditors.”
Their conclusions seem rather dismal as if rotational auditing isn’t a good idea at all.
But wait, there’s some more fishing to do. For every action, there’s an equal and opposite reaction.
If on paper, rotational auditing produces lower quality, why do companies continue to do it? Moreover, large, reputable companies – Nestle, United Airlines, Hewlett Packard – all seem to rotate auditors in and out in some measure.
The rotational audit game changer might be in the ratio. Too many rotational auditors without enough career auditors might damage the quality of the internal audit brand in your company.
With proportionate career auditors to rotational auditors, you could mitigate some of the cons that the above report points out. Even more, you can leverage the talents of professionals rotating in. This can improve audit techniques that jump the financial gap and move into other areas in a company that are audited: communications, cybersecurity, marketing, sales, and human resources.
If internal audit is supposed to be a consulting agency for the company, would it be beneficial for audit to dedicate a portion of their resources to educating the company on risk? Keep in mind we’re still talking about teaching a person to fish.
Some points to consider
An internal audit program that uses rotational auditors takes consulting to a different level. Rather than coming in and defining the symptom, it’s a forward-thinking program that teaches leaders within the organization to think like an auditor. In other words, leaders learn through experience how to consider risk and how to keep the company safe.
If the idea of teaching others to fish appeals to you, then a rotational program can be made more effective with a few points to consider. The following list summarizes points made in this article and this article.
Document clear processes. Are workpapers reviewed ahead of time? How much of what you do is verbal knowledge and how much is written? Is the auditing and reporting process clearly documented and used the way it is documented? If your audit shop’s processes are clear and documented, then a rotational auditor will receive clear expectations of what to do.
Plan for company size. Just like a large boat is calmer in heavy seas than a small boat, so is a large company with a large audit team able to buoy a small percentage of training rotational auditors. If your company is smaller, consider the audit plan and the types of rotational auditors that can help support rather than detract from the organizations listed on that audit plan.
Make sure your reputation is in tact. If your internal audit team has a solid reputation, the company will see the value in rotating their best employees through the program. “If the reputation of the internal audit group is shaky,” writes Richard Chambers, “there’s a risk that other departments might use internal audit more as a ‘dumping ground’ for borderline employees than as a source for developing talent.”
Garner executive support. As mentioned in the previous rotational audit article, it’s important to market the program and more, have executives truly interested in leveraging the rotational internal audit program to improve their management.
Improve perception. Companies that haven’t used rotational auditing in the past might need to tweak their perception. If management is second line of defense, and audit is third line, internal audit can strengthen the second line with a little deeper support.
Consider company culture. A rotational program may require a subtle shift in company culture or audit culture. Too often, auditors get stuck in a rut of controls and assessments and give little heed to development in others. Instead, begin to create a culture of improvement.
For Brad Ames, Internal Audit Director at Microfocus, you have to have the right type of culture to make a rotational program work.
“If you’re just trying to cover a hole in assignments, rotational auditors is never a good idea,” says Ames. “It has to be more about the development of the individual coming in. You have to have this concept of ‘relational auditors’ that are invested in the development of another person. So if your shop isn’t relational and is more project management, then you’re going to have a difficult problem with a rotational program.”
Companies leverage rotational audit programs for both seasoned executives as well as recent grads learning the ropes of the workforce. Improving both the company and internal audit, teaching a person to fish will keep your auditors busy throughout the summer season.
What do you think? How does your company use rotational auditing? What methods has your audit group used to help keep the company aware of risk?