Governance & Internal Audit Evolution: Rules or Principles?

My view is that the voluntary adoption, disclosure, and enforcement of self-guided principles are the solution to restoring good governance and internal audit activities within our U.S. Free Enterprise System. Rule-based systems, while often well-intended, are generally designed to be negative reinforcement systems, often are prone to “loop-holes,” exploitation, and have bad consequence (i.e. punishment or penalization) As internal auditors, we know that recognizing “deficiencies,” and in some case “failure” are often what create the opportunities for organizational betterment. Principle-based systems are generally designed to be positive reinforcement systems, are less prone to exploitation because it encourages transparency and reasoning for actions, and have good consequence (i.e. commendation, recognition, and reward.) Public trust and confidence can be restored when organizations can publicly declare “Here is what we do, here is why we do it, here are the reasons we believe it is the right thing to do, and here is how we are going to show it to you” – this is the essence of good principle-based systems.  To say we are “compliant” with a rule-based system does not always meet the “intent” of the rule.

As an example, consider this – A father, Jack, tells his daughter, Jane, to be home at 10pm because she has school tomorrow. Jane goes home for her 10pm curfew, then she sneaks back-out until 2:30 AM. In the morning, while having breakfast with her parents Jane declares “I was home a few minutes before 10pm last night,” in response to her father’s question “What time did you get home last night?” By all counts Jane followed the rule – didn’t she? Is it human nature to find the “loop-hole” in the rules? How do you think the scenario outcome would change if that evening Jack told Jane “Be home to make sure you’re well rested for school tomorrow,” and then in the morning asked her “How much rest did you get last night Jane?”  While a simple example, hopefully this shares my thought process on the potential and power of the “principle” and the inherent weakness of the “rule.”

We must also ask ourselves where the role of Ethics and Integrity plays in the rule-based and principle-based systems.  An industry colleague, Dan Smith, brought up a great point that principle-based systems "Overtime, without proper safeguards or directives at a social and moral level can collapse in corruption." My view is that as we evolve, for the better, we will see the emergence of ethics committees in organizations that will become the "transparent" and most "trusted" voice to the community and public stakeholders. While the U.S. has its own recognized design flaws and operational deficiencies. However, the design and operation of the 9-member Supreme Court system has continually exemplified integrity, diversity, and thoughtful governance to our Democratic, Capitalist, and Free Society.

With respects to the emergent ethics committee, organizational stakeholders should look to the U.S. Supreme court as a framework for the conceptual design of internal adjudication processes that will serve as the necessary "social and moral" safeguard in which Dan has so diligently observed as necessary to prevent the erosion of integrity that results in corruption.

Governance: A Year in Review

As I attended the 2009 year end National Association of Corporate Directors (NACD) Conference in Washington, DC and the Institute of Internal Auditors (IIA) Eastern Regional Conference in Philadelphia I found it very insightful to compare my mental notes on the Chief Audit Executive and Director view on Corproate Governance. I am discovering a common theme of challenges with Directors sharing personal values, which are an essential part to establishing the core values of an enterprise. Sharing personal values and ones principle belief system certainly can bring a sense of vulnerability that some people may find discerning, however if the enterprise truly wants to engrain core values into its culture, then the core values of the enterprise need to be a reflection of the personal values of its constituency, and not merely just a written code. While we continue to see the microscope on the corporate transparency of Board and Officer activities, we should also expect to see more focus on personal transparency within and amongst the Board Members and Officers themselves. The internal audit activity should recognize and consider this “Inner” transparency when assessing governance structures and processes, and promoting appropriate ethics and values within the organization. The most important lesson learned from my conference experiences is that it can't hurt to have more "humility" and less “pride” in the boardroom to foster an environment that welcomes honest, candid, and constructive dialogue. Board and Officers must be comfortable drawing and elaborating on their failures, equally if not more so then their successes, to be an effective risk manager and contributor to sound corporate governance.