What is Internal Auditing and its Value?

A brief introductory session on what internal auditing is and the value it can bring to an organization.

Is there a culture of risk?

The Institute of Internal Auditors recently asked me the question "Is there a culture of risk?" so I decided to share my view. My view is that there is a culture of risk within organizations. If we define culture as "a way of life - the behaviors, beliefs, and values that are passed along by communication and imitation from one generation to the next" and put it into an organizational context then we can assume the term "generation" refers to the hierarchial levels and parent/child relationships that exist within an organization. That said, we can reasonably conclude that an organizational Board of Directors with good governance practices and an ethical tone at the top will minimize the risky behavior that permeate through the organization. We need to be mindful that cultural beliefs and values have a tendency to dilute themselves as they pass from one generation to the next, however this is the opportunity for internal auditors to serve as the feedback mechanism to the Board to protect the organizational well-being. For those organizational Board of Directors with weak governance practices or who disregard strong ethical practices - they have already lost and will eventually become destroyed by the culture of risky behavior they have created.

Governance: A Year in Review

As I attended the 2009 year end National Association of Corporate Directors (NACD) Conference in Washington, DC and the Institute of Internal Auditors (IIA) Eastern Regional Conference in Philadelphia I found it very insightful to compare my mental notes on the Chief Audit Executive and Director view on Corproate Governance. I am discovering a common theme of challenges with Directors sharing personal values, which are an essential part to establishing the core values of an enterprise. Sharing personal values and ones principle belief system certainly can bring a sense of vulnerability that some people may find discerning, however if the enterprise truly wants to engrain core values into its culture, then the core values of the enterprise need to be a reflection of the personal values of its constituency, and not merely just a written code. While we continue to see the microscope on the corporate transparency of Board and Officer activities, we should also expect to see more focus on personal transparency within and amongst the Board Members and Officers themselves. The internal audit activity should recognize and consider this “Inner” transparency when assessing governance structures and processes, and promoting appropriate ethics and values within the organization. The most important lesson learned from my conference experiences is that it can't hurt to have more "humility" and less “pride” in the boardroom to foster an environment that welcomes honest, candid, and constructive dialogue. Board and Officers must be comfortable drawing and elaborating on their failures, equally if not more so then their successes, to be an effective risk manager and contributor to sound corporate governance.