INTERNAL AUDITORS AS CHANGE AGENTS: WHAT A DIFFERENCE A YEAR MAKES!

Abstract

It was evidenced in a multiple-case study that the pattern of interaction between Chief Audit Executives and Senior Management is a key determinant of Internal Audit effectiveness. There are notable differences among Internal Audit Functions. The effectiveness of Internal Audit is largely determined by “soft factors.” Therefore, where Senior Management, possibly pushed by the supervisory board or the owner himself, truly supports the Internal Audit Function and wants it to look at the right matters, its effectiveness will be fundamentally different from cases where the management and/or board is passive, and does not push the Internal Audit Function to become effective by unearthing matters they may not wish to be found. In the upper echelon of Management, interaction with the chief stakeholder/s typically happens frequently, in a timely manner, and the communication is geared toward problem-solving. The relationship is strongly based on shared goals, shared knowledge, and mutual respect. At the other end of this spectrum, interaction with the chief stakeholder/s happens in-frequently, is typically delayed, and the communication is rather geared toward finger-pointing. In this context, functional goals prevail, knowledge is preferably exclusive, and relations can be impaired by disrespect.

This article provides conceptual and practical insights into features within the more immediate control of the Chief Audit Executives, helping or hindering Internal Audit effectiveness. Self-perception and external perception can differ greatly. Positioning and communication are instrumental when identifying successful Internal Audit Functions; these make a fundamental difference as to whether the Internal Audit Function is positioned as police, servant, consultant, doctor or change agent. Practical insights then demonstrate what a difference a year makes. Guided by the change agent, the more effective Internal Audit Function can prove also with hard data that there are fewer overdue findings, that reports are delivered more swiftly, and quantum leaps of productivity can be achieved.

PROLOGUE 2024

Murdock (2024) beautifully delivers internal audit content via storytelling: the transformative journey from an underperforming Internal Audit Function (IAF) to a value adding, and respected service in the eyes of key stakeholders. There is much to learn from the fictitious “John Taylor” and his audit trail. There are many “John Taylor like IAF” out there in the real world.

This story is about me, about “Rainer Lenz,” this story tells about my real-life experience. This article originally written in September 2015 describes my first-year journey and reflections as Chief Internal Auditor, after assuming the role as Head of Internal Audit at Villeroy & Boch in May 2014. “To better understand the plurality in practice, we need to study the practice” (Lenz, 2013, p. 286). This is good advice, however, we hardly get insights into the real life of Internal Audit Functions for IAFs are literally INTERNAL.

This article is a case-study. My first assignment as Chief Internal Auditor lasted from 2007 to 2013. This is about my second assignment as Chief Internal Auditor, commencing 2014, and it is about my first year in the role. I view myself as a change agent, and this article underlines that one year can make a tremendous difference. If I can be a change agent, the encouraging message is that all Internal Auditors can be change agents. I am grateful to my coauthors, both part of my small IAF at Villeroy & Boch Group.

SELF-IMAGES OF INTERNAL AUDITORS: YOU HAVE A CHOICE

The literature on Internal Audit effectiveness indicates a significant disconnect between the “demand-side perspective,” - that is, the stakeholder’s expectations and perceptions – and the “supply-side perspective” – that is, self-assessments by internal auditors (Lenz & Hahn, 2015). Self-perception and external perception differ greatly (Diagram 1),¹ which can be attributed both in part to hubris on the part of internal auditors, and to a lack of understanding from management regarding the service Internal Audit actually provides.

Diagram 1. Self-perception and external perception differ greatly.

Narrowing this expectation gap increases the effectiveness of the Audit, as customers measure the perceived benefit in relation to the expected benefit.

Within organizations, Van Peursem (2004, 2005) regarded the role of Audit as enigmatic, meandering between the roles of watchdog and consultant. She reflects on the nature of the internal auditor’s role confusion, and alerts to the dangers of a “jack-of-all-trades” image of internal auditors. In this article I will reference metaphors and self-images used by internal auditors themselves. I will focus the analyses and reflections on what internal auditors control completely, that is, how they view and describe themselves. To find more out about the self-perception of internal auditors, I asked them: “If you were asked to write down a catchline to sum up your role as internal auditor in your organization, what would it be?” I posted that question in LinkedIn, in the official global group of the Institute of Internal Auditors (IIA) and obtained 141 comments within 6 months, between 17 March and 17 September 2010.

All self-images received are clustered into five groups acknowledging that “metaphors create insights. But they also distort. They have strengths. But they also have limitations. In creating ways of seeing they tend to create ways of not seeing” (Morgan, 2006). Thus, the clustering is normative. Some metaphors and self-images sow the seeds for non-acceptance of Audit and contribute to its marginalization within organizations. Others may be the base for disappointment in the eyes of stakeholders. Five clusters of self-images (Sarens et al., 2016) are distinguished (Diagram 2):

Diagram 2. Five clusters of self-images.

Negative self-images – as put by internal auditors themselves - like “An auditor is a watch dog and not a blood hound” may create distance and form the basis of non- acceptance (1. Police). Overly modest self-perceptions like “I am the one you want me to be” (2. Servant) and the use of self-evident and empty words like “Increase stakeholder value” (3. Consultant) can lead to marginalization in the eyes of the Audit stakeholder. Overly ambitious claims like “We are doctors” (4. Doctor) or “A modern day hero … ” provide the basis for disappointment as Audit then risks over- promising and under-delivering. Eventually, there are also original and helpful self- images (5. Change Agent) that point to positive characteristics and differences; helping to create a unique and sustainable identity and supporting Audit’s pursuit to become more effective (Sarens et al., 2016).

INTERNAL AUDIT AT VILLEROY & BOCH: WHAT A DIFFERENCE A YEAR MAKES!

Change Agent has been the leitmotif when assuming my new role as Head of Corporate Audit in Villeroy & Boch² in May 2014. Those who take a look at the then newly created Corporate Audit page on the intranet may well rub their eyes in disbelief. What people expect to see is an objective, sober page describing the purpose and aim of the department, along with a couple of contact persons. Instead, the reader is greeted by an eye-catching quote from ex-racing driver Mario Andretti: “If you think you’ve got everything under control, you’re not fast enough.”

But how might this quote apply to Corporate Audit? Internal auditing is not an end in itself; it is designed to safeguard the success of the business as a whole. The Audit Function’s main task at Villeroy & Boch is to identify problems and risks in our business processes, offering support to the various operative units and to assist the company in meeting its goals. When conducting internal audits, the Corporate Audit department also plays an advisory role. For example, we discuss together with the units where there could be improvement in cross departmental cooperation – between the various company divisions and headquarters or between headquarters and the subsidiaries.

“Cooperation” and “together” are words we often use when talking about Corporate Audit in action. Those who think the department distances itself from the rest of the company could not be more mistaken. The Internal Audit Function at Villeroy & Boch is part of the team. We pitch in – we do not just sit on the sidelines and watch. Ultimately, we are all working toward a common goal – we want to make Villeroy & Boch even more successful and play our part in increasing the value of the brand and the company.

It is the readiness to implement change which is first and foremost here. The reports written after each audit, grading the various “findings” in risk categories A to D (very high to low), serve merely as a resource. We are pragmatic. The measures are based on common sense, keeping in mind what is realistic. For this, we need business acumen and a flexible approach to how we think and what can be done – and that is exactly the approach by which we want our work to be judged.

The work of Corporate Audit does not end once the report has been sent; steps need to be taken to ensure that measures are carried out and improvements made. We remain in contact with the units we have audited, because our work only becomes meaningful once the recommended measures are implemented.

The guiding principles of the Internal Audit Function at Villeroy & Boch since May 2014 have been twofold:

1. We are performance oriented. We focus on the timely delivery of meaningful reports and improvements. Our reports and communication aim at improving our business practices and associated controls.

2. We are not the decision maker. We are not the one that will ultimately change things; we can only inspire people to change. That requires a healthy level of modesty; asking questions rather than assuming expertise; being open-minded and respectful regarding the organization; and acknowledging that we are just one part of the organization, requiring the rest of the organization in order to succeed.

The units which have been audited respond to this pragmatic and active approach positively, as the latest feedback reports show. Also, hard data support the heightened effectiveness when comparing the situation upon assuming the role as Head of Corporate Audit in May 2014, and approximately one year later (Diagram 3):

Diagram 3. What a difference a year makes!

New processes and a cooperative and pragmatic approach have helped improve business practices and associated controls. The dialogue with Senior Management intensified resulting, for example, in an increase in ad-hoc requests and assuming project lead responsibilities. The heightened goodwill in the organization evidenced by positive customer satisfaction surveys has enabled the implementation of suggested actions. Further, computer assisted auditing techniques - especially Process Mining - have been instrumental when increasing the effectiveness of the Internal Audit service rendered.

While upon arrival most findings were overdue, this is now the exception to the rule. Delivery time of reports has been shortened from 8 weeks to less than 10 days. The productivity per full-time-employee (FTE) went up by 33%, from six reports per FTE p.a. to eight reports per FTE p.a.; that is equivalent to one FTE. Most importantly, the improved acceptance and effectiveness of the Internal Audit Function was grounded in an overhaul of the overall positioning of the Function. We now have open access to Senior Management. Information flow freely in both directions; peers and clients perceive the Function now as “Guide,” “Protectors,” and “Change Agents,” rather than as “watchdog” and “police.”

CONCLUSION

Internal Audit is at a crossroads (IIA, 2013). The Internal Audit value proposition is still not commonly appreciated since having organizational relevance is still regarded a top challenge. The value of Internal Audit is questioned by many: the study by Ernst and Young (2012) revealed that the majority of Audit stakeholders - that is, CEOs, CFOs, Audit Committee Chairs and members - believe that Internal Audit is not helping their organization achieve its business objectives, and that about 80% of Internal Audit Functions have room for improvement, which is now expected urgently by most. Otherwise, as the study by PWC (2013) pointed out, “internal audit runs the risk of becoming a marginalized function”.

To become and remain a key player in the governance arena, the identity of the Internal Audit Function matters. There is a huge difference between positioning the Function as POLICE or as CHANGE AGENT, whilst acknowledging that the Function in practice may have elements of both. The more promising path as evidenced in the case study in Section 3 represents the positioning of internal auditors as change agents. Internal Audit is a support function, not connected directly to the profit and loss account. The case study presented demonstrates what a difference a year makes when internal auditors become more humble. Becoming agents of change is the (new) leitmotif of the IIA (2014): “To be effective, internal auditors must possess not only sound judgment and critical thinking, they must inspire (I suggest saying “inspire” instead of “compel” as in the original statement from the IIA) others to an appropriate and sometimes urgent response (…)”.

The claim that Chief Audit Executives and internal auditors shall become change agents is aspirational now for most Internal Audit Functions. Internal Audit agency presently is a rare phenomenon in practice. It is not the stereotypical model – yet - that internal auditors emerge as agents, who challenge the status quo and initiate to alter “the way we do things” in an organization. However, internal auditors may become change agents on a much greater scale. In doing so, the stereotypical model may transform from being reactive; responding, and seeking to meet others’ expectations, to being an agent who drives change. A change agent breaks with institutionalized practices and contributes to establishing a new pattern. That requires particular personal characteristics and competencies in, among others; liaising successfully with clients, Senior Management and the board or audit committee; business acumen; leadership and communication skills; listening and influencing skills; and relationship acumen. When seeking to make a difference, and create a unique and sustainable identity, inspiring others to change may become the avenue of success.

The analysis of how internal auditors view themselves partly explains why some Internal Audit Functions are on a route to marginalization and disappointment, while others embark on a more promising path creating a positive, unique, and sustainable identity. When getting the positioning right, helped by excellent communication, the expectation gap may be narrowed. Improved relations with key stakeholders and strong “soft skills” increase the chance that hard data can evidence the boosted level of Internal Audit effectiveness, including fewer overdue findings and higher productivity.

This article shows that some shortcomings and limitations of Internal Audit Functions are self-inflicted. The self-perception of internal auditors often carries negative self-images (Police) that create distance and form the basis of non-acceptance. Overly modest self-perception (Servant) and the use of self-evident and empty words (Consultant) display a lack of identity and may lead to marginalization in the eyes of the stakeholder. Overly ambitious “superman-like” claims provide the basis for disappointment in the eyes of stakeholders, as Internal Audit over-promises and under-delivers (Doctor).

Ultimately, the internal auditor has no formal mandate; they are a “leader with no title” (Sharma, 2010). When acknowledging that, inspiring others to change may be the more promising path when emerging as agents of change. Possibly, internal auditors as change agents need to be more like farmers. Like farmers, internal auditors have little or no formal authority. Farmers work indirectly, they sow the seeds. They acknowledge that they only can work and be indirectly effective since plants grow themselves when conditions are favorable, and chickens lay eggs (or may not do so when it is too cold). Similarly, internal auditors are not the decision maker. Internal auditors do not change processes or people by themselves but can rather inspire people to change.

To resolve the dilemma between self-perception and external perception in order to best position the Internal Audit Function, ask yourself:

• What would Senior Management (the C-suite) say about you and your team?

• What would the Board (Audit Committee, Non-Executive Directors) say about you and your team?

• What role does your Internal Audit team play now?

• What role will you choose in the future?

You have the choice.

EPILOGUE 2024

Notably, the conclusions (from 2015) are still current. In 2024, about ten years on, internal audit is still exposed to becoming a marginalized function. I look forward to the leads and actions stemming from the Institute of Internal Auditors Vision 2035 project.³

As my contribution to the Vision 2035 project, I am suggesting “The Gardener of Governance: Our nature is Nurture” (Lenz & Jeppesen, 2022; Lenz & O’Regan, 2024) as mantra, as leitmotif for the effective internal auditor. That mantra has been enjoying increasing popularity. The strong traction is evidenced by an amazing and growing readership and 25+ translations.

While writing the prologue and the epilogue to this article from 2015, I also asked ChatGPT: What are the pros and cons when positioning internal auditors as “The Gardener of Governance: Our nature is Nurture“? ChatGPT responded rapidly, saying:

“Positioning internal auditors as “The Gardener of Governance: Our nature is Nurture” can have both pros and cons:

**Pros:**

1. **Positive Perception:** The metaphor portrays internal auditors as caretakers, promoting a positive image of their role in nurturing good governance within an organization.

2. **Collaboration:** It emphasizes collaboration and partnership with management rather than a confrontational approach, which can lead to better working relationships.

3. **Long-Term Focus:** “Nurturing” implies a long-term perspective, encouraging auditors to consider the sustainability and health of the organization over time.

4. **Preventative Approach:** Just as gardeners act to prevent plant issues, auditors can focus on identifying and preventing governance and compliance issues before they become major problems.

**Cons:**

1. **Perceived Softness:** Some may perceive the metaphor as softening the role of auditors, potentially diminishing their ability to take a firm stance when needed.

2. **Lack of Independence:** It could be argued that the term implies a close relationship with management, raising concerns about auditor independence.

3. **Ambiguity:** The metaphor might be open to interpretation and not convey the precise nature of the auditor’s role, potentially leading to misunderstandings.

4. **Risk of Complacency:** If not balanced properly, a nurturing approach could lead to complacency in addressing serious governance issues.

In conclusion, positioning internal auditors as “Gardeners of Governance” can be a valuable way to emphasize collaboration and a long-term perspective, but it should be used carefully to maintain the core principles of objectivity, independence, and effectiveness in their role.

I hope this article serves as further contribution to the proposition that “The Gardener of Governance: Our nature is Nurture” might be a promising guide when considering where and how to position internal audit in an organization. The arguments in favor are substantial. Contra arguments deserve further discussion which is not the purpose of this article.

Since entering the internal audit profession in 2007, my perspective on internal audit has evolved over time. I qualified as Certified Internal Auditor in 2009, then in 2013 I was awarded PhD for my work, done in parallel to my full-time job, about the effectiveness of internal audit. While my PhD is critical of the internal audit value proposition, as helpful metaphor, the GARDENER mantra and leitmotif is a development of my earlier “farmer” version.

After a career in CFO type of roles, since 2007 I have experience as Chief Audit Executive, heading a small team in three different but always industrial organizations with a global footprint. Since 2007, I have conducted 300+ internal audits in 50+ countries.

From 2007 to 2013, my first engagement as Chief Internal Auditor was with the pharmaceutical company Actavis until it was sold to Watson for USD 5.5 billion. From 2014 to 2018, I was Chief Audit Executive (CAE) at Villeroy & Boch. This article (originally written in September 2015) describes my first 12 months in that role. Even though my experience is about ten years old, such insights can still be helpful to practicing peers for they are real experiences, not fictitious. Since 2018 I have been CAE at SAF-HOLLAND, a EUR 2 billion supplier to the global commercial vehicle industry.

To close, I asked myself what final thought I might share with my professional peers. Here it is, my two cents, one might say: I consider internal audit to be an enabler of learning and change (a characteristic of The Gardener of Governance). I have been applying that philosophy for years, and it has served the purpose well, so I invite the reader to do likewise.

According to Scharmer (2009), there are four barriers of learning and change: (1) NOT TO SEE WHAT WE DO, (2) NOT TO RECOGNIZE WHAT WE SEE, (3) NOT TO SAY WHAT WE THINK, and (4) NOT TO DO WHAT WE SAY.

As I explain below, internal audit aims at overcoming those barriers (Diagram 4).

1. First, we SEE WHAT WE DO: Internal audit first sees and appreciates what we (the company) do (does). Internal audit is well placed via, for example, talk-through and document-based walk-through to view what actually is happening, not what SHOULD be happening. Data analytics and digital auditing are increasing aids to this. We are always appreciative of the work under review. We act always with utmost respect. We treat people with kindness.

2. In doing so, we RECOGNIZE WHAT WE SEE: We put things into perspective, we compare observed practices with applicable laws and/or company (internal) standards and/or best practices. Benefitting from Process Mining and/or digital auditing tools, we analyze, summarize, synthesize big data to unearth patterns in the digital traces in our ERP systems.

3. When crafting our report, we SAY WHAT WE THINK: We verbalize what we think must be said, thereby pointing out control weaknesses and/or unexploited performance potential. At the end of our field work, in the closing meeting while on site, when it is typically discussed in detail with the audit client and local senior management, the written audit report is the typical vehicle for doing that. In case management wishes to add a commentary to our recommendation we offer separate space underneath each relevant finding.

4. Eventually, we regard our report as a sort of contract with management. We expect timely closure. We follow-up on the issue to ensure that we as a company DO WHAT WE SAY. We trigger management action, with the aim of remediating and improving things, but we cannot act on behalf of the key process owners themselves, as we have no operational responsibility.

Diagram 4. Internal audit as enabler of learning and change.

I often use this audit cycle as an introduction in the opening meeting. It has served me well. You have the choice how you wish to position your internal audit function. I look forward to further discussions with professional peers and oversight bodies.

Vision 2035: I eagerly await what vision will become reality in 2035.

We can do better. We can do more. We can be enablers of learning and change. I suggest “The Gardener of Governance: Our nature is Nurture” as helpful guide.

You have the choice.

Let us see where the profession is going.

Acknowledgments

Rainer thanks his co-workers at Villeroy & Boch Group for their support. As token of appreciation, he invited his former team members as co-authors: Oliver Karmann and Jens Druckenmueller. Performing as agent of change is a team sport. #StrongerTogether

We thank David Jackson for proofreading our manuscript.

We thank Dan Swanson, the Managing Editor of EDPACS, for the invitation and the opportunity.

The authors thank David Hill, CEO at SWAP Internal Audit Services (https://www.swapaudit.co.uk/), for funding OPEN ACCESS.

Disclosure statement

No potential conflict of interest was reported by the author(s).

Additional information

Notes on contributors

Rainer Lenz

Dr. Rainer Lenz is a seasoned finance and corporate audit professional with 30+ years of international experience as Regional/Divisional CFO and Chief Audit Executive in global organizations. Since 2018, Chief Internal Auditor at SAF-HOLLAND Group. PhD in Economics and Management Science from the Louvain School of Management in Belgium. Teaching Governance and Internal Auditing at the Johannes Gutenberg University Mainz (Germany). Awardee (5×) as Global Internal Audit Thought Leader (by Richard Chambers). Winner of the Global IIA’s 2023 Bradford Cadmus Memorial Award. Author of a series of articles in peer reviewed journals (h-index of 12).

Oliver Karmann

Oliver Karmann, M.Sc., is a seasoned Senior Manager with a proven track-record in internal audit, and finance and Customer Service matters. Experienced in working with luxury and industrial brands in an international environment. Since 2016 with J. Wagner GmbH, first as Group Vice President Head of Internal Audit, and since 20202 as VP of Finance and Customer Service. His educational background includes a Master of Science degree in Business Administration and Law from the University of Saarland. While being a student, Karmann has also contributed to academia as a student research assistant at the University of Saarland’s Chair of Banking and Finance (Prof. Dr. Waschbusch).

Jens Druckenmueller

Jens Druckenmueller, LL.M., is an experienced finance and internal audit professional currently serving as Regional CFO at Villeroy & Boch Luxembourg and as a Board Member of a subsidiary within the Villeroy & Boch Group. His educational background includes degrees in Economics and Business Administration from the University of Konstanz and the University of Saarland, culminating with a Master of Laws in European and International Law from the Europa-Institute at the University of Saarland. Throughout his career, Druckenmueller has also contributed to academia as a research assistant at the University of Saarland’s Chair of Banking and Finance. He has authored several publications in the field of finance and speaks at conferences focusing on internal audit.

Notes

1. Independent Audit Limited (http://www.independentaudit.com) gave their consent for using the diagram, ref. PhD-thesis (Lenz, 2013), “Looking good - I’ll sail through the self-assessment”

2. As of May 2014, Villeroy & Boch employed a workforce of around 7,300. The consolidated sales for 2014 reached €766 million. Villeroy & Boch is represented in 125 countries around the world and has 14 production facilities in Europe, Mexico, and Thailand (http://www.villeroyboch-group.com/en/the-company.html).

3. Accessed online on 20 April 2024: https://www.theiia.org/en/internal-audit-foundation/latest-research-and-products/ia-2035-project/ “The Internal Audit Foundation has embarked on a groundbreaking initiative called, Internal Audit: Vision 2035 – Creating Our Future Together. This project is designed to envision the future state of the Internal Audit profession and chart the steps necessary to make that future a reality.”