THE FUTURE OF INTERNAL AUDITING: GARDENER OF GOVERNANCE

Abstract

Internal Auditing is a profession at crossroads. On the micro level, in organizations and institutions, stakeholders may see less and less value in the contributions from internal auditing and on a macro level, this projection jeopardizes the legitimacy and relevance of internal auditing as a profession. The good and bad news is that the future is uncertain. This article suggests five main fields of action and focus for the IIA Global – The Institute of Internal Auditors, its local chapters, internal auditors and academia that will determine the future role of internal auditing, its legitimacy, its relevance and its organizational and societal significance. The purpose of this article is to provide comprehensive content suggesting five concrete paths for the betterment of internal auditing. The five directions that deserve development are planet, public, profession, prosperity and people. Ultimately, positioning internal auditing as Gardener of Governance is a promising metaphor to strengthen its value proposition, both on a micro and on a macro level. Metaphors are an important way to convey ideas and make ideas stick.

INTRODUCTION

The IIA Nordic chapters celebrated their 70th anniversary¹ on 8th October 2021. The IIA President & CEO Anthony Pugliese was the key-note speaker that day, speaking about the profession and the Institute going forward. The first co-author of this article, Dr. Rainer Lenz, was invited to speak that day about The Future of Internal Auditing. The presentation was provided online to about 250 attendees from the IIA chapters in Denmark, Finland, Iceland, Norway and Sweden. There was plenty of positive feedback including “very inspiring messages”, “thought provoking”, “brilliant presentation”, “I loved the quotes and analogies you used and the personal touch you gave it”, “comprehensive content” and so forth and the feedback signaled an appreciation of the metaphor suggested: “Gardener of Governance”. Rainer happily accepted the invitation by the managing editor of the EDPACS journal, Dan Swanson, to summarize the key messages of the presentation in this article, in close cooperation with his co-author, Professor Kim K. Jeppesen from the Copenhagen Business School.

According to the World Economic Forum Report “The Future of Jobs” from 20 October 2020,² Accounting and Auditing are at No. 4 on the list of jobs with decreasing demand. While the future obviously is uncertain, judging from reports such as this, the outlook is not so promising and time is ripe for considering what the internal auditing profession can do about it. While The Future of Internal Auditing could easily be the topic for an entire book, Rainer had only 25 minutes that day.³ In this article we will share and elaborate on our perspective on what we believe the internal audit profession should focus on to make itself more relevant and more impactful in the future. We see five main paths, five main fields of action. We call these the 5Ps: Planet, Prosperity, Public, Profession and People.

In the remainder of the article, we will discuss each of the 5Ps in more detail, and we provide a suggestion for a ‘leitmotif’ for internal auditing as the ‘gardener of governance’. We add suggestions on how to make the ideas stick and we conclude with a call to action.

Before we discuss the 5Ps, we will take a brief look at the megatrends in society, which will frame our 5P model.

MEGATRENDS IN SOCIETY

Internal Audit (IA) is embedded in society and therefore megatrends in society⁴ will affect the future of IA. The German Zukunftsinstitut (2021) suggests that the following megatrends will shape society in the coming decades (the list is not exhaustive):

1. Digitalization: Increased digitalization of all spheres of society;

2. Sustainability: Greater focus on the sustainability of the way we organize society;

3. Gender Shift: Gender may increasingly lose its conventional social relevance;

4. Health: Increased focus on health, physically as well as mentally;

5. New Work: People seeking purpose in what they do;

6. Individualism: Diminished sense of affiliation with broad societal groups;

7. Globalization: The world becomes increasingly closer connected;

8. Mobility: Innovative value propositions of traveling;

9. Safety: As the risks in the world increases, so does the need for safety;

10. Silver Society: The population will age in many parts of the world;

11. Knowledge Culture: Information becomes ubiquitous, knowledge becomes permanently accessible;

12. Urbanization: More and more people live in or around major cities.

Some megatrends in society may matter more to the world of internal auditing, some less. Some may matter sooner, some later. The megatrends will shape the development of society and to stay relevant, internal auditing must consider these trends and find ways to address them.

Regarding Digitalization, there has been substantial interest in audit data analytics in internal audit practice and research over the last decade (Bierstaker et al., 2014; Chartered Institute of Internal Auditors, 2017; Mahzan & Lymer, 2014). IA is in a better position to exploit Audit Data Analytics (ADA⁵) than external audit because IA is more familiar with the company’s systems and has easier access to data. IA is also better positioned than External Audit (EA) to embrace continuous auditing. However, extant research shows that IA does little to adopt ADA, in particular newer techniques such as data mining or process mining. For example, Lenz (2017a), summarizes that Process Mining has the potential to revolutionize internal audit. The credo in this article from 2017 is to let the data speak to drive learning and change. With Process Mining, auditors can now better see through the mountain of data so that it can be converted into actionable information. Process Mining helps to fully understand what is going on and work in a faster and more focused manner.

Process Mining collects data from a company’s IT systems, often heterogeneous, to reconstruct, visualize and analyze processes in real time. This helps auditors to see and understand how the company de facto operates to find non-conformant deviations when compared with the standard and assess their impact. In other words, auditors get a deep understanding of how the process is working and compare that with how the company should be operating for maximum efficiency and productivity. In an audit, it is all about achieving clarity thus providing transparency. Auditors need to understand the patterns in processes. By using Process Mining, nobody needs to second-guess and speculate anymore – the data is speaking right in front of you.⁶ Process Mining is one example illustrating how internal auditors can benefit from digitalization in the work they do.

Regarding Sustainability, all sensible minds have realized by now that our planet is at risk. The United Nations (2015) report on “Transforming our world: the 2030 Agenda for Sustainable Development” from 21 October 2015⁷ may serve as prime reference in the context of this article. The contemporary press all around the globe is full of articles about climate change, for example, droughts, heat waves, melting glaciers and polar ice caps, and flooding. Climate change has a pervasive impact on many industries and companies will increasingly need to adapt their strategy and operations to become sustainable. Internal audit functions will need to adapt to this reality.

The other megatrends referenced above affect internal auditing, too, but in our opinion not as eminent as these two. The megatrend Gender shift points to the pattern that gender may increasingly lose its conventional social relevance. This implies identity shifts. Soon, there may be more women in senior leadership positions, possibly initially helped by quota. Having more women in audit leadership positions may be an avenue to further strengthening the value proposition of internal auditing, viewing diversity as an asset. The megatrends New Work and Individualism have already started to change the labour market, as traditional employees are substituted with contracted self-employed persons like Uber drivers or Wolt delivery persons. Could we see something similar happening in IA in the future on a much larger scale, i.e., hiring individual and independently operating auditors for ad hoc assignments in internal audit? It certainly would provide opportunities for hiring some of the specialised expertise needed in IA to adapt to megatrends such as Digitalization and Sustainability. The megatrend Safety is also of importance for IA. As risk in the world increases, so does the need for safety. As assurance providers, IA may provide assurance that risks are managed properly and in a consulting role, IA may educate and advise on how to manage risks to provide safety. So, the need for more safety is an opportunity for IA, but it will inevitably bring IA into turf battles with other professions. To win these battles, IA needs to build a relevant knowledge base and be able to explain its value proposition in clear terms.

The COVID-19 crisis may affect and counterbalance some of the aforementioned megatrends. The German philosopher Gabriel (2020) views COVID-19 as a watershed event. He regards COVID-19 as an historical caesura, seen in combination with climate catastrophe and overstrained financial systems. In his perspective, the world with COVID-19 and post-COVID-19 will no longer be the same.⁸ Gabriel (2020, p. 338) suggests deeper and more transdisciplinary reflection to better meet the challenges of the 21st century. In that regard, internal audit research would benefit from innovative research strategies, probing new theories and benefitting from cross-fertilization with other research streams.

The global climate challenge is a fact. The United Nations (UN)⁹ seeks to “unite the world to tackle climate change”: the UN orchestrates efforts to limit global warming to 1.5°C above pre-industrial levels. Ridley’s recent blog “On the Frontlines: Internal Audit’s Role in ESG” (Ridley, 2021) is right on point. His considerations and subsequent interaction with him in July 2021 served as rich inspiration for the presentation in October 2021 and this article. Ridley (2021) builds on the aforementioned megatrend Sustainability when demanding that “all internal auditors should be contributing to the global achievement of the United Nations’ (UN’s) 2015 sustainable development goals. Auditors’ scope, assurance, consulting and practices should all be working toward accomplishing each of the 17 U.N. goals for environmental, social and governance (ESG).” That points straight to three Ps of our suggested 5P model: People, Planet and Prosperity. We add two further Ps: Public and Profession.

THE 5PS

These are the five main fields of action and focus for the internal audit profession and academia that we believe will determine the future role of internal auditing, its legitimacy, its relevance and its organizational and societal significance. We call these the 5Ps.

Hence, the five Ps of our comprehensive model are: Planet, Public, Profession, Prosperity, and People. We comment briefly:

1. Planet: No planet, no (internal) audit. There is no plan(et) B. Environment, Social and Governance (ESG) are vital, literally speaking and IA has a role to play in this.

2. Public: No third-party appreciation, no (internal) audit. In other words, no customer - no audit. Self-assessments of internal auditors are biased and are of very little value. To gain acceptance, relevance and heighten impact, the stakeholders of internal auditors must see and appreciate the service rendered.

3. Profession: No Unique Selling Proposition, no USP, no “heartland”, no (internal) audit, ultimately. The internal audit profession still lacks its commonly shared core. With that hazy value proposition, the internal audit profession is constantly at risk of overpromising and underdelivering, risking being viewed as “jack of all trades” and “master of none”.¹⁰

4. Prosperity: No business, no (internal) audit. Internal audit must find ways to contribute to the overall value proposition of the private organization or public institution it serves.

5. People: People make all the difference. People apply technologies. Internal auditors are no robots. Neither are their peers and clients. Business is about people working together.¹¹

We will discuss each of the five Ps in more depth in the following chapters.

Planet

ESG is no longer a “nice to have.” The challenge is real and will not disappear even if ignored by some. ESG becomes a question of “Do or Die” for society, for companies and for internal auditors.

ESG measurements have become formally embedded into decision-making by investors and by private equity firms.¹² Many private equity firms sign up to the UN Principles for Responsible Investment (UNPRI): Over USD 100 trillion of assets are under management and over 3,000 asset managers have now signed up to those principles. Furthermore, the EU has recently decided to make ESG disclosure mandatory in order to channel investments towards sustainable activities.

Internal auditors need to critically ask themselves whether internal audit has satisfactorily staked a claim in the ESG debate. We do not think so, for we have little evidence to support that. Regarding environment, ten years ago, Ridley et al. (2011) concluded that internal audit has not provided due independent assurance to stakeholders about the reporting of sustainability policies, practices and measures. The authors view internal auditing as having the potential to do so, but internal auditing has not sufficiently been promoted globally in this role. Ten years on, there is an increasing number of scholars who write about internal audit and sustainability. However, DeSimone et al. (2021), for example, still see limited relevance in practice when concluding “while an increasing number of organizations are engaging in sustainability activities, assurance of these activities is relatively new.”

More and better is needed – to become and stay relevant. The E in ESG is directly related to the climate change threat, which is already impacting companies’ strategic decisions and will increasingly do so in the future. There is a clear need for internal auditors to become prominent and respected players providing due assurance to management on strategic and operational environmental goals. While there are cases where internal auditing is doing just that, however, the overall profession is generally missing out on the opportunity, perhaps because the E is missing in internal auditing’s mission statement:

“The mission of Internal Audit is to provide an independent, objective assurance and consulting activity designed to add value and improve the organization’s operations. Internal Audit aims to help the organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes.”¹³

We believe that it is time the IIA Global – The Institute of Internal Auditors considers the Environment in its mission statement, in the other parts of the IPPF and in reports and other supportive materials.

The S in ESG, social, is also relevant for IA. The New Work megatrend implies that in the future, a company’s legitimacy will depend on more than just profits. A company will need to show how it contributes with broader value to society to attract investments and talented employees. This overall company branding is a strategic and operational task, where management will need assurance that its objectives are met, and its external reporting is correct. IA is well positioned to provide such assurance, yet relatively little is done in this area.

Finally, regarding the G in ESG, governance, has for a long time been core as to what internal audit should be about. Lenz (2013) concludes “while the IIA claims that IA is a pillar of corporate governance, some of its key stakeholders question its value. There is some tension between the value IA believes it is rendering and that perceived by some of its customers.” Lenz (2013) defines internal audit effectiveness as a “risk-based concept that helps the organization to achieve its objectives by positively influencing the quality of corporate governance”. Almost ten years on, we still view positively influencing the quality of corporate governance, as a promising path for anchoring the value proposition of internal audit.

Internal audit has the potential to render more added value in the arena of governance. Laura Spira, Emeritus Professor of Corporate Governance at Oxford Brookes University, fully concurs when concluding in July 2021: “The G part is rarely addressed and that’s where Internal Auditing should be important”¹⁴ in practice. We are in full agreement with that conclusion.

To conclude, we believe that ESG has great potential for IA to provide value to business and society, or to put it theoretically, to be the professional jurisdiction (Abbott, 1988) or heartland for internal auditing, providing the basis for recognition by society while simultaneously differentiating IA from external auditing.

Public

There are micro- and macro-factors impacting the effectiveness of internal auditing.¹⁵ The micro factors include the organization, internal audit resources, processes and relationships. While Lenz (2013) emphasizes the superiority of micro factors, especially the relationships of internal audit with key stakeholders, namely senior management and the board, macro factors matter, too.

Lenz and Hahn (2015) reference normative, mimetic and coercive forces as macro factors:

• Normative forces show their impact through the degree of conformance with the International Professional Practices Framework (IPPF) as provided by the IIA (2017).

• Mimetic forces refer to the phenomenon that organizations tend to model themselves after similar types of organizations that are considered successful and legitimate.

• Coercive forces are related to the compliance with laws, standards and other binding regulations.

Other IA research based on institutional theory show how these forces shape IA. For instance, Arena et al. (2006) and Arena and Jeppesen (2010) show how the regulatory context (coercive force) can have a strong influence on the development of IA and scholars like Brierley et al. (2001) and El-Sayed Ebaid (2011) argue that IA could gain legitimacy by adapting coercive force.

Regulation can be instrumental in heightening the legitimacy of internal audit, especially in less mature contexts. At present, regulators generally do not demand and enforce an effective internal audit function, not even for listed companies. However, there are exceptions. The New York Stock Exchange (NYSE) listing rules mandate the presence of an internal audit function (NYSE Section 303A.07), the size and nature of that function are not specified, and the NYSE does not address its effectiveness.¹⁶ Similarly, in Denmark, internal audit functions are mandatory in banks with more than 125 employees, but the function’s resources is left for the Board to decide. Consequently, it is very common to have internal audit functions consisting of one person, a clear sign that the board has an internal audit function to comply with regulation, rather than for the value it may add to the company.

Thus, while regulation demanding internal audit functions as a must-have in (certain types of) organizations may enhance internal auditing’s legitimacy, boards will also need to understand the value an IA function can deliver, if regulation is to matter. Accordingly, we suggest that,

1. Regulators do not understand how internal audit is of value to society.

2. Regulators do not understand the variety of work internal audit does according to the IIA definition.

3. Board members do not understand how internal audit may add value to their company.

To promote internal auditing, we believe it is crucial to influence regulators and boards alike, heightening awareness and appreciation of internal auditing’s value proposition.

In that context, we congratulate the IIA Austria¹⁷ for their first ever press conference on September 29, 2021. An example we would encourage other IIA chapters to follow, too. The IIA Austria presented the results of a survey with 326 participants, thereof 126 decision makers, CEO, C-Level Executives:

• One of the surprising outcomes was that 26% of these decision makers do not see the value of what internal audit does, even worse, they have no idea what internal audit does.

• Another striking point was that 75% of the participants suggest making internal audit mandatory in certain types of organizations (depending on size etc.)

Both survey results solidify our hypotheses that many stakeholders do not see the value in internal audit and do not understand what internal audit does.

Thus, the internal audit profession needs to continue and improve the advocacy work already done by IIA’s many chapters, so that the main stakeholders better understand internal auditing’s value proposition. In particular, stakeholders need to understand how internal auditing differs from external auditing. Such an understanding is a precondition for the promotion of internal auditing and of IIA’s International Professional Practices Framework, and thus also a precondition for claims that an internal auditing function should be mandatory.

After the presentation on 8th October 2021, Norman Marks¹⁸ reflected upon the question of why internal audit is generally not mandated by regulators. In his view it is because internal audit is “not focused only on preventing errors and fraud - and that is a good thing,” he adds while continuing “the regulators are focused on protecting investors’ money not in enhancing it.” We agree and note that in many cases where internal audit have been made mandatory, regulators have insisted that internal audit work in tandem with external audit, either by focusing on financial auditing or by auditing internal controls of direct relevance for the financial reporting process. However, the consequence of this is that internal audit become subordinated to external audit like nurses to doctors (Arena and Jeppesen, 2010). In this scenario, external audit will have full control over internal audit’s work and knowledge base and internal audit will find it difficult to professionalize on equal terms with external audit. Furthermore, there is no consensus in the internal audit community and among internal audit practitioners about the appropriate focus of internal auditing. Internal auditing means different things to different people at different times. There is a huge spread of practices in the world of internal auditing. Some internal audit functions may rightfully consider themselves world-class whereas others do not apply basic practices and do not have essential pillars in place (Lenz et al., 2014).

The IIA definition of internal audit is broad and designed to encompass a diversity of practices, but this diversity is exactly what makes it difficult to promote internal audit in relation to regulators and key stakeholders such as boards. However, to narrow down the definition would interfere with the way many IA functions seek to deliver value to their organizations and cause internal disagreements within the profession. Thus, the benefits of mandatory internal auditing come with the price of internal coercion. The definition of internal audit must be narrowed down and convincingly explain how internal audit can create value for organizations and society, the IPPF must be made more specific and compulsory to follow, compliance must be monitored, and deviations sanctioned. Only then can internal audit hope to claim legal recognition of its services.

Profession

The discussion in the previous section noted that legal recognition and mandatory internal audit require a clear and commonly understood and agreed Unique Selling Proposition or what the sociology of professions calls a “jurisdiction” (Abbott, 1988). If internal auditing seeks professional recognition, it will need a knowledge base which can link the profession to the work it does. In other words, there needs to be a body of internal audit knowledge, which is legitimate and distinct for internal auditing and explains how internal audit is of sufficient value to society to warrant professional recognition. However, professions usually compete with other professions for a jurisdiction. Internal auditing’s main competitor is external auditing, so to capture the internal audit jurisdiction and to avoid subordination to external audit, internal audit needs to differentiate its knowledge base from financial auditing (Arena & Jeppesen, 2010). The process of creating and maintaining a professional jurisdiction is a balancing act, as there may be trade-offs between full clarity of purpose and a vague conception (easy target versus good defense) and between too little and too much content (not worth professionalizing versus impossible to legitimize (Abbott, 1988, pp. 52, 103).¹⁹

As suggested, we do not believe that internal audit presently hold such a distinct jurisdiction; the definition of internal auditing is simply too broad. Over time, this has led several authors to note the risk that internal audit becomes the “jack of all trades” and “master of none” and that proficiency over no discipline turns out to be the antitheses of a profession (Lenz et al., 2018; Van Peursem, 2004).²⁰

We believe that internal audit needs to reduce the variation of practices to focus on what differentiates it from external audit, i.e., internal auditing’s ability to engage with an organization’s governance processes, which external audit for independence reasons cannot do. We also believe that internal audit needs to have a more compelling and sticky idea and story to tell about the jurisdiction. For this story, we suggest using a compelling metaphor because this eases understanding by conveying experiences from one context to another (Lakoff & Johnson, 1980). Accordingly, we suggest using the metaphor “Gardener of Governance” to explain the value proposition of Internal Auditing:

• Governance has been central to what internal auditing has been aspiring to do for a long time. Governance is by definition “The combination of processes and structures implemented by the board to inform, direct, manage and monitor the activities of the organization toward the achievement of its objectives” (Anderson et al., 2017, Chapter 3) and is the perfect choice for “heartland” of internal audit. Governance is an umbrella term, which we suggest should include the E and S of ESG. We view governance as the core territory of internal audit, helping to avoid overpromising and underdelivering. Governance as the suggested “heartland” of internal audit covers a broad arena, it is not too abstract and does not have too little content, either, just right sized, the recommended focus of internal audit.

• Gardener builds on prior work by Sarens et al. (2016), “we need to be more like farmers”²¹ and views the internal auditor as respectful towards nature, caring about creating the right environment for plants to grow given the weather and soil conditions. Internal auditors must sow the seeds, fertilize, water and nurture the plants, continuously check the weather forecast and adapt plant nurture to this, occasionally weed the weeds, all done while being patient and humble, but also result-driven and outcome focused. Internal auditors work indirectly and so their impact is through others. We suggest that viewing internal auditors as gardeners is a promising metaphor with which to position internal audit can strengthen its value proposition.

The 70^th anniversary of the IIA Nordics was the golden moment to introduce internal auditing as the Gardener of Governance. With the anniversary presentation and this article as kick-off we would like to see this suggested anchor term, Gardener of Governance, being discussed in the internal audit community. Gardening suggests that the role of internal auditing has a positive influence in nurturing effective governance within organizations, which will be of value to the organization and its stakeholders.

We are enjoying appreciative feedback from internal auditors, for example²²: “Love this. ‘Gardener of Governance’ is such an apt metaphor to illustrate the position from which internal audit can strengthen its value proposition. The outcome of gardening is a beautiful blend of nature (the environment in which we operate) and nurture (the way we care for, protect, nourish and support).”

How to make Internal Audit as Gardeners of Governance a sticky idea? The acronym SUCCESS can help. In their bestseller, Heath and Heath (2008) explore why some ideas survive and others die. When applying their SUCCESs model to the world of audit, it is worthwhile to search for sticky ideas that are Simple, Unexpected, Concrete, Credible, Emotional and/or tell Stories. One such trait may already be sufficient to make an idea stick.²³ We added another capital “S”, representing “Surfing in the wild ocean”. The suggested metaphor and leitmotif of Gardener of Governance²⁴ can become such a sticky idea helping to solidifying the value proposition of internal audit in the future:

SIMPLE: That metaphor is easy to understand and remember. Governance has been central to internal auditing for a long time. Gardening acknowledges the fact that internal auditors can only be indirectly effective since plants grow themselves when conditions are favorable. That metaphor draws on a common understanding of what a Gardener does and transfers this understanding to internal auditing.

UNEXPECTED: We deliberately suggest Gardener of Governance not Guardian of Governance for the metaphor Gardener displays a healthy level of modesty being exposed to reality and unexpected weather conditions in the real world. The metaphor Gardener underpins humility. Gardeners are very respectful toward nature, the environment they live in. Similarly, internal auditors are well advised to be respectful toward the rest of the organization in which they operate. With the soft/er metaphor of Gardener we deliberately position internal auditing as a constant learner, a learn-it-all, rather than a know-it-all.

CONCRETE: Governance covers a very broad arena, it is not too abstract and does not have too little content, either, just right sized, the recommended focus of internal audit.

CREDIBLE: Governance is an arena where internal auditing has worked on and gained experience and credibility over a very long period.

EMOTIONAL: Gardening as metaphor softens the negative perception of internal auditing as preoccupied with finding errors and of auditors as grey, dull, bean counters. Gardening creates immediate, visible results, which all can enjoy and appreciate. It is even beneficial for your health, research shows (Soga et al., 2017). So, the Gardener of Governance has an emotionally positive connotation. Internal auditors as gardeners shall signal empathy, too. Audit clients should feel invited and safe that internal auditors are focused on collective improvement going forward, rather than on finding errors. Having the right mindset to develop trust is key. Beware “gotcha” type of individuals for they will perpetuate the negative stereotypes. The human aspects of how to approach internal audit are critical. An “inviting personality” is one that demonstrates empathy and can quickly gain and develop a trusting relationship (Garyn, 2021).²⁵

STORIES: Internal auditors are humble displaying a healthy level of modesty being exposed to the rough reality and severe and unexpected weather conditions in the real world, we have a holistic view, we care about the conditions where plants grow or go, we look between the functional siloes, we know that we cannot pull grass to make it grow faster and we apply a questioning approach to better understand the world and context we live in.

SURFING in the wild ocean: Our mini typology of internal auditors distinguishes three different types, type 1: Standing on the sidelines, type 2: Swimming in a calm pool and type 3: Surfing in the wild ocean. Modern auditors are no longer staying on the sidelines of the pool (organization) or hardly getting wet at all; modern auditors are in the wild ocean, in other words, modern auditors are part of today’s business world, too. To gain relevance, the internal audit profession needs more type 3 auditors, more pioneers and innovators in the world of VUCA, characterized by Volatility, Uncertainty, Complexity and Ambiguity.²⁶ The idea that these types are dynamic rather than static depending on the context is worth examining further. Possibly, that becomes the starting point for further research (Lenz, 2021).

Prosperity

Internal Auditing and good controls are not ends themselves. Internal auditing and controls are means to an end and the end is to improve an organization’s governance. According to Mario Andretti (Italian American racing driver):

“If everything seems under control, you’re just not going fast enough.”²⁷

Chambers (2016) rightfully states that internal audit is more than brakes in a car, it is part of the navigation system. We fully concur, internal audit must serve the overall strategy of the organization. If an organization fails because it is not profitable, internal audit fails, too.

Internal auditors in the public sector protect and enhance public welfare. Internal auditors in the private sector protect and enhance private welfare, put simply. When auditing what truly matters in the private sector, governance, strategy, operations and the business model are vital. When demonstrating the value of internal audit, some internal audit functions justify their legitimacy with contributions to the bottom line, hard savings, too, or help securing liquidity. Although it is a deviation from the suggested heartland of internal auditing there is nothing wrong with that. In times of crisis, for example, at the outbreak of the COVID-19 crisis in Europe, in March-April 2020, the first author of this article, a Chief Audit Executive, was invited by the CEO to additionally assume the role as global project leader of the Cash-is-King project helping to secure and improve operational cash-flows throughout the crisis.²⁸ An important project, for illiquidity is a major cause of companies collapsing.

Adding value, for example, being temporarily the Cash-is-King project leader as part of the role of the internal audit function, shall serve as one real case example. There are many ways to demonstrate value in the governance arena. Internal auditors are typically well educated, know the organization they serve well and can emerge as true helpers in times of distress.

People

Vercaeren (2021) demonstrates the value of humanizing strategies and organizations. All strategies ultimately deal with people. People make all the difference. People are what matters most. “Values, beliefs and emotions have a proven impact on human motivation and thus influence our focus, decisions and actions” (Vercaeren, 2021, p. 12). Change begins with people. Internal auditors must remain flexible, adapting to the unknown future and keep learning.

In our opinion, internal audit is and will remain, above all a people business. Human skills are the key to success, including communication skills, especially listening skills, the origin of the profession.²⁹ “Listening is a way of offering others our scarcest, most precious gift: our attention. Once we’ve demonstrated that we care about them and their goals, they’re more willing to listen to us”, summarizes Grant (2021, pp. 159–160).

Nevertheless, as the business environment becomes ever more digitalized, internal auditors will need to use new technologies such as audit analytics and process mining. Betti and Sarens (2020) conclude that the digitalization of the business environment change the skills needed in an IA function and Li et al. (2018) conclude that the use of audit analytics by internal auditors is below expectation, pointing to expertise in statistics and technology as an important precondition for the adoption of audit analytics.

Thus, while acknowledging the prime importance of people, we need to consider ways to further improve education and training of internal auditors to prepare for the megatrends of digitalization and sustainability. Increased cooperation between the IIA and universities throughout the world is an important way to achieve this and IIA Global may need to rethink its Academic Relations Program³⁰ so that what the IIA can learn from universities becomes as imperative, as what the universities can learn from the IIA. As part of the program, awareness of IA may be increased by having practitioners assume teaching assignments or offer lectures to interested students to nudge the career path into internal auditing right after graduation, otherwise a career path often ignored at that stage. It would be advantageous for the internal audit community to nurture more colorful, diverse career patterns, become more fluid, to best mirror the plurality in practice.

Leveraging gamification is another opportunity to heighten the attractiveness of internal auditing, benefitting from a modern way of learning when playing “The Internal Audit Game” (Foerschler & Lenz, 2020).³¹ We live in a VUCA world (Volatile, Unexpected, Complex and Ambiguous), internal auditors have traditionally been good at dealing with complicatedness, sorting it out to establish WHAT IS. That remains important, however internal audit practitioners want to be impactful, too, also addressing the question of SO WHAT. Being pragmatic, not dogmatic, helps, indeed. However, in our modern, fast paced and intertwined world, WHAT IS and SO WHAT is no longer good enough for the modern internal auditor. We must start becoming more familiar with WHAT IF type questions, i.e., scenario thinking and forward looking. We must learn how to get better at dealing with interactive complexity and influencing behavior, exactly what gamification is all about. The interactive mode of playing offers excellent opportunities to gain experience, thereby improving participants’ ability to deal with interactive complexity.

Business and internal audit are in essence about people working together, successfully. In doing so, human skills are and will remain essential. Some IA tasks may well be automated by robots, but the core aspect of critically assessing evidence and communicating the results cannot. So, IA is only partly science (standardized procedures), the lion’s share is an art. Interpersonal skills, communication and listening are and will remain mission critical, in fact key to the internal auditor’s success.

CALL TO ACTION

Internal auditing is projected to be a profession and a job, demand for which is in decline. According to the World Economic Forum Report “The Future of Jobs” (World Economic Forum, 2020), Accounting and Auditing are at No. 4 on the list of jobs with decreasing demand.³² Internal auditing is at a crossroads, again. On the micro level, in organizations and institutions, stakeholders may see less and less value in the contribution from internal auditing and on a macro level, this prospect jeopardizes the legitimacy and relevance of internal auditing as a profession. In essence, the internal audit profession has not moved on nearly enough in the last decades. More and better is needed.

While we acknowledge that more research is needed regarding how the metaphor of Gardener of Governance may be perceived by key stakeholders, we do believe that it is worth pursuing and we conclude our article with a call to action.

This article suggests five main fields of action and focus for the global Institute of Internal Auditors and academia that will determine the future role of internal auditing, its legitimacy, its relevance and its organizational and societal significance. The purpose of this article is to provide comprehensive content suggesting five concrete paths for the betterment of internal auditing. The five directions that deserve development are planet, public, profession, prosperity and people. Ultimately, positioning internal auditing as Gardener of Governance is a promising metaphor to strengthen its value proposition, both on a micro and on a macro level.

We conclude this article with a call to action for the various stakeholders and addressees:

We would like the leadership of the IIA Global – The Institute of Internal Auditors to review both the 5Ps presented (Planet, Public, Profession, Prosperity, and People) and the suggested Gardener of Governance leitmotif to establish whether and how it might be of added value to the ongoing strategic direction for the global internal audit profession and community. On February 1, 2022, in parallel with the final editing of this article, the IIA Global unveiled a new brand and website as part of the intended transformation. The green background of the new logo fits perfectly with the suggested metaphor Gardener of Governance.

We would like the IIA chapters around the world to pay particular attention to advocacy, with the aim of educating and influencing public opinion about what internal audit does and can do. This may, for example, be done by writing native language articles and reports about internal auditing’s potential, by seeking influence on board member educational programs, by conducting local research into stakeholder perception of internal auditing, by contributing to the formulation of local corporate governance frameworks and by disseminating news in the form of press releases and conferences. Advocacy is of prime importance because third party perception matters more than the internal audit profession’s self-image. Beauty is in the eyes of the beholder.

We would like more Internal Auditors to become Type 3 auditors, surfing in the wild ocean, to put it somewhat poetically. We would like internal auditors to become pioneers, joining their organizations and institutions when entering unknown territory, for example, acquiring and integrating businesses, launching new products, possibly in new markets, upgrading the IT architecture and associated business applications and so forth. We would like internal auditors to expand their comfort zone by embracing gamification and benefit from it as a fun avenue of learning with a healthy dose of competition. Additionally, we would like to encourage more internal audit practitioners to go to academia to encourage students to consideration internal auditing as first career path after graduation. Presently, compared to business administration, auditing and governance is hardly on their radar, clearly a void waiting to be filled.

Finally, for the betterment of the internal audit profession we would like to see Academia critically analyzing the components of the metaphorical Gardener of Governance leitmotif, critically researching the main stakeholders’ perception of it and how internal audit could use its premise to create value for them, within the boundaries of the metaphor. Critical research could also establish to what extent each of the five Ps might contribute and how much they may conflict or indeed interact with each other. This article wishes to motivate researchers to explore innovative research strategies and probe new theories, as well as benefit from cross-fertilization with other research streams.

Acknowledgments

Rainer is grateful and thanks all chapters of the IIA Nordics for the opportunity and invitation to speak in October 2021 about The Future of Internal Auditing: IIA Denmark, IIA Finland, IIA Iceland, IIA Norway and IIA Sweden.

For discussions, perspectives and input when preparing the presentation on 08. October 2021, Rainer thanks Thomas Braun, Barrie Enslin, Dr. Dominik Foerschler, Prof. Kim K. Jeppesen, Prof. Christopher Koch, Anthony Pugliese, Prof. em. Jeffrey Ridley, and Prof. em. Laura Spira.

When crafting this article, we thank David Jackson for proofreading our manuscript.

We thank the reviewers of our paper for their comments and suggestions, and we thank Dan Swanson, the Managing Editor of EDPACS, for the opportunity.

DISCLOSURE STATEMENT

No potential conflict of interest was reported by the author(s).

Additional information

Notes on contributors

Rainer Lenz

Rainer Lenz, PhD, CIA, CIIA is Director Corporate Audit and Advisory Services at SAF-HOLLAND SE. He is a seasoned finance and audit professional with 30 years of international experience as Divisional & Regional CFO and Chief Audit Executive in global organizations. PhD about the effectiveness of internal auditing from the Louvain School of Management in Belgium. He has published a series of articles about internal auditing in peer reviewed academic journals and has earned several awards for his thought leadership. He has a teaching assignment at the Johannes Gutenberg University in Mainz and can be reached at [email protected]

Kim K. Jeppesen

Kim K. Jeppesen is Professor of auditing at Copenhagen Business School and is the author of a number of papers on internal auditing in International Journal of Auditing, European Accounting Review and EDPACS. He is Program Director for the Master in Accounting and Auditing at CBS, where he teaches financial auditing, internal auditing, audit data analytics and fraud investigation. He is also on the board of the Danish IIA Chapter. He can be reached at [email protected]

Notes

1. 70 years of IIA in the Nordics: Join the 70th anniversary celebration and meet IIA President and CEO Anthony J. Pugliese, https://iia.no/activities/70-years-of-iia-in-the-nordics/

2. World Economic Forum (2020), The Future of Jobs Report 2020, page 30, https://www.weforum.org/reports/the-future-of-jobs-report-2020

3. Link to the original presentation: https://drrainerlenz.files.wordpress.com/2021/10/the-future-of-internal-auditing-dr.-rainer-lenz-70th-anniversary-scandinavian-iia-chapter-08oct21.pdf

4. Inspired by www.zukunftsinstitut.de, Megatrends 2021: “Zeit für eine Revision”, and complemented by our own reflections

5. According to the American Institute of Certified Public Accountants (AICPA), audit data analytics (ADAs) are techniques that help auditors leverage current technologies and move toward a more data-driven approach to planning or performing an audit. While audit data analytic techniques are often applied to external audits, they can be applied to internal audit engagements as well (https://www.aicpa.org/, accessed on 22 December 2021).

6. CELONIS is the pioneer of Process Mining, now a Decacorn start-up with a valuation exceeding USD 10 bn, https://www.celonis.com/

7. United Nations, 2015. https://sdgs.un.org/2030agenda, accessed on 11 October 2021

8. Gabriel (2020), page 344: “Die Gesellschaft wird nach Corona nicht mehr so sein können wie jene zuvor.“

9. The UK hosted the 26th United Nations (UN) Climate Change Conference of the Parties (COP26) in Glasgow from 31 October – 13 November 2021, websites accessed on 23 December 2021, https://ukcop26.org/, https://en.wikipedia.org/wiki/2021_United_Nations_Climate_Change_Conference

10. Lenz, R. (2013) alludes to that risk three times in his PhD thesis, pages 35, 110, and 191

11. Further recommended reading: Gert Vercaeren (2021) Humanizing Strategy: How to Master Emotions, Values and Beliefs When You Execute Plans

12. Pagnamenta (2021), Blog from 29 September 2021

13. IPPF (2017)

14. LinkedIn, dialogue with Prof. em. Laura Spira, 16 July 2021, when preparing the presentation at IIA Nordics on 08 October 2021, https://www.linkedin.com/in/laura-spira-a9268a5

15. Lenz, R. and Hahn, U. (2015)

16. Lenz, R. (2013), page 31

17. Study about Internal Audit in Austrian organizations: “Interne Revision: Großer Handlungsbedarf bei IT-Sicherheit, Gender-Pay-Gap, politischer Einflussnahme und Korruptionsvermeidung“, https://presse.skills.at/News_Detail.aspx?id=140884&menueid=25063

18. LinkedIn, Norman Marks’ (Globally recognized risk management and internal audit thought leader), comment on 10 October 2021

19. Lenz, R. (2013), p. 36

20. Lenz, R. (2013), pp. 35–36

21. The authors suggest viewing internal auditors as farmers is a promising metaphor with which to position internal audit and strengthen its value proposition.

22. Bhavani Jois’ (Associate Vice President and Head - Internal Audit & SOX at Infosys), comment on LinkedIn, 23 January 2022

23. Lenz (2017a) and (Lenz, 2017b)

24. Sarens, G., Lenz, R. & Decaux, L. (2016), building on the metaphor of farmer

25. Garyn (2021) citing Lenz R. in his blog when speaking about empathy.

26. Lenz (2017a) and (Lenz, 2017b)

27. Accessed online 11 October 2021, https://www.brainyquote.com/quotes/mario_andretti_109743

28. Press release SAF-HOLLAND SE, 25 March 2021: “The net cash flow from operating activities in the 2020 financial year came to EUR 137.9 million, 52.4% above the level of the comparable period of the previous year of EUR 90.5 million. The increase is mainly attributable to the positive contribution from net working capital management. The Cash-is-King project initiated in April 2020 played a major role in this regard. As a result, it was possible to sustainably reduce overdue receivables in all regions and improve the management of inventories.”

29. Lenz, R. (2013, p. 3): “The Latin word ‘audire’ means ‘to hear’ in English. As Ridley (2008, 293) states, “the right questions will always be the key to effective internal auditing. So will be right listening!” There is a deeper meaning in the fact that humans have two ears and one mouth (so that we can listen twice as much as we speak). That may be particularly good advice for internal auditors.”

30. https://global.theiia.org/edu-events/Pages/Academic-Relations.aspx

31. Dominik Foerschler and his team at the ARC-Institute organized the European Audit Championship 2021. Please see the YouTube video of the Grand Finale from September 2021: https://www.youtube.com/watch?v=GDXjjsIDnT8

32. World Economic Forum (2020), The Future of Jobs Report 2020, page 30, https://www.weforum.org/reports/the-future-of-jobs-report-2020