The Internal Auditor and the Organization – Anecdotal Comments and Other Problems

In preparing for this study, a small number of internal auditors was interviewed, and their views on the attitudes of middle management to internal auditors were noted. These findings coincided with the experience of the writer when he was involved in internal audit of a major trading bank some years previously. From these interviews with internal auditors employed in several different companies and later interviews with a number of middle management personnel, it was noted that there is a wealth of anecdotal evidence concerning the internal auditor’s relationship with others within an organization. One example is the comment made by a member of middle management of a major international bank: “Internal auditors need something to put in their report in order to justify their existence, thus they will nit-pick if they have no major problems to report.” (interview: Banking Management Subject 2, 2002). Thus, a history of anecdotal evidence of “getting on the wrong side of the person being audited” has been created (Banking Management Subject 2, 2002). In fact if these interviews are collated, the outcome is that with reasonable certainty the auditor is seen by most management as having a more rigid attitude to the method by which organizational goals are to be achieved, a different attitude. While not directly admitting to the existence of such a problem, the Institute of Internal Auditors has created a standard “260 Human Relations and Communications –

internal auditors should be skilled in dealing with people and communicating

effectively.”(IIA Handbook, 1997). The Institute of Internal Auditors has published at least one article in Internal Auditor, pertaining to this problem of perceived attitudes and

views. The title of which indicates the nature of the problem: “Oh no the (internal) auditor is here” (Chadwick, 2002).

There is other supporting evidence that the position of internal auditor is one that may see the organisation in a different way to the middle management of the organisation. For example Van Peursem and Pumphrey (2005) while principally looking at the internal auditor from the point of view of agency theory, and also considering the problems faced by the internal auditor when clear lines of responsibility for the internal audit are not outlined, did however mention the difficulties an auditor faced from within an

organization. In their view the difficulties arose because of the different expectations of the internal auditor from the different levels of management within the organization.

.It needs to be kept in mind however that the internal auditor is different to the external auditor, in that the internal auditor is generally considered to be a member of the organization he is auditing. Thus he faces the organization as an insider rather than an outsider.

A key difficulty faced by the internal auditor is that his or her appointment is generally relatively short-term. The individual is cycled through the position to gain experience “on the job” before moving on. (Mathews et al 1993). It takes time for an organization to assimilate a new member into the culture of the organization (Coffey et al 1994). Given the generally relatively short-term appointment of the internal auditor, the organization may have too short a time to assimilate a new internal auditor into its culture, and the

internal auditor’s role within the organization will not properly fit within the culture of the organization. Thus, the internal auditor will feel “the odd one out” within the

organization. As the respondent to a survey of attitudes to the use of the internal auditor as an adviser within an organization put it “management tolerates internal auditors but does not want them operationally involved” (Glover & Romney 1997). This implies a significant difference between the culture of the organization and the culture of the internal auditor. Even if the new internal auditor is given time to assimilate as an internal auditor, he will still find this difficulty in some organizations. The senior internal audit role, however, is often filled by a long-term auditor. Leung et al. (2004) found that of 85 chief audit officers that responded to a survey, 45 had held the position for in excess of ten years. This is to be expected, the cultural problems faced by the ordinary internal auditor, who will have held his position for a much shorter period of time remain, however. This is supported by a study discussed by Goodwin and Yeo (2001) which found that the use of internal audit as a management training ground was widespread. If this is the case then future managers would be unlikely to be left as an auditor for long.

There is also a potential for culture in the broader national and international sense to impinge on cultural attitudes, including the attitude towards internal audit. For example, Kachelmeier and Shehata (1997 p429) considered that in societies where trust2 was considered an important component in the achievement of organizational goals, the imposition of a form of audit, even on a voluntary basis, may be counter-productive.

The restructuring of organizations, which has been widespread in the 1980s and 1990s (Otley 1994), often leads to a greater number of empowered employees (Leifer & Mills 1996), with high levels of delegated authority, as organizations move to operating more technologically flexible systems (Leifer & Mills 1996). The use of imposed internal controls in an organization that is no longer based on a bureaucratic culture, but rather is now a clan-based culture, may cause members of the organization to consider the controls unnecessary and ignore them. As mentioned previously, the internal auditing profession is promoting the concept of “Control Self-Assessment” or CSA. Part of the reason for this development is to overcome this difficulty (Fritsch 1996).

CSA involves the auditee in the development of both the control programs to be faced and the audit program (Baker & Graham 1996). The purpose is to motivate the employee to follow the set controls, as the employee has been involved in the design of the controls (Baker & Graham 1996). Despite the support that CSA is gaining in the literature

(www.theiia.org 2005), this is considered an improper approach to the development of internal control systems by some researchers in the area of internal control (Brownell 1995). It is possible that organizational culture will impact on the efficacy of CSA. The form of the control system is accepted as one of the ten characteristics of organizational culture (Robbins & Barnwell 1994). From this it follows that attitudes to controls are dependent on culture. The result is that where the culture of the organization does not support a high level of self-control, given the high level of freedom that exists following

2

organizational restructures where middle management is reduced, and authority delegated down the line, CSA may fail.

For reasons similar to those relating to the problems with CSA, the use of “self-directed audit teams” of internal auditors is also being developed. Here the purpose is both to improve the attitude of the internal auditor in terms of job satisfaction, and to assist the internal auditor to make better decisions (Baker and Graham 1996). This need that Baker and Graham (1996) have identified to improve the attitude of the internal auditors leads to the concept that there is likely to be a difference in culture between the organization and its internal auditors. It is therefore likely that the performance of the organization’s

internal auditors will depend on both the culture of the organization and the sub-culture of the internal audit group.

The question which arises is whether the cultural and control environment of the organization is considered likely to influence the ability of the modern internal audit function to carry out its role. The influence over the control environment that the internal audit function possesses may be determined more by culture than by formal structure. This is a particular problem given that the empowerment of employees (delegation of authority) may have been implemented more as a “fad” than a developed strategy, and the resultant effects on business control may not have been properly examined (Sweeting 1995). For example, members of bureaucratic organizations which are rule based and follow structural lines of authority may be accepting of internal audit processes. In

less accepting of internal audit. However, they may be more likely to accept CSA as this allows for participation rather than blindly following rules.