Being Disconnected from Senior Management and the Board

I run leadership workshops for CAEs in which we explore ways to be more influential. Clearly different CAEs have different styles and different relationships with key stakeholders, but there are three areas which consistently crop up as important challenges:

• Simply getting access to the diaries of senior managers and the board;
• Not fully understanding the evolving agendas, motivations and political sensitivities of these key stakeholders;
• Determining whether and how these stakeholders can be constructively challenged without adversely affecting working relationships.

Audit may not be alone in having problems of access. However, CAEs can sometimes sense that there is an inner circle of senior leaders who do have time for one another to talk openly about a range of issues, but it seems hard to break into this group. Chris Baker (Technical Manager, IIA UK) offers some reflections from his experience carrying out External Quality Assessments (EQAs):

“Having informal discussions with senior managers and audit committee members is a great thing to do. But I still don’t see that in a number of instances, sadly.”

When thinking about being in a position to add value, a CAE who finds himself relegated to the margins of senior leadership interactions, cannot just accept it as “one of those things”; he must proactively take steps to remedy the situation.

Having to Play Constant Catch-Up in Relation to Planned Strategic Developments and Key Operational Challenges

A number of CAEs and auditors find themselves regularly in “detective” or “catch up” mode, trying to find out what is going on in their organization in relation to key operational achievements and challenges, and especially in relation to strategic developments.

I have spoken to several CAEs who have heard about major systems and process changes “out of the blue” without being consulted or informed. This is despite the fact that they were most likely one of the most well-informed and impartial senior managers who could understand the key risks and opportunities in relation to what was being proposed.

The reason that CAEs and auditors may find themselves having to play detective may be due in part to their relationships with senior management; however, it can also be due to a management view that “this is not an issue of concern for audit” or “this is not an area audit will be able to help”.

CAEs Thinking “They Have Seen It All Before” and Sticking to Traditional Ways of Working

At various audit leadership workshops, I see CAEs from a wide variety of backgrounds and with considerable differences in experience. Some of the most experienced CAEs are engaged and interested in new ways of working that might enhance the value adding contribution of audit. Often these CAEs are actively engaged in auditing high value, strategic areas.

However, other CAEs I have met say they have stopped attending most professional update meetings because they: “rarely get any fresh insights”. However, at the same time, it does not surprise me to learn that often their audit functions carry out a traditional role and are not particularly well resourced. John Earley (Partner, Smart Chain International) highlights the mindset that can be a barrier to effective lean working:

“If you’re satisfied with the way things are, you’re not there. Your head is in the wrong place.”

CAEs Who Have Difficulty in Taking a Lead and Making a Real Difference

I see an enormous range of CAE styles; I do not believe there is a simple formula for being successful, since it depends on a range of factors, including the organizational context, culture and the preferences of senior managers and the board. However, I have seen a number of instances where even long-standing CAEs have lamented, in private, shortcomings in the risk and control culture of their organization. When we have then examined this in more detail, we have identified missed opportunities to educate and influence senior stakeholders (although I recognize we cannot be certain they could have been persuaded if they were challenged by the CAE). Richard Chambers (President & CEO, IIA) offers an interesting reflection on this topic:

“If you appear tentative, if you appear intimidated, if you appear uncertain, your detractors will seize on that, and that undermines internal audit’s effectiveness.”

Thus, a CAE may achieve personal security by holding on to their role for a period of time, but this can sometimes be at the expense of the organization making real progress in relation to GRC and assurance disciplines. From a lean perspective, no external customer is going to be satisfied with someone who is just interested in collecting their pay cheque.

Ensure You Are Properly Plugged in to What Is Going on in the Wider Organization

John Earley (Partner, Smart Chain International) explains:

“In any kind of lean environment communication is fundamental. It has to be. If information is not flowing, in the same way that everything else should be flowing, then you have a major problem. Because people need to understand what is going on, and why they are doing what they are doing.”

Marcin Gody (Head of Internal Audit, USP Group) explains:

“If management aren’t involving you in everything that’s going on how can you build the right audit plan and work on the key issues that right now may need to be better managed?

Being fully connected is fundamental to value adding ways of working. 

I believe that we need to understand things as they progress, being a partner alongside management, so that we can add value on a timely basis. Making comments after things are done can add value, but rarely much as giving real time input.”

Karen Dignan (CAE, Group Head Office, OMG) has been working on this area and explains the changes that have taken place:

“A key change recently has been the level and quality of information I am now getting about what’s going on, about big strategic changes, etc. This increase has followed a recognition that we might get involved in issues that in the past wouldn’t have seemed relevant to us.”

Such a flow of information can be achieved by ensuring the CAE is included in senior management circulation lists, key performance updates, and is also informed about the agendas of key meetings. When this happens, the CAE can meet with senior managers and the board far better prepared, and as a result, better placed to explore questions concerning risk and assurance in more depth. Karen Dignan (CAE, Group Head Office, OMG) goes on to emphasize:

“Having more information is a good thing, but if everyone’s on a treadmill with no time to consider what it means, it’s a waste. So you’ve got to explicitly make sure you’ve got time to digest information and also to engage with the right people.”

In practical terms this can mean that the audit function should nominate roles within the function to distil key messages from internal and external sources and stimulate discussions within the audit function about the practical implications going forward.

Actions for Internal Audit to consider:

• Consider what information exists within the organization and the extent to which it is flowing easily to the audit function;
• If information is not flowing, work with stakeholders to explain the benefits of doing this in terms of having a better understanding of organizational issues (as well as less time wasted);
• Allocate roles within the audit function to review information and digest this for onward consideration in the audit function.

Proactively Manage Contact with Key Stakeholders to Build Trust and “Money in the Bank”

Beyond being kept up to date with what is going on, effective CAEs recognize the crucial role they play in proactively engaging with senior managers and the board. Karen Dignan (CAE, Group Head Office, OMG) explains:

“We actively work to maintain regular contact with key stakeholders. We’ll discuss what’s happening in the business, as well as relevant developments in the plan and audit findings.”

Greg Coleman (CAE, ITG) goes on to explain:

“I think it’s essential that senior stakeholders get to know you well enough to trust you. I think the challenge for many CAEs is that due to their workloads it’s so easy not to take the time out to engage them. My goal is to make contact with them frequently enough that they know who you are, and what you can do, and they are comfortable giving you a call.

At the same time it’s important to be conscious of their diaries and recognize there’s no point in just having a meeting for the sake of it. If you haven’t got anything of significance to really discuss they’ll think you’re wasting their time.”

Richard Young (Director, UNIAC) explains the approach he has taken:

“Building relationships with senior stakeholders leads you to being more in tune with the business and higher up on the list of: who do I call to have a chat about this? Who do we trust? Who have I got a rapport with?

We have to be seen as part of the top table. If it doesn’t happen ask yourself why are you not attending more senior management team meetings? If the answer is that you are worried that you are going to be out of your depth, you need to get beyond that.

One approach is to agree to attend some key meetings as an observer and then offer them some reflections, perhaps even in private, after that. That’s where audit should be.”

If managed proactively, audit involvement in key meetings can create a virtuous circle of being well informed about developments, which in turn enables the CAE to engage with senior stakeholders on a more equal basis, offering insights on issues that matter and ensuring there are no surprises in relation to the work audit is engaged in.

Beyond this it is important that CAEs should work to ensure they and their senior managers stay engaged with a range of key stakeholders across the organization, keeping track of key contacts and the key points that were discussed. Most of all, CAEs and senior audit managers should not simply spend time with those colleagues they feel most comfortable with.

Building closer relationships can be achieved by sharing learning on best practices with colleagues and participating in joint working groups. At an informal level it can involve going to lunch with colleagues and being involved in social events, creating an underlying relationship of friendly interaction that can be a useful backdrop for any more difficult interactions.

Actions for Internal Audit to consider:

• Map out the key stakeholders of audit and consider when these stakeholders were last contacted and what about;
• Be wary of spending too much time with some contacts simply because you get on with them;
• Consider the quality of relations between the CAE and key stakeholders – try to build some “money in the bank” so that when issues become difficult there is already a degree of trust and mutual understanding.

Adopt a Mindset of Continuous Improvement

Properly engaging key stakeholders in relation to what they are looking for and what can be done differently should create a natural pressure to make changes to audit practice, since what is wanted at one point in time is not necessarily going to be wanted the next.

Staying properly plugged in to professional developments within GRC and assurance circles is also likely to help the audit function keep moving forward. Particular favourites of mine are “audit hot spot” updates (which can be invaluable when thinking about planning) and also best practice templates (e.g. to enhance audit reporting and audit committee presentations). External best practice updates, that might address how a topic is being addressed in other organizations, should not only be read by the audit function, but also be shared (in summary form) with senior managers and the board, as a way of educating them on key developments in GRC and assurance. At the same time, their feedback on what they make of these new practices can give the CAE a useful perspective on how stakeholders are viewing audit as well as wider GRC and assurance developments.

As discussed in an earlier chapter, CAEs should take a close interest in post assignment feedback and the outcomes of assignment learning reviews. Phil Gerrard (CAE, Rolls-Royce) outlines his approach to continuous improvement:

“A value adding function has got to keep moving. You’ve got to keep challenging yourself. Get your team involved, because they will often come up with some great ideas: What should we stop doing, what should start doing? What should we change?

I’ll do this every year because you need some fresh perspectives. Some of the best insights are from the people who have been in the function three weeks. They say, I don’t understand why you are doing this? And I’ll realize they’re absolutely right: why do we do that?”

Actions for Internal Audit to consider:

• Regard feedback from stakeholders as a key source of fuel for a continuous improvement culture in audit;
• Determine which members of the audit function should take the lead in key areas of audit best practice and regularly share improvement opportunities within audit and with key stakeholders.

Politics and Influencing Do Matter

Building relationships with key stakeholders is important, but it should be recognized that there is often a degree of organizational politics in relation to what audit does, particularly if it involves challenging the organization on well-established processes, roles and other cultural norms. However, not every CAE fully appreciates the importance of managing organizational politics, or is particularly skilled in this arena. Indeed, research by the Audit Director Roundtable cites this as one of the reasons new CAEs can fail in their role.

An experienced UK audit manager explains his philosophy about influencing and political savvy:

“Over the years I have come to understand that anything that comes as a surprise is annoying. Anything that gets communicated out of chain generates a lot of sensitivity and negative feedback.

The things we focus a lot of our time on is making sure we tell people what we’re thinking as we go along so there are no surprises. We encourage people to go through their chain of command so it doesn’t come as a surprise at the top. So you have to put an awful lot of effort into that. Understanding the political dimension of our work is a key component of being effective.

This means you need to think ahead, to give people time to respond, and be able to understand not only what push back you are getting, but the reasons for this, as well as the unspoken clues that can give insights into other problem areas.”

Thinking politically also means being able to think ahead about competing agendas and to operate strategically in order to build support for key improvement opportunities. I have been running development workshops for CAEs on influencing and political savvy for several years. My observation is that there is no standard technique to apply, often it is just a question of taking time to think about the sensitivities of certain proposals in the context of organizational challenges and individual priorities, so that what is being offered by audit genuinely seems of value. Over time these opportunities to reflect on the wider context within which audit proposals sit can instill a more mindful approach to influencing stakeholders.

Actions for Internal Audit to consider:

• How often are you consciously thinking politically and devising strategies in order to achieve positive change in the organization?
• Consider coaching or training on influencing and/or political savvy.

Be a Role Model for Senior Management and the Board through Professional Reporting, Engagement and Transparency

In addition to a good understanding of organizational politics and influencing at the most senior levels, the most effective CAEs recognize that their impact comes from having a range of attributes over and above pure technical skills. Greg Coleman (CAE, ITG) provides a perspective on one of the ways in which CAEs can build credibility and influence:

“It’s crucial to focus on being professional in all aspects of the audit process, especially when dealing with senior stakeholders. For example, you might be presenting to the audit committee, and you are sitting next to the external auditor, who has got a slick presentation, where a lot of money has been spent on all the graphics and everything else. I think it’s really important that what you present from internal audit looks really good and professional and on a par with them.”

Having a good look and feel to an audit report and an audit committee paper is often identified as a key area where for a small amount of effort audit can impress stakeholders and set a benchmark for clarity and transparency for other board reporting.

Beyond working on senior management and board reporting, a good understanding of key facts (e.g. killer facts) is important for the CAE’s credibility, and for their ability to influence. Stephen Foster (CAE, Cargotec) explains:

“Relationships are important and we need to be able to lobby and persuade management but at the same time, there is a saying that one fact beats a thousand arguments. Doing work, with concrete facts that show what’s going on, which can demonstrate what the weaknesses are, is very important.

Facts aren’t really the message but they’re the supporter of the message I might need to give. A relevant piece of factual information, which has gone through a proper process, that I can then call on, is a crucial value contribution from the audit perspective. This is because so often, when you are dealing with senior levels of management, it can be the person who is the most persuasive with their argument, who has the greatest charm, who can determine the outcome of a disagreement.

But you can often counteract that very effectively and efficiently by presenting the facts. Calling on hard findings or issues that I’m aware of from other audit reports can be so powerful. In a discussion at an executive level some might say something is not an issue and I can say: it is an issue: we’ve had a couple of sites where this has happened in the last year.

I couldn’t persuade and guide if I didn’t have hard facts. But at the same time, just having the hard facts is not enough; you need to find a way of communicating that is more than setting down a set of cold reports.”

Whatever strategies are used by the CAE to build trust and influence, it is clearly fundamental that the CAE obtains regular feedback to ensure that they are on the right track.

Actions for Internal Audit to consider:

• Ensure the look and feel of audit reports promote audit in its best light;
• Be prepared: make sure that you have key facts to hand when interacting with key stakeholders;
• Ask for feedback from key stakeholders about your presence at senior stakeholder meetings.

Being a Leader

Influencing skills, political savvy and having the right presence at senior meetings are all important ingredients to being successful. However, at the end of the day, being effective at a senior level requires an ability to take the lead. Rania Bejjani (CAE, Colt Technology Group) offers a useful analogy:

“Most CEOs, most CFOs, most heads of business divisions, are people with a strong character and personality. Overall, they tend to be driven ambitious strong leaders, the equivalent of lions in nature. And, a CAE cannot be a mouse talking to a lion. I’ve got to be a lion to have an equal footing with a lion.

So heads of audit need to be strong, driven and emotionally intelligent characters, who understand the business, and are able to flex their behaviours to build rapport. The aim is to build credibility and gain the trust of management so they see the CAE as an equivalent peer who speaks their language and shares their objectives.”

Phil Gerrard (CAE, Rolls-Royce) offers the following perspective:

“Have confidence in your view. You need to be happy putting your head above the parapet, because if you are not you won’t succeed. If you crumble in front of management at the first challenge, your credibility can be lost. So even if you’ve got really good points, you’re fighting uphill after that.

Have confidence, but at the same time listen, if necessary go away, come back, either agree or disagree, but don’t fold if you’ve got something you believe in.”

This is a difficult dilemma to navigate through: CAEs with a strong character or a strong opinion on a particular point can sometimes be too rigid and unable to compromise. On the other hand, those who are less confident might tend to underplay their hand, and be disappointed with a lack of progress on GRC issues in their organization. One starting point for some CAEs is to obtain feedback from peers, staff and key stakeholders on their impact, and to build a development road map. Ideally, the CAE should have the courage to share these development needs with close work colleagues so that they can prompt the CAE if they are not managing the balance well.

In the context of progressive ways of working, this feedback can focus on the way that the CAE is leading work on value adding ways of working and also the way the CAE is driving greater productivity. This can sometimes involve readjustments in relation to the way they delegate within the audit function, empowering and coaching audit staff to strengthen their own influencing and leadership skills. Remember that whilst managers are appointed from above, leaders are determined through the consent of those around. Also remember that the best leaders don’t develop followers, but other leaders!

Some CAEs are natural leaders; however, even the best may use a professional coach or senior mentor from time to time to help them reflect on what they are doing and how they are doing it. Another mechanism for self-development is the technique of Action Learning. Action Learning was developed in the UK in the 1940s and supports the “development of the self by the mutual support of equals”.

I used Action Learning throughout my time as a CAE to examine a number of the key challenges I faced as a CAE, and I am a member of a (different) Action Learning Group to this day. Action Learning helped me hugely on several important issues during my 7 years as CAE. At the influencing workshops I now run with CAEs and audit managers, we use Action Learning discussions to address challenges they are facing. Most find that Action Learning has given them a fresh perspective on the reasons for the difficulties they are facing, as well as new options for moving things forward. At one workshop recently we ran three Action Learning discussions, the last of which concluded the CAE was doing all he could and there were no obvious alternatives, other than accepting the situation or leaving the organization. At the end the CAE commented: “It’s interesting that this approach does not always try to ‘fix’ things. But I now feel a lot better knowing the choices I thought I had are indeed the main choices I have.”

My experience is that many of the choices facing CAEs and senior auditors are filled with dilemmas, with no easy answer. However, an Action Learning group (which has similarities to small work groups in a lean context) offers the opportunity to step back and reappraise a situation, getting multiple perspectives on what may have caused the difficulty and seeing more clearly a range of options for moving forward. Note that Action Learning utilizes techniques that amount to much more than having a chat or giving advice. Indeed one of my main roles when I facilitate these groups is to ensure that the Action Learning Group has an atmosphere of calm reflection and is not judgmental, which can be quite difficult for a group of half a dozen auditors!

Actions for Internal Audit to consider:

• Gather or update feedback on your leadership as a CAE;
• What action plan do you have in place to improve your leadership? How are you progressing? Have courage to ask close colleagues to observe your progress and offer you feedback;
• Consider coaching, mentoring or Action Learning groups to “sharpen your saw” as a leader of the audit function.