Norman Marks on Governance, Risk Management, and Internal Audit

My congratulations to Hernan Murdock on his book. It described on Amazon as:

John Taylor has been hired to transform the underperforming internal audit unit at InSports. The auditors are not reviewing what the audit committee and executive leadership consider essential for the organization’s success, their methodology is subpar, and their relationships with their clients are strained. The audit committee has been patient, but not anymore. Their mandate is clear: make clear improvements in one year or the function will be outsourced.

This is the story of a visionary leader who needs a strategy to transform processes and deliver better results for stakeholders at all levels within the organization. The audit committee, all levels of management, and employees expect more from internal audit. Now, John must lead the group through 12 challenging months as they focus on what matters most when performing audit and advisory services. They must communicate results faster and better, leverage existing quality control and data analytics techniques, and, with every encounter, help the organization address strategic, operational, compliance, and financial risks.

With similarities to “The Goal” and “The Phoenix Project” and leveraging Kotter’s 8-Step Process for Leading Change, follow John and the internal audit team from Boston to New York, San Francisco, London, and Buenos Aires, as they address almost insurmountable challenges in their transformation journey.

Hernan takes us thoughtfully (slowly) through the challenges of a new CAE taking over a dysfunctional department, with a mandate from the Audit Committee to fix it within his first year. I can certainly relate to that, having joined a less-than-ideal department a few times and turned it around in less than a year.

He discusses multiple challenges, including:

• A manager (the #2 in the department) who loves the old ways, with rigid, inflexible, annual audit programs and a focus on compliance with the rules (and the Standards) instead of risk and delivering value to the customer. He is also afraid of jeopardizing his independence by helping management correct weaknesses.
• A staff of five who work from home and live in different locations.
• Unhappy customers who are difficult to work with. They delay responding to requests for information and challenge the auditors at every turn.
• Audit reporting that is not only very long but takes forever to be completed, with many rounds of editing even before they get to the customer, who then challenges the findings.
• A failure to audit the more important risks to activity, let alone the enterprise.

It takes the CAE many months, but he makes progress.

Does he do what I think should be done? To a degree.

That’s where practitioners may find value!

I can recommend the book, but only if you use it to stimulate your own thinking:

• Do you share his priorities? Would you tackle the different challenges in the same way and in the same order?
• Would you change the audit plan faster than John Taylor (the CAE in the story), or in a different way?
• How is he managing the team? Would you do it differently?
• Do you agree with the way he introduces Agile Auditing, or are you a fan (like me) of auditing with agility? There’s a huge difference!
• Do you like the tools he introduces, like affinity and fishbone diagrams?
• Is he making the internal audit function both effective in delivering value and efficient?
• How do you feel about his ideas for measuring effectiveness and customer satisfaction?
• What is your reaction when the audit committee chair asks whether he is complying with the IIA’s Standards?
• What do you like about his methods and what would you do differently?

While the book covers a fictional situation, it is useful even for experienced CAEs and audit managers. It is not uncommon to inherit an internal audit function in need of change, and Hernan has done a good job addressing multiple challenges.

In fact, I would recommend that anybody running a CAE roundtable or similar should have participants read all or a section of the book and then discuss and debate it.

I give it an overall “thumps up” – with the proviso that you don’t take what is done in the book as gospel, but think about whether you would do the same, and why.

Now, if you want to read a pure work of fiction, a novel featuring internal auditors investigating potential fraud and other issues, then Adventures in the Audit Trade may be for you (and it is priced as a novel). It was not written as an educational book like The Change Agent, but as a light read. It’s an adventure and has been called “an awesome read” (by a CPA firm partner) and “an enjoyable read” by a doctor with zero internal audit experience.