Norman Marks on Governance, Risk Management, and Internal Audit

I am, of course, talking about people.

X

If you look at the root cause of almost every failure or missed opportunity, it comes down to people.

Yet, we don’t pay nearly enough attention to whether we have the right people in the right jobs. You could add to that ‘the right information and authority’, but that is provided by people too.

The Human Resources department is supposed to help everybody hire the right people, train and develop them, and (if necessary) fire people.

But my experience is that they usually get in the way.

They prevented me from hiring the best people for the job I needed done because (a) I wanted to pay them too much in their opinion (based on surveys of positions that were not comparable), (b) I wanted to call them managers (because that is what they were in their last job and reflected the authority and level they would have in this one) but they would have no staff, or (c) they gave preference to people who were not the best candidates, but had been with the company longer or met diversity goals. (I make no apologies for putting excellence ahead of diversity.[1])

When I was a vice president in IT, I completed the annual performance appraisals for my direct reports. All were rated 4 or 5 on a 5-point scale. HR said this was unacceptable and sent my boss, the senior vice president, CIO, to tell me to change it. My rating had to fit a predetermined pattern with only so many at each level, and I needed some to be rated below average – even though none of them were. I knew that such an unfair process would significantly affect morale and I would lose very valuable people.

The SVP told me I couldn’t rate everybody at that high level, so I asked him to name the best performers in his entire department of several hundred. All my direct reports were in his top ten! He relented and joined me in the fight with HR.

HR also prevented me from retooling the department when I inherited a team whose top speed was average. The CFO criticized me at one point for not running a world-class department when everybody was doing their best (and far better than they had under my predecessor). He changed his tune when I pointed out that I cannot fire people who are not under-performing. Equally, I cannot expect world-class performance from people who are not capable of delivering it.

In time, I was able (with no help from HR) to help them find other positions (advancing their careers in the process), slowly replacing them with more experienced personnel who could deliver greater insights and valuable advice. I left the company just one or two steps from my goal of world-class performance, but it was within reach.

X

We are not very good at calling a spade a spade.

Internal auditors shy away from informing management and the board (if necessary) when the root cause of an elevated risk and the failure of controls is people.

I have heard many times that auditors are not allowed to recommend hiring additional people when that is what is needed to address a significant source of risk. They are also fearful of saying that an individual is not competent – whether that individual is a trainee, a supervisor, manager, or C-level executive.

It is even more difficult when the problem is the CEO or even the board itself!

X

So what should we do about it?

First, we should recognize that while it is important to remove deadwood and have the right people for each job, we also need to appreciate and reward those who are truly excellent. (Achieving easy goals is not the same as being excellent.)

Management should be helped to assess whether their compensation and bonus programs are delivering the performance they need.

They should also be helped to understand whether people are being treated well and developed to optimize their potential.

X

Management needs to sit back and look in the mirror. Do they have the right people in the right jobs? Are the managers doing everything they should? Is HR a help or a hindrance? What actions need to be taken on all fronts?

X

Risk practitioners need to ask management to look in that mirror. If they see a shadow themselves, they should point it out. They can also work with management to consider the various options, what can and should be done.

X

Internal audit needs to be alert to poor performers, at any level. They also need to be alert to the failure to recognize and reward high performers, or to train and develop people so they can achieve their potential. Internal auditors should be brave enough to call a spade a spade.

X

The Board should ask management whether they have world-class people in every position, and what they are doing to develop and train everybody.

X

Organizations will only achieve their potential if they have the right people performing to their potential.

X

I recognize that these are difficult times. It is hard to get the best people, and it’s also hard to retain them.

It pays to dedicate time and money to preserving and enhancing the value of your greatest asset: people.

X

I welcome your thoughts.

[1] By fortune rather than anything else, my hires were predominantly female with a serious sprinkling of people of color.