Norman Marks on Governance, Risk Management, and Internal Audit

I had the privilege of working with Mike Jacka as a member of an IIA International Committee for many years. He’s not only smart, but funny – a great speaker if you can get him.

He continues to write for the IIA’s magazine and blog.

His latest is Mind of Jacka: Not Quite a Manifesto.

Mike shares an interesting list of what he calls “the more intangible, human elements that allow us to function amid the contradictions that define our profession. To quote a fairly famous document, we hold these truths to be self-evident.”

I agree with the underlying premise, that internal audit exists to help the organization and its leaders succeed. It’s not about finding fault. It’s not about making ourselves look good and boasting about how much value we deliver.

While there are times when we have to be the cop, finding serious issues that threaten the success of the organization, most of the time we should be the consultant, providing valuable assurance, advice, and insight on what matters to the success of the organization.

Some auditors prioritize finding fault. For example, I knew one CAE who told his team that an audit report with no findings was unacceptable.

These auditors will not gain the trust of management. They will not be seen as helpful, only as potential impediments that consume valuable time.

Management will hide things and certainly not invite them in. They will resist and not be interested in working together to identify the best path forward.

I don’t believe in that approach, that mindset.

Do your testing and assessment with the objective of confirming everything is ok, rather than to find fault.

Recognize that success is a shared success – the success of the organization.

Here’s Mike’s list. I have highlighted my favorites.

• We want to make things better.
• We want to make our departments better.
• We want to make our profession better.
• We want to make our organizations better.
• We want to make ourselves better, as well as those around us.
• We are partners with the organization and the people who work within that organization.
• No matter how much we are battled, beaten, and bruised, we still recognize that we are partners.
• We have our egos, and we succumb to them, push them aside, or use them to become better.
• Our clients have their egos, and we bow to them, fight them, or use them to understand how we can better work with those clients.
• We take an active role in the success of our organizations, not sitting back and letting events happen around and to us.
• We have a unique blend of skills, access, and opportunities.
• We grab our opportunities, allowing us to place ourselves into the consciousness of those with whom we work.
• We don’t have all the answers.
• Sometimes we don’t have many answers.
• Sometimes we don’t have any answers. And there is nothing wrong with that.
• We are salespeople.
• We are selling ourselves.
• We are selling assurance.
• We are selling improvement and betterment.
• We are not selling a report.
• We know we can count on each other — as professionals, as businesspeople, and as human beings.
• And, ultimately, we are nothing more than people working with people to raise the bar in everything that is done.

I expect some will say that some of these are wrong, because we must be both independent and objective.

Yes, we must be independent within the organization, and we must be objective in our assessments and reports.

But that must not interfere with our ability to help the organization succeed.

We need to have that mindset and have it drive our actions as auditors and trusted advisors to the business.

Don’t be the person who is seen as always finding fault.

I welcome your thoughts.