Is the Future of Internal Auditing as a Gardener?
Dr. Rainer Lenz is more than a CAE and long-time practitioner. He also teaches corporate governance and auditing, and has been an independent board member and a finance executive.
Rainer was recognized by Richard Chambers as one of the top ten internal audit thought influencers.
He has been talking about the value of internal auditing for years. In January 2016 he wrote Effective audit: inspiring change. As he eloquently points out, many internal auditors need to change their own attitudes towards the role of internal audit if they are to be effective in persuading management to change.
In 2020, he was one of the authors of Defining, Measuring, and Communicating the Value of Internal Audit. Rainer and I have discussed this and other topics over the years, including my view that the only way to measure internal audit value is through the eyes (and opinions) of our customers in management and on the board. Are we helping them in a significant way lead and direct the organization for success? Are we providing the assurance, advice, and insight on issues that matter to them in a way that helps them and the enterprise achieve their goals and objectives?
X
More recently, he has been talking about the idea of the future role of internal audit as the “Gardener of Governance”. He presented on this at a conference to mark the 70th anniversary of the Scandinavian chapter of the IIA in October, 2021. You can see his slide deck here. His primary point is that internal audit has been paying insufficient attention to Governance.
On his blog, Rainer said:
Internal Auditing is projected to be a declining job and is at a crossroads. On the micro level, in organizations and institutions, stakeholders may see less and less value in the contributions from Internal Auditing, and on a macro level, this projection jeopardizes the legitimacy and relevance of Internal Auditing as a profession.
I have not seen that myself and hope his view is incorrect.
X
Dr. Lenz has now co-written a paper, The Future of Internal Auditing: Gardener of Governance that merits our attention. After I read it earlier this year, he and I talked about the need for internal audit to deliver on the Core Principles of Internal Auditing (from the IIA), providing the forward-looking assurance, advice, and insight on issues that matter – the risks and opportunities that will affect the achievement of enterprise objectives.
My belief is that if internal audit functions can deliver on those principles, they have a very bright future.
He suggests that the profession needs to focus on 5 areas:
- The Planet
- The Public
- The Profession
- Prosperity
- The People
While I don’t agree with all of his comments (for example, he encourages data analytics or process mining as a continuous audit technique while I prefer that management use them for detective controls), he makes a number of good points and his paper is worth our attention.
This is how he explains the concept of the auditor as a gardener:
Gardener builds on prior work by Sarens et al. (2016), “we need to be more like farmers” and views the internal auditor as respectful towards nature, caring about creating the right environment for plants to grow given the weather and soil conditions. Internal auditors must sow the seeds, fertilize, water and nurture the plants, continuously check the weather forecast and adapt plant nurture to this, occasionally weed the weeds, all done while being patient and humble, but also result-driven and outcome focused. Internal auditors work indirectly and so their impact is through others. We suggest that viewing internal auditors as gardeners is a promising metaphor with which to position internal audit can strengthen its value proposition.
Later in the paper, he says:
Gardening as metaphor softens the negative perception of internal auditing as preoccupied with finding errors and of auditors as grey, dull, bean counters. Gardening creates immediate, visible results, which all can enjoy and appreciate. It is even beneficial for your health, research shows (Soga et al., 2017). So, the Gardener of Governance has an emotionally positive connotation. Internal auditors as gardeners shall signal empathy, too. Audit clients should feel invited and safe that internal auditors are focused on collective improvement going forward, rather than on finding errors. Having the right mindset to develop trust is key. Beware “gotcha” type of individuals for they will perpetuate the negative stereotypes. The human aspects of how to approach internal audit are critical. An “inviting personality” is one that demonstrates empathy and can quickly gain and develop a trusting relationship (Garyn, 2021).25
X
Do you like the concept of the internal auditor as a gardener? Does it resonate with you and will it be meaningful to our customers in management and on the board?
Or do you prefer Tim Leech’s objective-based auditing?
My preference is similar to Tim’s. I don’t think we can provide assurance on the achievement of objectives, only on how management addresses the risks and opportunities that matter to their achievement. (Risk officers, however, should be focused on helping management make the informed and intelligent decisions necessary to achieve objectives. They should be working with those responsible for performance management so that leadership understands whether there is an acceptable likelihood of achieving each of the goals and objectives.)
I welcome your thoughts on this topic.
X
I commend Rainer for his continued desire to stimulate our thinking on the value of internal auditing and how it can be upgraded in the future.
At the same time, I am grateful for his kind words in his review of my latest book, Auditing at the Speed of Risk with an Agile, Continuous Audit Plan, which he calls “a must read for internal audit professionals”.
Rainer tells me that he is going to focus on his CAE role for a while. We will miss his advocacy for internal audit, and I hope he is able to share more of his insights at some point in the future.
Leave a comment
Norman Marks on Governance, Risk Management, and Internal Audit 
I find the gardener metaphor an extremely and delightfully useful idea. Helping towards the absolutely imperative escape from the dour image. I am really carried by its positive connotation. The problem might be that it would indeed confine the available supply of qualifying auditors to those with an “inviting personality”, a rather tall order, although not unbefitting of a profession that I consider as very much one.
Thank you, Norman, for your comprehensive review, both appreciative and critical. This co-authored article about The Future of Internal Auditing: Gardener of Governance (https://www.tandfonline.com/doi/full/10.1080/07366981.2022.2036314) will be my main contribution this year. Let us see what that article will be worth. The discussion in the professional community will tell. It is now time for me to listen: I am particularly interested in what I do NOT think myself. Moreover, given my seniority, I will not be part of the future generation of internal auditors. The emerging leader of this profession could build on this (or ignore it) and could actively contribute to this discussion of the future direction, drive that dialogue. I will rest silent for some time, at least no further publications for the time being. I said what I had to say. You might hear my perspective and advocacy for internal audit – whatever it is worth – via different avenues going forward, including presentations at internal audit events and interviews.
Being a gardener, and having visited gardens, both large and small, I don’t see internal auditors as gardeners. Gardeners deliver the objectives of the garden owners. These may be fruit and vegetables or a sweeping vista across huge lawns. Gardeners produce, just like most other functions in an organization. They do not provide opinions on the management of aphids, slugs, snails, diseases and everything else which tries to destroy your newly planted seedlings. They just act to mitigate these threats.
Dr Lenz writes ‘Gardening creates immediate, visible results, which all can enjoy and appreciate’. I’m afraid it doesn’t. There is soil to prepare, seeds to plant, seedlings to plant out and slugs to control. The result is lovely but not immediate.
I’m not sure where internal audit fits into gardening. I certainly wouldn’t like to tell a head gardener that he/she had planted roses in the wrong place.
I think internal audit’s main role is to provide an opinion on whether the business understands its opportunities and risks and is managing them properly. It’s boring, but somebody has to do it.
Dear dr. Lenz,
Thank you for sharing this article. It is really excellent, written in an easy manner, interesting and easy to read and above all qulity and competent with reasonable point of view onto internal auditing, so it is easy to comprehend it! Although, I am primarily an external auditor I agree with Arena & Jeppesen quotation – “to capture the internal audit jurisdiction and to avoid subordination to external audit, internal audit needs to differentiate its knowledge base from financial auditing”. Internal auditors are not professional accountants and the scope of internal audit differs from an external audit.
Furthermore you have concluded “We believe that internal audit needs to reduce the variation of practices to focus on what differentiates it from external audit, i.e., internal auditing’s ability to engage with an organization’s governance processes, which external audit for independence reasons cannot do”. Otherwise, if internal audit (IA) does not differentiate itself from external audit (EA), then what would be the purpose of IA? In that situation EA would be sufficient. We need to be truthful and acknowledge that EA is not enough and cannot accomplish the same scope of work as IA can, so that fact underlines righteousness of your conclusion.
Nevertheless, you are right when you say “Internal auditing’s main competitor is external auditing”. Unfortunately that is true and continuing in that manner I would add external audit to your list of those who don’t (want to) understand internal audit. However, I strongly believe that at the same time external audit could “promote” and “add value” to internal audit through reliance and appreciation of internal audit’s work.
Eventually, I would be free to add a word and expand your conclusion: “To promote internal auditing, we believe it is crucial to influence regulators, EXTERNAL AUDITORS and boards alike, heightening awareness and appreciation of internal auditing’s value proposition”.
It is needed that we external auditors ask ourselves: Is external audit a profession of practitioners who have strong ethics and integrity and who are ready to acknowledge work of internal audit? Are we ready to acknowledge that IA practitioners could do quality audit and that external auditors, boards, regulators and public can rely on their work? The answer has to be “YES” for the sake of both professions.
Just one comment on your excellent reply: many internal auditors are CPAs or the equivalent with as much or more experience in auditing financial statements as the external audit team. Many have moved into IA after a career with a CPA firm – some rising to manager, senior manager, or even partner.