Feed a Fever, Starve an Internal Audit Function

Earlier this week, I came across an article that discussed an ongoing dispute in Delaware over funding of the State Auditor’s office. Partisan politics appear to be at the root of a debate over more than US $2.5 million sought by the State Auditor to make his auditors’ pay scale more competitive. The title of the article, “Delaware Auditor: Low Pay Could Muzzle ‘Watchdogs’,” might be a bit sensational, but don’t underestimate the effectiveness of purse strings toward containing internal audit functions in government or the corporate sector.

First, let me say that a vast number of corporate executives and government officials demonstrate appreciation for a strong and effective internal audit function and the oversight it can bring. They understand that internal audit is crucial to an organization’s system of risk management and internal controls. And they know that, as the third line of defense, it also must be adequately resourced and staffed with talented and energetic internal audit professionals.

Despite the norm, I have witnessed a number of cases over the years where strong and effective internal audit functions are just not welcomed by nefarious executives and government officials who are more interested in having a “lap dog” than a “watch dog.” A few of these officials take the position where, as far as internal audit is concerned, “if you don’t feed it, it can’t bite you.” So, they squeeze or contain internal audit’s budget so that talented and capable internal auditors cannot be hired or adequately compensated.

What is a chief audit executive (CAE) to do? Where the government audit model is concerned, I believe the Delaware State Auditor is doing the right thing. Once all internal options to obtain appropriate funding have been exhausted, making your case publicly can motivate elected and appointed officials to reevaluate their position. Shining a light on deliberate underfunding o​f government audit functions can certainly stimulate action.

In the corporate sector, publicity is almost never an option. Instead, CAEs who feel strongly that their functions are being underfunded should have frank and candid conversations with their audit committees. Lay out in appropriate detail which risks are not being addressed by virtue of funding/staffing limitations. Itemize the internal audits that will not be accomplished in the year ahead. If you are convinced that internal audit is not being adequately resourced, and the audit committee is unwilling to intervene, you then may need to make the final statement on the subject with your feet. Walking away and finding an organization that appreciates the value of internal audit can be liberating.

I realize the tone of this blog is a bit strong. Perhaps the Delaware situation struck a nerve with me. I have seen too many cases in which internal audit functions have been rendered ineffective by simply starving it of the resources it needs.

As always, I welcome your views.