Internal Audit Must Speak Truth to Power

“Speaking truth to power.” It is an expression that has been around for decades — often used in a social or political context. But it is also a concept with which many internal auditors struggle. In far too many organizations, those in a position of power and influence are simply not open to conversations around high risks or other uncomfortable topics — until it’s too late.

The challenges and risks facing organizations in the 21^st century are increasingly complex and, if ignored, potentially lethal. This requires those of us who provide assurance on governance, risk, and control to be unwavering in our conviction to examine all such threats.

On its face, this would seem obvious. Why would internal audit ever shy away from addressing risks to the organization? But, in reality, this happens every day. From toxic cultures to executive compensation, there are some risks that are avoided or just not talked about.

In the past, I have described these kinds of risks as “third-rail” issues, comparing them to the high-voltage rails that provide power to electric trains. While the power that surges through third-rail issues could easily damage internal audit’s relationship with management and the board, ignoring them could prove even more destructive to the organization.

That is why internal audit must be willing to “speak truth to power.” According to Shari Runner, President and CEO of the Chicago Urban League, “Speaking truth to power means believing deeply in what you say and fighting every day to have that heard. It may not be popular; it means taking a risk, it means standing for something.”

The concept of speaking truth to power when it comes to internal audit is more than just taking a stand. To me, it means addressing difficult or uncomfortable issues that management and/or the board would rather avoid. It requires internal auditors, especially chief audit executives, to have the courage to challenge taboo subjects.

I often wonder if some of the scandals that have engulfed highly successful organizations such as Volkswagen, Wells Fargo, and Equifax could have been avoided had internal audit fully assessed relevant risks and addressed the root causes that ultimately led to the debacles.

Speaking truth to power requires internal audit to be resourceful as well as courageous. Resistance to taking on taboo subjects is almost guaranteed. Management may put up barriers, such as limiting access to records, to block internal audit from taking on those tough issues. But internal audit must find ways to overcome those barriers. For example, Cynthia Cooper’s team worked after hours to gain access to computers to unearth the $3.8 billion fraud at WorldCom.

Speaking truth to power is difficult, but it can be done effectively. The key is conditioning those in power to want to hear the truth. Here are four steps to putting stakeholders into the right frame of mind to address the hard issues:

• Nurture the right kind of stakeholder relationships. Ideally, stakeholder relationships should be built on mutual respect and a clear understanding of internal audit’s role and value to the organization. If this is not your current relationship, you must work to change that.
• Resist efforts to box internal audit into a limited role. If stakeholders pigeonhole internal audit, for example, into financial and compliance assurance roles, attempts to address taboo subjects outside those areas will fall on deaf ears.
• Prepare stakeholders for the inevitable showdown. Speak openly to the audit committee and board about how they might handle difficult findings. Stakeholders should understand there may come a day when internal audit will be the bearer of bad news or findings that management vehemently opposes. Relationships built on mutual respect can survive contentious disagreement.
• Discuss with stakeholders that there are often greater risks in ignoring or looking away from risks that could yield “bad news.”

I want to make clear that the steps I’ve outlined here are not prerequisites to speaking truth to power. They will make it easier to do so, but working in less-than-ideal conditions doesn’t excuse internal audit from taking on taboo or difficult subjects.

I’ll add one important caveat. Internal audit must be in a position to back up the tough talk. Taking on executive compensation or delving into legal or human resources issues will not only require resourcefulness and courage, it also will require the competencies and expertise to get it done. Make sure you assign or bring in the right talent to examine those difficult subjects. The key word in the phrase “speak truth to power” is truth. So, make sure you get it right the first time and every time.

In developing my thoughts on this subject, I searched for just the right word to describe the characteristic or trait to describe what it takes to speak truth to power. The word I settled on is fortitude. The dictionary defines fortitude as, “courage in the face of pain or adversity.” I would alter that slightly to add the word anticipated or expected. Fortitude in this context means having the courage to take on the tough issues, knowing it may create professional and even personal adversity.

This year, my intent is to focus my writings on subjects that define great internal audit departments and the outstanding internal auditors who comprise them. The dynamics and complexities of modern business risks demand every part of the risk management process to operate effectively and efficiently. This includes internal audit, and an integral part of internal audit’s role is to speak truth to power.

As always, I look forward to your comments.