When an Internal Audit Client Shows You Who They Are – Believe Them!

Famed American poet Maya Angelou once observed: “When people show you who they are, believe them the first time.” I have always found that to be incredibly sound advice, in both personal and professional relationships. Those words came to mind recently when a chief audit executive (CAE) shared with me an experience with an internal audit client.

The saga started when a new director took over corporate procurement two years ago. The CAE’s staff met with the procurement director at the beginning of an internal audit, and they were warmly received. The director spoke glowingly about the importance of internal audit, and said he looked forward to the assurance they would provide about the effectiveness of procurement operations. Everyone left that meeting feeling good about the path forward.

However, it wasn’t long before the internal audit team began noticing a different level of cooperation and transparency compared with previous audits. It was harder to schedule meetings with procurement officials, and responses to interview questions seemed short and to the point. Gone were the friendly conversations about families and sports team loyalties. There also seemed to be less joy in the office, the CAE told me, and certainly less joy about meeting with the internal auditors.

Something just didn’t feel right, but the audit team was able to acquire access to the records and information they needed, so no there was no confrontation.

Once the audit was completed, the internal audit team held an exit briefing with the new procurement director. They hadn’t identified any major issues, but there were a number of areas identified for improvement. The director was advised that the overall rating would be “satisfactory.” He was polite and thanked the internal audit team for their insights.

Not long after the final audit report was issued, a member of the internal audit team ran into a member of the procurement team at their children’s school function. After some idle conversation about their kids, the internal auditor shared her regret that they hadn’t been able to catch up more during the recent audit. She went on to say: “In fact, it seemed you guys didn’t really want us around.” To her surprise, the procurement team member gave a very unguarded response: “Oh! That’s the new boss. He called us all together at the beginning of the audit and told us to ‘speak to the auditors only when spoken to and to offer only the information the auditors asked for.’ We all felt like we were being watched throughout the audit.”

The internal auditor shared the exchange with her CAE who simply wrote it off as “nerves” of a new director. He figured the procurement director had a bad experience with internal audit in his last job. The CAE was sure things would be better next time. But when the next time came, the script played out exactly the same: a positive opening meeting, a professional but distant environment during the audit, and a curt “thank you” at the conclusion.

Then the CAE shared with me the most disturbing part of the story. He had just learned that the procurement director had been fired for serious procurement policy violations. In fact, the case was being reviewed by the company’s general counsel, who asked for the final internal audit report and workpapers for audits that had been done since the director arrived.

The CAE was disappointed about the entire saga and asked me if I would have handled things differently. I shared that hindsight is always 20/20, and that he certainly shouldn’t second-guess himself. But I offered a few ways he might have approached things differently.

First, I pointed out that, when there is turnover in a key position like the head of procurement, that should be considered in the engagement risk assessment undertaken at the beginning of the new audit. The CAE confided that the team probably hadn’t done that, and had simply reused the audit plan for the procurement area that had been used repeatedly over the years. He acknowledged that was a mistake.

Then, I drew on Maya Angelou’s words and what I had learned a long time ago: “When an audit client shows you who they are – believe them the first time.” I suggested what he likely already understood: There were ample indicators that the director might not be trustworthy. I shared a similar story from my own years in internal audit. I noted that, as internal auditors, we must be objective, but we also must always maintain a healthy level of skepticism. If someone says one thing but does another, my skepticism meter reacts accordingly. My guess is that the procurement director’s two-faced actions were inconsistent with company policies and almost certainly violated the corporate code of conduct.

I also suggested that the CAE might have directly confronted the procurement director after learning that he had told his staff to “answer only the questions asked and to volunteer nothing.” I also likely would have discussed the issue with his boss, the COO. Finally, I would have personally attended the opening meeting of the next procurement audit, and stressed in front of the staff that we were looking for full cooperation during the audit, and asked the director to confirm that was his expectation, too.

I assured the CAE that I still might not have been able to fully anticipate what was to come and the director’s eventual departure. However, I suspect that taking some prudent steps could have given the team a better chance at identifying procurement policy violations.

Before I wrap up this blog, it is important to note that many internal audit clients show us who they are – and quite often, who they are is good. I had many clients who went the extra mile for my audit teams, making sure they had access to every shred of documentation needed, and the clients made sure their staff understood there would be zero tolerance for not cooperating. I believed them, too. I enjoyed a great relationship with the vast majority of my clients, but I always maintained my objectivity and professional skepticism.

The CAE walked away from our conversation hopefully feeling less guilty about how he had handled things, and with a better understanding for how to manage similar situations in the future. By sharing this story, I hope you will be well-prepared the next time a client shows you who they are.