World Class Internal Audit
World Class Internal Audit
Table of Contents
Introduction
Chapter 1: In the beginning
Chapter 2: I am obdurate
Chapter 3: Too much quality
Chapter 4: The value of criticism
Chapter 5: The value of writing and teaching
Chapter 6: The value of curiosity and research
Chapter 7: The executive attention span
Chapter 8: You are how others see you
Chapter 9: The search for charisma
Chapter 10: The root cause
Chapter 11: Do we speak the same language?
Chapter 12: WIIFM
Chapter 13: Where do I go from here?
Chapter 14: Wearing a white hat
Chapter 15: Awkward days
Chapter 16: A great but unlikely compliment
Chapter 17: When to suggest an answer
Chapter 18: Learning about limits
Chapter 19: Empathy
Chapter 20: The customer
Chapter 21: The best job I ever had
Chapter 22: Hiring the best
Chapter 23: Humility and respect
Chapter 24: The risk-based internal audit plan
Chapter 25: My first frauds
Chapter 26: Not all auditors hate risk
Chapter 27: Loretta and Wow! audit projects
Introduction
I have never said that I was a world-class internal audit leader or that my team was
world-class. I dont believe that anybody should presume to make that claim about
themselves. It is arrogant and may well not only be wrong but an indication of
complacency that there is no need to change or seek improvement.
That doesnt mean that I am humble because I am very proud that many whom I hold in
high esteem have put us on a pedestal. It is they who have said we were world-class.
Members of the audit committee said that when they think of the ideal internal auditor
they think of me (which makes me uncomfortable), while executives said that internal
audit provides me with a competitive advantage, your team has not performed an
audit I wouldnt gladly pay for, internal audit helps us stay efficient, and Norman,
you dont behave like an internal auditor.
I confess that the last is precious to me, coming from a curmudgeon of a senior vice
president of human resources who started off laying down the law that internal audit
was not welcome and had no value to her, but realizing after an operational audit that
we had helped her solve a troubling organizational problem. Not only did she write a
flattering letter of appreciation to my boss and his boss, but she let me drive her
Cadillac!
In addition, my team and I have been profiled as innovators in the magazines of the
American Institute of Certified Public Accountants and the (Global) Institute of Internal
Auditors. When Protiviti (then Arthur Anderson) started to profile world-class internal
audit departments, we were proud to be their first selection.
This book is a series of short stories about episodes from my professional life that gave
me precious and enduring lessons. Taken as a whole, they explain who I am today and
how I have practiced internal auditing as a chief audit executive for more than twenty
years.
My hope is that these stories will amuse as well as provide some insights into how I
came to lead internal audit departments as I did.
Maybe, and this is why I wrote the book, it will stimulate some thinking on your part.
If I have been recognized as leading world-class internal audit functions, it is because I
have been extremely lucky to work with and learn from many world-class
professionals. From audit committee members (including Wes Scott, Charlie Luellen,
Greg Myers, Clarence Frame, Joe Ingrassia, Wayne Budd, Kurt Lauk, and so many
more), to top executives (such as Tom OMalley, Jay Allen, John Schwarz, C. S. Park,
Joe Tang, Chester Lin, and more), to members of my audit and other teams (a list too
long to mention here). Where I can I have paid tribute to them in each story and as many
as I can remember are listed in the Acknowledgment section at the end of the book. My
apologies in advance when I have forgotten to include individuals and mention their
contribution.
Einstein said A person who never made a mistake never tried anything new. I am no
Einstein and I have made at least my share of mistakes and some were huge!
However, every mistake is an opportunity to learn. Many of these stories are about my
mistakes and what I learned from them. If I share them with you, it is so that you will
either not repeat them or will at least make smaller ones!
Now that I am retired, I am enjoying reliving these memories and I hope you find them
of value.
Later in the training course, our instructor had a moment of levity and told us a true story
about the firm. Apparently, the partners had written a letter to the Lord Mayor of London
congratulating the city on its anniversary. The writer added a paragraph that described
how the firm had been a prominent part of the city since its founding in 1854; perhaps,
he suggested, the city might recognize the firm by renaming the street on which it had its
offices (Gutter Lane) as Cooper Lane.
The Lord Mayor wrote a formal letter in reply, noting that while the firm had a long and
highly respected history dating back to 1854, the city and the street (Gutter Lane) had an
even longer history that pre-dated the great fire of London in 1666. Perhaps, the Mayor
suggested, the partners might consider renaming the firm as Gutter Brothers!
Pomposity, meet your match.
After a few more weeks, I was allowed to join the ranks of the auditors. In between
audits, I was in the office studying for my Chartered Accountants exam and became
curious. I was working for an audit senior, who reported to a supervisor and then to a
manager. But nobody had ever told me what title I had. What should I call myself if
anybody (especially a girl) asked me what I did? So I went to that senior and asked him.
He smiled at me and suggested I have a look at the rate sheet (a schedule that showed
all the ranks, from partner on down, and what their standard hourly rate was). He told
me that my position was listed at the bottom of the sheet.
I found one and read it. I saw partner, principal, senior manager, manager, supervisor,
senior, semi-senior, executive secretary, secretary, copy typist, receptionist, and other.
Yes. That was me at the bottom, below the copy typist and receptionist. I was an
other.
I could have been upset. Oddly, I was amused (I will admit to being jealous that the
copy typists were paid more than me, a graduate of the LSE!) and have fun telling the
story to this day.
I learned a valuable lesson from this. No matter how high you see yourself, how
magnificent you look in the mirror of your vanity, others may see you as a pompous
nitwit or worse.
Another situation, many years later, reminded me never to think too highly of yourself.
As the new Vice President of Internal Audit of Solectron, I visited our Singapore
offices. My regional audit director, Audrey Lee, was based there with her team.
My flight from San Francisco did not arrive until just after midnight local time, so
Audrey was smart enough to tell me that she would pick me up at my hotel at about 10
am. She drove me to the office and as we got off the lift I asked her where I could get
some coffee. I really needed it! She said, But Norman, you have to meet Chester first!
I looked for a sign to the coffee as I asked her who Chester was. She told me that he was
the President of Solectron Asia Pacific and he was waiting to see me.
Reluctantly, I let her take me in and introduce me to Chester. She took my bag and left to
get coffee for me. Chester was a gracious gentleman and we talked for the best part of
an hour.
I felt proud of myself for being able to talk business with a senior executive despite my
jet lag, never having been in the region before, and only having a couple of months
experience in the business. I remarked to Audrey that I felt the meeting had gone well
and that I had built the start of a good relationship with Chester.
She looked at me with amazement.
Norman, Chester was speaking to you in Mandarin for the last twenty minutes!
That put me in my place. Fortunately, Chester didnt realize it either and we did, in fact,
have an excellent relationship. The incident didnt seem to affect Audrey, either;
probably because I eventually woke up and we had some constructive conversations
about the business and how we would run internal audit.
Respect is not the result of a title, or the fact you are the son of the managing partner and
a partner yourself (whether you earned it or not), or a vice president from the home
office.
No, respect is earned by your actions and needs to be maintained and enhanced by
continued excellence.
Chapter 2: I am obdurate
You learn things in the strangest ways.
After about a year with Coopers, I had worked on the audits of several companies under
a number of audit seniors and supervisors. I felt that I had learned a great deal and my
managers had told me they were pleased with my work.
So, when I was called in to meet with the group manager (a grey-haired individual who
sat just below the gods) I was reasonably confident that I would get a decent
performance appraisal. Let me tell you a little about him, to set the scene. Gordon, who
I grew to like a great deal in future years, was a single male of about 50 who knew that
he was never going to be a partner but had settled into the comfort of running a team of
managers and staff of about 30 people. I had only met him once before, when I joined
the group as a freshly-minted other.
Now here I was, in the company of this nearly great man, to receive feedback on my
performance. Gordon greeted me in a way that was more lukewarm than either formal or
welcoming. I sat nervously and listened as he went through the early sections and
explained that his comments were based on the feedback he had received from the
seniors and supervisors I had worked for; he didnt have any personal observations
since he had not supervised any of my work directly. The ratings were good, but
somehow I knew that a bomb was about to be dropped.
He got to a section of the appraisal form where it asked about my ability to take
direction. His tone changed slightly and he told me that I was below average and that I
had been obdurate. Fortunately, I knew what the word meant: stubborn, unwilling to
change your opinion, and unmoved by persuasion. But I still asked Gordon to explain
since I was surprised to hear this. He told me that he when he talked to my managers
they told him that when they gave me directions I consistently asked questions rather
than just doing what I was told.
This surprised me even more and I asked Gordon why this was a problem. None of my
managers had said anything to me and I thought that the only way I would learn is by
asking questions.
The bomb exploded.
Gordon told me that my behavior at the very moment was proving the point! I was being
obdurate by not accepting the verdict of authority. My questions were an example of not
being able to take direction and he believed the rating was correct and appropriate. His
words and manner were stern and unforgiving.
I felt the pain, but was even after the blast unwilling to accept the verdict. How could
asking my managers to explain what they wanted from me be wrong? Each of them had
been very responsive and helpful, without any indication that what I was asking was
inappropriate. So, I went to each of them and asked and was relieved when they
assured me that asking questions was not only appropriate but expected if I was to learn
and progress. Gordon was, they said, an old school manager and had interpreted their
comments in the context of his personal experience and bias that junior staff
(apprentices) should be obedient and not question their masters. They also assured me
that I was not obdurate. Once I understood what was needed, I was able to follow
directions and use my common sense and training to get the job done.
Over the years, I have continued to ask questions when I dont understand something
rather than simply do what I was told. I believe very strongly that only when people
have a solid understanding of why something needs to be done will they do it well.
That lesson applies in several ways. As auditors, we often ask why people do things the
way they do. We dont accept the answers because we have always done it this way,
because we were told to do it this way, or even because the last set of auditors told
us to do it this way. Those are not good answers; in all likelihood, they indicate that
the work is not being done correctly.
As auditors, we should not fall into the same trap. When we rely on a checklist or last
times audit program to tell us what needs to be audited and what work needs to be
done, we are doing what somebody else has decided is best in a different (even if
similar) situation. A checklist is a useful reminder or way to test your own assessment.
But it should never be followed without understanding what needs to be done and why,
and questioning what it tells you to do.
Many years later, I was with a large savings and loan company (very similar to a midsize domestic bank). After a few years in their internal audit department, leading among
others the IT audit team, I had moved into IT management with responsibilities that
included information security. Randy, one of my former IT auditors and a gentleman that
I had hired and thought well of, was performing an audit of our information security
program. He met with me to review his preliminary findings.
Randy told me that we had a serious control weakness in that we didnt change the
phone numbers people used to dial into the data center. They needed to be changed at
least once every quarter; otherwise there was a risk that over time the numbers would
frequently. Incidentally, my manager (a senior vice president) and his manager (an
executive vice president) were both quite concerned about the politics of disagreeing
with an audit finding, but they trusted me to see it through.
A few years later, I joined Tosco Corporation as the head of internal audit, the start of
some twenty years in that role. While I allowed the use of books, standard audit
programs, and checklists as tools to remind auditors of areas to consider, I insisted that
they were only a tool. Common sense, an understanding and appreciation of the
business, and knowledge of risks and opportunities can never be replaced.
There is a magic word in the English language and it is Why. It is a far more powerful
tool than any checklist or book.
may misrepresent (e.g., on their resume) their experience and the Human Resources
department doesnt do enough to check.
I had a different surprise on another audit, one of the first where I led the on-site audit
team after my promotion to audit senior. The client was Hercules Powder Company
(HPC), the UK subsidiary of an American multinational, Hercules Inc.
Before I get to the surprise, let me tell you about a curious and somewhat amusing
incident.
For tax reasons, at the end of December HPC contracted with the Dutch division of
Hercules Inc. to purchase a significant quantity of raw materials. It was an unusually
large purchase that would meet the UK divisions needs for a few months. The inventory
was stored in Holland in a company warehouse owned by the Dutch firm, but was
physically segregated while it was waiting for shipment. So, at year-end the UK
division accounted for the purchase as inventory owned by them. This was correct
according to UK accounting rules. However, according to Dutch accounting rules the
inventory needed to be recorded as owned by the Dutch division.
The value of the inventory was material to the financial statements of both divisions and
the Dutch audit team (the local affiliate of our firm) advised us that they would have to
issue a qualified audit opinion on the Dutch divisions financial statements if they did
not record the inventory as theirs. The Dutch audit team had a problem because the
purchase was unusually large, very close to year-end, and the inventory had only been
moved within the Dutch warehouse to a segregated location.
I discussed this with my manager who reviewed it with our partner. Their conclusion
was that we (the UK firm) would have to issue a qualified audit opinion on the HPCs
financial statements if the inventory was not recorded as owned by the UK division!
What a mess!
I wrote on behalf of the UK firm to the US audit team. They replied with the wisdom of
Solomon: both the UK and Dutch divisions should record the inventory as owned by
them, and the US parent would make an appropriate adjustment as part of the
consolidation process.
This was a resolution that satisfied everybody.
Returning to the surprise, this was my third year as part of the audit team. I was assigned
as a junior associate when Coopers was appointed auditor of Hercules Inc. My audit
supervisor, a great mentor, was Kevin Gilbert. He taught me the value of using
analytics, trends, and ratios as an audit technique. Hercules used a wide variety of
chemicals in its manufacturing of an equally extensive number of products. Kevin
developed a set of what we might now call metrics or performance indicators and used
them to detect unusual patterns in inventory levels, margins, and so on. When combined
with audits of the controls in key processes and physical inventory inspections, this was
an effective method that kept the cost of the audit at a relatively low level.
I became fairly proficient in this technique and when Kevin was promoted (deservedly)
to manager and I was appointed the senior in charge of the audit, I extended their use.
Since I was very familiar with the technique and the rest of the team were able to follow
Kevins audit approach (the prior year workpapers were an excellent guide), we
completed the audit with about 15% fewer hours than in the prior year!
The closing process also went very smoothly with just two exceptions: the first was the
issue of the large purchase of inventory from the Dutch division. The other was that we
had to finish our fieldwork and write the summary for the partner by candlelight! This
was a time of union unrest in the UK, and the miners called a strike that left much of
London without electrical power, including my team of auditors. Even though we were
working late into the evening to complete the documentation by candlelight, we all
stayed at our desks although we did move closer to the windows so we could get a
little illumination from the streetlights.
When I returned to the firms offices at the end of the audit, I received a note from the
group manager. Gordon directed me to take all the workpapers to the partners office.
The partner, Chris Lowe, wanted to review them. Now this was very unusual. Partners
generally relied on the managers to review workpapers, but Gordon told me that Mr.
Lowe wanted to see them. My guess was that he wanted to assure himself that all the
work had been completed, because it was done so much faster than in the prior year.
I took them up to his office and left them with his secretary. Then I waited and waited,
trying to be patient. I had confidence that all the work had been completed, but didnt
feel good about the time the partner was taking to return them.
Eventually, I got them back with a note. Mr. Lowe wrote this:
These are the best workpapers I have ever seen.
My heart leaped and a smile started to spread. But he continued:
You spent too many hours on them.
Surprise!
My first reaction was confusion. I had completed the audit in record time and built nighon perfect workpapers in the process. Why was he complaining?
I asked Kevin. He sat me down and congratulated me for the praise part of the note.
Then he explained what Mr. Lowe was saying.
Kevin told me that every hour spent on an audit was a cost and as a partner Mr. Lowe
saw any extra hours as reducing his personal share of the firms profits. While the
quality of my work was commendable, it didnt need to be that good.
Kevin explained that the good far outweighed the negative and that Mr. Lowe was
actually very pleased with the audit. However, the surprising criticism made a huge and
lasting impression on me.
This experience led me to question the value of workpapers when I became a chief audit
executive (CAE). While there is a clear need to document the work done as an external
auditor (for protection in the event of litigation), the same need is not necessarily
present for the internal auditor.
The work of internal auditors is not reviewed by examiners or regulators, while
external auditors work is
The opinion of the internal auditors, with the exception of government and similar
environments, is for internal use only
Internal auditors are rarely sued, whereas the external auditors may be sued by
investors who rely on their published audit opinion
While the International Standards for the Professional Practice of internal auditing
require that there be evidence to support the internal auditors assessment, they dont
mandate working papers in the same way that external auditor standards do
There is value in working papers:
If findings are disputed, the working papers provide evidence in their support.
However, the facts behind audit findings are not often disputed; the debate with
management, if there is one, is usually how to interpret the findings and assess the
risk they represent
Working papers are necessary if litigation is anticipated, such as in the case of a
fraud investigation. This points to a need for working papers for investigations, but
not for all internal audits
Working papers enable a manager or supervisor review. However, most internal
audit departments document in more detail than required for a manager to confirm
About 15 years after the Hercules audit, I was the head of internal audit at Tosco
Corporation. Tosco was an oil refining and marketing company (more later) and I made
a point of meeting with the internal audit departments of other oil companies to
benchmark and compare practices. One of those companies was Atlantic Richfield
(Arco), a much larger company than ours based in Los Angeles.
I met with the Arco managers separately from my meeting with the CAE. One of my
questions was what is the typical length of one of your audits? The first part of the
answer was not relevant to this story, but it is amusing: the audit team spends as many
hours as were budgeted. In other words, if they were able to finish early, they found a
way to draw out the time. If the time budgeted was insufficient, they dropped areas from
the scope of the audit. They used the example of an audit in Hawaii. It was usually
budgeted for two weeks. If they finished the fieldwork in less time, they would move to
the beach!
I shared that we used a technique called stop and go auditing, where we would extend
the audit if the risk was higher than expected and we needed more time to address it, but
we would also cut short an audit if the risk was lower than anticipated. We always had
more areas to audit than available resources, so if we could cut an audit short then the
time we saved could be used for another audit.
Arcos second answer was that their average audit was about 1,000 hours in length. I
asked why, because our typical audit was no more than 200 hours and I tried to keep
most audits below 100 hours.
The Arco managers explained that an estimated 60% of their time was spent
documenting their work for review.
There is no way that audit documentation should take such an enormous percentage of
total time. If my internal auditors spent more than 10% of their time on working papers,
I would need to know why.
These days, many departments have automated their working papers. However, I still
have to question why they are spending scarce budget dollars on software to automate
working papers. I suspect they are falling into the trap of documenting their audits
because that is what they have always done (especially if they have never set aside their
public accounting training), and the new software helps them do it in a consistent and,
perhaps, less expensive way. It certainly does help when a manager wants to review
working papers from his office without going to the audit location. But is that sufficient
justification?
If we, as internal auditors, asked a business process owner why are you doing this,
would we accept the answer of because we have always done it this way? We would
not. We would look to a valid business reason. The same holds for working papers: we
should have a valid business reason for preparing working papers and for setting
standards for them. That reason should balance the value and the cost (especially the
opportunity cost) of working papers.
confirm that I hadnt received any training, which I was pleased to do.
We then spent a productive couple of hours as he essentially trained me by reviewing
what I had done, explaining why it was wrong, and showing me what I should have
done. I left invigorated and went back to my desk to redo the entire set of workpapers.
Did I get them totally correct the next time? No. But the number and level of review
comments was at an acceptable level and easy for me to address.
My manager heard about the level of review comments and was quite critical. He told
me that I had not represented either myself or the team well and the hours I had spent on
the work were excessive. Frankly, I thought his criticism was unfair but I had learned
my lesson and accepted it (while simmering inside).
I was a good auditor, understood the basic business processes, and had respectable
flowcharting skills. But I didnt understand the fundamental principles behind my task. I
had neither training nor experience on which to base my documentation and assessment
of the computer controls within the revenue and payables business processes.
Over the years, I have come to learn that if you are to be effective in any position you
have to have a solid grasp of the fundamental principles. If you have that understanding,
you have a firm foundation on which to add technical and other skills and build
expertise you can rely on.
Coming back to the criticism.
Jarlath gave me constructive, fair, and clear criticism that helped me not only fix what
was wrong but understand why it was wrong. The latter was critical and I am grateful to
this day for it. He criticized my work and not me as a person. Although at first his tone
was harsh, when he realized I hadnt received the training that I was supposed to have
received, he became as much a teacher as anything else.
The criticism didnt hurt; it educated and changed me.
Two postscripts are of note.
A few months later, I received a message from the CAG group. They offered me a place
on their team starting in January. Apparently, Jarlath had told his manager that given I
had zero training, I had in fact done quite well. My second effort had even impressed
him. I accepted the offer and havent looked back.
Two years later, as a CAG manager, I was asked to work with a manager from the New
York office on a project to develop the global firms approach to data center audits (see
Chapter Six). My manager introduced me to the US team member, who turned out to
would learn about new technology, determine how it would affect our clients
businesses and our audit of their financial statements, and then share that information
with the rest of CAG. I had a small budget so I could attend seminars, etc. and subscribe
to appropriate technical journals.
One of the first expeditions I took into the land of new technology involved attending a
series of sessions on data bases at the British Computer Institute. I heard about all kind
of data base structures, schemas, sub-schemas, and more. It was fascinating and I was
starting to worry about translating this to the rest of CAG. What did it mean to our
clients, their business processes, and our audit approach?
The last session was memorable. The presenter was Tom Gilb. Tom is an American that
moved to the UK as a teenager (but kept his accent and sense of humor), spent most of
his working life as a consultant, has written several technical books, and is an Honorary
Fellow of the British Computer Society.
More to the point for me was that he was an engaging speaker. He took the highly
technical and spoke about it in plain English.
Tom told his rapt audience about an engagement he had with a Scandinavian car
company. They wanted a fully integrated system, running against a single (although large
and complex) data base, that tied in customer orders, procurement, factory planning,
inventory management, fulfillment, billing, and accounting. This was something that, to
his knowledge, had never been done.
The client talked to IBM and purchased their most powerful computer; if memory serves
me right, it was an IBM 360 mainframe running the DOS operating system, the CICS
transaction processing system, and an early version of the IMS data base system. Tom
told us that IBM assured his client that this was sufficient power to run the massive
system.
The software was developed, the data base designed and populated, and testing started.
Each module (customer order processing, receivables, factory planning, etc.) was tested
and found to be working well.
Then, they tested the integrated system. That did not work as well. They input about an
hours volume of customer orders, and they appropriately updated inventory
management, created the necessary purchase orders, were considered in factory
planning, led to correct billing upon completion and delivery, and the appropriate
entries in the financial records.
Unfortunately, that hours volume took more than 24 hours to process all the way
My next adventure took me into a new and smaller world: the world of
microprocessors.
People I knew were buying do-it-yourself microcomputer kits from mail order stores,
and the technical computing journals were starting to hint that these devices had the
potential to move from a hobby to a business tool. In 1974, a company called Zilog was
founded and in 1976 they introduced the Z80, an 8-bit microprocessor that was a
significant advance from the early Intel 8080 model. The Z80 allowed more powerful
devices and the military, in particular, used it extensively. The Z80 powered early
business computers, such as the Osborne, Kaypro, Xerox 820, Radio Shack TRS 80,
and Amstrad. I purchased a Radio Shack TRS 80 Model II a little later but thats
another story.
I believed in the potential and wanted to share that vision with the rest of CAG. After
obtaining materials directly from Zilog and accumulating a number of pieces from
journals, I started to write. I was smart enough to include diagrams, but not smart
enough to please David with the initial drafts of my paper.
After I had exhausted my patience and wanted to give up, and David had nearly
exhausted his patience with me, he gave me two pieces of sage advice:
1. Tell him (in person) why this is important. Say it and then write what you said.
As you are saying it, learn from the listener (David) how to express your
thoughts in a way that will be understood and learn what not to say because it
will not be understood.
2. Avoid technical language and use ordinary English where possible. If you have
to be technical, explain the terms clearly so that the non-technical person will
understand.
I ended up writing a much longer piece, but it worked. While not everybody would
share my opinion of the potential, everybody understood what I was talking about.
Later that year, I was asked to be one of the teachers at the off-site training session for
people joining CAG. This was a wonderful learning experience for me. The task of
teaching meant that I had to master the fundamentals of what I needed to teach. It was
also essential that I avoided technical language when plain English could be used and
that I explain the technical in easy-to-absorb-and retain terms.
This set of experiences led me to require all of my staff to:
Write and speak for the people who are listening, the people you are trying to
influence, inform, or persuade
Write and say what they need to hear, rather than what you want to say
Use language they understand. If they dont start with a decent understanding of
the topic, explain any technical terms in ways they can understand
Give examples and use diagrams; they are of great value in expressing ideas,
especially to those who are visually oriented (i.e., absorb concepts from seeing
better than they do by reading). I became used to getting up and using a
chalkboard to diagram and explain what I was trying to communicate
Master the fundamentals: you wont get far explaining anything unless you have
deep understanding of the topic yourself
current programs used to calculate the IBNR reserve we were auditing but as I was
framing my question, the answer was becoming clear in my mind. By the time he
replied, I knew what he was going to say.
But Norman, we have been updating the IBNR software constantly. The test data that
your man put together five years ago wont work with todays software. We knew that,
so we carefully preserved the code he used so your test would work.
So, for five years the CAG team had been running a worthless test. If the auditor had
understood exactly how the test data was being run, he should have been able to see
what was (or was not) happening. Only my curiosity and delving into the IBM manual
led me to recognize that something was wrong.
Obviously, I updated the test data and developed an audit program that would not only
work that year, but in future years as well.
It may have been this incident that sparked a life-long interest in what we now call IT
general controls, but back then we called data center controls.
I was back the next year, this time as the manager of the CAG team; I had assigned
myself the task of reviewing the data center controls.
In those days, little was known by computer auditors about the potential for the systems
programmers (the most technical of the IT staff, they maintained the operating system,
data base software, and so on) to affect the operation of enterprise applications. Pretty
much all we knew was that they had the ability to use so-called utility programs that
had enormous power: they let the systems programmers make changes to data or to
application code, bypassing any controls. The most famous were the ZAP family of
products (used in the IBM environment). There were variations for the different
operating systems, but in the GRE environment, the one we were concerned with was
SuperZap (sometimes referred to as SPZAP).
We had a step in the data center controls audit program to assess whether the company
had sufficient controls over SuperZap. According to the prior years audit file, the
company had determined that they needed to make SuperZap available to systems
programmers only in the event of an emergency. So, they had hidden the program by
renaming it to something only known to the head of IT. If there was an emergency, the
head of IT would rename SuperZap and provide that new name to the systems
programmer. When it was no longer needed, the head of IT would hide it again by
renaming it.
I had been working with these systems programmers on some audit software (which I
was running against the companys IMS database, so I needed their technical support). I
had a high opinion of their abilities and doubted that the IT director, who was not a
technician but had a background as a COBOL programmer, could realistically hide it
from them.
I got a copy of the IBM manual that explained SuperZap. In one of the very first
paragraphs, it described how the utility could be executed either by its file name,
AMASPZAP, or through aliases (literally, other names). The most common alias is
IMASPZAP.
I wondered. OK, my firms computer auditors had been fooled (innocently, I assumed)
into thinking that the test data run was a test of the software used to calculate the IBNR
reserve. Had the IT director also been fooled?
I stopped by his office and asked him if SuperZap had been renamed to IMASPZAP. His
jaw dropped and he asked me how I knew. After I explained that IMASPZAP was a
standard alias that was described in the IBM manual and probably known to every one
of his systems programmers, his jaw snapped back and his teeth clenched. He agreed to
change the way in which SuperZap (however named) was to be controlled.
This taught me to look a little deeper and make sure that I really understood what I was
being told. This story is about my time as a computer auditor and is somewhat technical.
But the same thing applies to other areas of auditing, such as compliance with
regulations. Too few people actually read the regulations, the underlying laws, or
commentary on related litigation.
Later, I found out that the IT director told the engagement partner that I was head and
shoulders above any previous computer auditor he had worked with internal or
external. My little demonstration of common sense (on the test data) and desire to
understand what I was looking at (the utility program) impressed him. Over the years, I
have had similar experiences where a smidgeon of common sense and technical
knowledge (in each case obtained by reading and research) turned a skeptical manager
(auditee) into a trusting and valued partner of internal audit.
I collected my thoughts and started to reply only to notice that his attention had
wandered off. I have no idea where it went. Maybe he was thinking about the great
deeds he would perform when he got back to his office. I dont know. All I did know
was that while his ears may have been hearing what I was saying, his mind was not
listening.
I found my way to the end of my report, said it was nice to meet him, and cringed my
way to my office now definitely 2 feet smaller.
I saw David return to his office and followed him in. He saw my face and confirmed
that Mr. BGJ had stopped paying attention to me as soon as he saw me hesitate.
David, one of the finest mentors you could ask for, explained that people like Sir Brian
have no patience. They need to hear answers to their questions straight away, in a clear
and succinct voice.
Executives like him have the attention span of a gnat.
I have used that expression ever since and taken its lessons to heart.
When communicating with senior executives, whether in management or on the board,
they need you to get to the point quickly, communicate what they need to know and no
more, and then answer their questions in the same manner. They dont want to be
bothered by stuff they dont need to know.
This style of communication extends beyond the oral to the written.
I learned two lessons from this very brief encounter with a god:
1. Effective executives have an immense amount on their plate and want to spend
as little time as possible on every topic, so they have little or no patience with
people who waste their time with trivia information the executive doesnt
need to know
2. When we communicate with the gods of our world, we need to tell them what
they need to know, rather than what we want to say. Too often, we want to
share details that show how good our work was, which is important to us, when
all the executive really needs to know was our conclusion and whether they
need to do anything
This translates into every communication we make with senior management. How can
we get to the point as quickly as possible, and provide the information with the clarity
needed so they can take the actions we desire?
Over the years, I learned that there is an immense difference between what we would
like to say, to demonstrate we have done quality work and reached important
conclusions, and what executives need to hear.
In this case, I wanted to show the great man that I was confident in the task, I was
working well with my US counterpart, that we were making good progress, and he
could have confidence in us. In contrast, he wanted only to know whether we were on
track and whether there were any issues he could help with. He was also using the
opportunity to size me up, to assess whether David had assigned a competent individual
to the project.
The typical internal auditor wants to demonstrate that the work was thorough, according
to standards, and that the conclusions and recommendations are supported by credible
evidence. The executive wants to know whether there are issues he should be aware of,
how critical they are to his objectives, and what he needs to do about them.
This leads the internal auditor to write an essay when all the executive needs is a punch
line.
The auditor writes a 10 page report with a one or two page executive summary, just to
say that with the exception of one item (which is being appropriately addressed by
management) everything is fine.
A test I like to give my people is to imagine that they are boarding an elevator on the 3rd
floor that has the CEO inside. He asks what do I need to know about your audit? The
auditor has until the elevator reaches the ground floor to answer. I used this technique
when I joined Solectron as CAE and was reviewing a draft audit report from Singapore
following an audit of the factory in Shenzhen, China. The audit report format was
excellent in many ways, with a dashboard on the first page that had separate lines for
each of the major areas and a traffic light (i.e., red, tallow, or green) indicating
whether the controls in the area were effective. But when I looked at that first page on
this particular report, all I call see was red. Every risk area was red.
I called the Singapore team director (Audrey Lee) and asked her what the report meant,
being all red. Her reply was that it meant the controls were poor. I asked what that
meant to the business; she didnt know how to answer, so I gave her the elevator
question. What would she tell the CEO as the elevator descended? I asked her to call
me back the next day with her answer.
When she called back, she told me that the processes and controls in Shenzhen will not
My nature is somewhat shy and introspective. But I have learned that pretty much
everybody I will ever meet is valuable and interesting in one way or another. Not only
are people interesting as individuals and have much to teach me, but they often have
perspectives, experiences, and insights that are different and therefore interesting. My
view of this world and my small place in it has been enlightened by conversations about
all kinds of topics with all manner of people around the world.
When it comes to business, managers and executives are not the only people with
information and insights of value. Tom Peters said that if you want to know what is
really happening in an organization, you should talk to the janitor. Why, because
managers only think they know what is happening. That is why internal auditors are
needed, to explain to managers and executives that what they think is happening is really
not.
If we are to understand the business, we need to listen to people from managers to floor
sweepers, from the people who talk to the customer (whether in sales, managing a store,
or staffing a help desk) to those who develop strategy, from those who work in the
warehouse to those in charge of procurement, and from the CIO to the staff responsible
for software testing and quality control.
I have learned that people love those who will listen to them. You can be charismatic by
listening actively, showing respect and attention to anothers views.
In fact, I tell people that I dont want them ever to go and talk to somebody. I want
them to go and listen. If they are talking more than half the time, they are not listening
effectively and learning what the other person has to tell them and they will not only
be the poorer for that, but will have less influence with that person in the future.
I think of charisma, as David was using the term, as this: a personal quality that makes
a person capable of inspiring or influencing others. I have learned that listening,
showing respect, valuing others, and demonstrating ability through action, not just
words, gives you the power to inspire and influence.
All the program changes I was looking for were logged as emergency changes and had
been approved by the IT Operations Supervisor. As there was no record of testing, I
started writing up an item for the audit report recommending tightening the controls over
emergency changes. For example, the procedure for emergency changes had not been
formalized and approved by senior IT management.
I was also looking at how management responded to production jobs that abended.
When a production job failed, that could mean a failure to update accounts, bill
customers, and so on. So it was important that management monitored and took
appropriate action when there was a production abend.
I found that a large number of production jobs were failing. Sometimes, they were run
again only to fail again. I talked to a few people in operations and heard that the high
number of changes was due to the high number of production failures. The high number
of production failures, in turn, was due to the high number of emergency changes, made
and tested by swamped and tired programmers coming in at night several days in a row,
which then failed in production. While the programmers may have been diligent at first,
as they lost more and more nights sleep to come in to fix their failed fixes, they became
more interested in finishing work and getting back to bed.
I drafted an audit comment to this effect and shared the results with my managers. The
issue was escalated to the manager and partner of the overall audit, who talked to senior
company management in New Jersey. To nobodys surprise, management had no
knowledge of this state of affairs and challenged my finding. I provided the details and
waited for them to investigate using their own tools.
But I didnt sit on my hands while I was waiting. I had a feeling, perhaps it was my
common sense talking to me, that the current level of production failure, emergency
change, and subsequent production failure didnt happen overnight. There had to have
been a steady build-up. I wrote a new program that provided a report of production
failures by month for the last several months. It showed not only a progression, but that
the rate of growth in the level of failures was close to logarithmic!
When management saw the chart and was able to obtain confirmation from their own IT
managers that my data was correct, they moved quickly to act.
Fortunately, I was able not only to show the current situation and the risk it presented to
the business, but indicate the root cause: a less than disciplined approach to the testing
and approval of emergency changes to production programs. Management slowed down
the implementation process for emergency changes, not only to ensure a more
disciplined process but also to make sure that the people making the changes were able
to do so while fresh.
If the auditor reports a problem that is only a symptom, management is unlikely to take
the actions necessary to fix the problem permanently. Only when the root cause is
treated, rather than the symptom, is the deficiency addressed.
I have learned over the years that there is a powerful word in the English language:
Why. When the auditor sees a situation that is questionable, he or she should ask why it
happened. But it may take as many as six why questions before you get to the root
cause. For example, consider this scenario:
Auditor to accountant: I see that the account reconciliations are not up to date.
In fact, they are several months old. Why is that? #1
Accountant: I will get right on it. I have been too busy recently.
Auditor: Why have you been too busy to do the reconciliations? #2
Accountant: I have too much work to do, especially when I have to cover for
a co-worker while she is on vacation.
Auditor: Why do you have to cover for her while she is on vacation when you
are already very busy? #3
Accountant: My manager told me to cover for her because there is nobody
else to do it.
Auditor: Why is there nobody else to do it? Why couldnt he bring in a
temporary worker to cover for her? #4
Accountant: He told me that his manager wouldnt approve a temporary
worker.
Auditor: OK, I will talk to your manager. Thank you for your time.
Auditor to manager: The accountant tells me that the reconciliations are late
because she is too busy, especially when she has to cover for her co-worker
while she is on vacation. She says you told her that you requested a temporary
worker to cover the vacation, but it was not approved. Is that correct, and do
you know why it was not approved? #5
Manager: That is correct. My manager wouldnt approve the request. He
didnt tell me why, but I think he is worried about his budget.
Auditor: OK, thanks. I will talk to her.
Auditor to senior manager: I understand that the accountants manager
requested a temporary worker be hired to cover for a vacationing employee,
but you denied the request. Is that correct and, if so, can you tell me why you
didnt approve the request? #6
Senior manager: That is correct. I didnt approve the request because the
accountants manager couldnt explain why the coverage was needed, nor
whether there was any risk if his request was not approved. He doesnt have a
great record when it comes to managing his resources and budgets are tight, so
I denied it.
Auditor: Did you understand that without the additional resources, the
reconciliations would not be prepared on time? If you had known, would you
have approved the request?
Senior manager: I didnt know and if I had I would have talked to the
manager. If we couldnt work out a way to smooth the workload so that the
reconciliations would be completed on time, I would have hired a temporary
worker. I will talk to him about the situation and how it should have been
handled. This will be a learning experience for him and we will also have to
figure out how to work with the available resources to catch up and ensure we
dont fall behind again.
The root cause in this instance was the inability of the accountants manager to express
the business case for hiring a temporary worker combined with an inability to smooth
the workload so that the reconciliations could be completed on time. When the senior
manager was informed of the root cause, she was able to take actions not only to correct
the current situation but to prevent a recurrence.
mentioned that I didnt seem to appreciate her work that I realized what was happening.
I asked her whether she understood that I was thanking her by saying ta. She told me
that she had no idea what I was saying, but it didnt really matter.
It mattered to me and I asked that she tell me whenever I said something she didnt
understand. She was kind enough to tell me that she didnt understand half of what I was
saying because I spoke too fast and softly, and sometimes pronounced words in ways
she was not used to. As a result, I modified my speech and tried to use American
pronunciations. After all, how can you be successful in business if people dont
understand you? I believe it is my responsibility to make sure they do, rather than
assuming they will take the extra effort to ask when they do not. To be honest though, I
still speak softly (my expression) and mumble (what others say) and have to make an
extra effort at times to be heard.
Years later, I had the privilege and pleasure of working with internal auditors in
Singapore. Their English is so different from UK or American English that they call it
Singlish. For example, they will on or off the light, where an American would
say turn on or turn off the light. This is easy to interpret, but I was confused for a
while when they answered a question by saying that they would revert to me. In UK or
American English, that means that they would change back into me and of course, to
the relief of many, there is only one of me! I guessed and was able to confirm that they
meant that they would get back to me.
English is not the only language where one word has different meanings to people who
ostensibly speak the same language. When I was with Home Savings of America as a
Vice President of Internal Audit, I observed a three-way argument between a Thai lady
(Nie), a Thai Chinese lady (Pat), an El Salvadoran male, and my secretary, who was
Mexican.
Pat and Nie were scolding the El Salvadoran for talking to them inappropriately. His
words and body language were offensive to them in their culture. He explained that he
was only trying to help and he never used bad or offensive language when talking to
ladies. At this point, the Mexican angrily told him that sometimes he used offensive
language when he spoke to her. (I found out later that they had a relationship.) He
countered that he did not and demanded examples. She was happy to share a few, but he
said that those phrases were innocent. She countered that in Mexican Spanish, they were
offensive even though they might not be in El Salvadorian Spanish.
I have learned not to assume that everybody uses and understands language, even the
same words in the same language, the same way. It costs very little to simply ask for
confirmation that what you hear is what they meant.
In more recent times, I have found that confusion over language, over different use of the
same words or expressions in ostensibly the same language, continues and grows.
Examples include:
The word risk. In common parlance, risk refers to the potential adverse
consequences or impact of events and situations. People talk about the risks of a
car crash, earthquake, fires, financial losses, and so on. But for many risk
practitioners, especially those who follow the global risk management standard,
ISO 31000:2009, risk is the effect of uncertainty on objectives. In other
words, risk can have positive impacts. When talking to risk practitioners, I like
to ask them whether they feel it is part of their responsibilities to help their
organizations navigate both the adverse and positive effects of uncertainty, or
just the negative. Only when I know we are talking the same language, and
sharing a common understanding of key words, can we have a constructive
conversation.
The acronym GRC. Most believe that it stands for Governance, Risk, and
Compliance. However, the Institute of Internal Auditors uses the acronym to
refer to Governance, Risk, and [Internal] Control. There is a huge difference.
But the confusion is not just over what the C stands for. People use the term
GRC without understanding what it means. When asked, they can say that it
stands for Governance, Risk, and Compliance, but they cant explain what that
phrase means. Some believe it is all about the management of risk, including
compliance risk, and the oversight of risk management by the board. Others
believe it is about the culture and ethical practices of the organization. I follow
the concept of GRC advocated by the Open Compliance and Ethics Group
(OCEG); it suggests that the long-term success of an organization is best
achieved when all the pieces of the organization (particularly those responsible
for governance activities such as setting strategy and objectives, making key
operating decisions, monitoring performance, and providing oversight and
executive direction) work together in a coordinated or orchestrated fashion,
considering risk as they make decisions and staying in compliance at all times
with both external laws and regulations and internal codes of conduct and
practice. When people talk about GRC, I always ask them to explain what
they mean. Otherwise, I find we are likely to be talking in what sounds like the
same language but in fact we are not communicating at all.
If we are to have effective communications with others, we must take responsibility for
what we say, what others hear and understand by our words, and what we hear and
understand when others talk. This can be hard work, requiring skills (which need to be
learned and then actively and consistently practiced) such as active listening and saying
the same thing three times in different ways to ensure it is both heard and understood.
Unfortunately, most people are lazy communicators. They assume that people mean the
same thing when they use particular words and expressions, but they often dont; they
interpret what they hear using the dictionary of their own history and bias when the
person they are listening to has a different history and bias; and, they dont confirm,
through questions and repetition, that the person they are talking to has understood what
they wanted them to hear.
unanimous partner vote, Don had not moved forward that year. Ben was adamant that
Don should succeed this year, so he called the partners to a special meeting and told
them that he needed everyone to support Don. They all agreed to do so. However, Don
didnt want to take any chances so he continued to curry the partners favor, especially
those who had voted against him the prior year.
I left the meeting with Don shell-shocked. Is this what I wanted to do? Was it consistent
with my personal ethics and values? I decided that I would need to campaign when my
time came, which I expected to be in a couple of years. In the meantime, I would have to
pay attention to my relationships with every partner and manager the latter because
they could influence the partners thinking. But, I would not follow Dons example of
stealing other peoples credit. If I couldnt make partner based on merit, I doubted that I
wanted to be a partner.
A month or so later, I checked in with Don to see how he was doing. He pulled me into
his office, looking quite distraught, and closed the door. Apparently, the partners had
voted unanimously to recommend him for partner, as expected. The next step was for the
national office to send a very senior partner to interview him and several of the
partners. Don told me that his interview went well, but when two of the local partners
were interviewed they, in his view, stabbed him in the back. Even though they had
committed to support him, they had sabotaged his nomination by making negative
comments to the visiting partner. He didnt know whether they had a problem with him
or Ben, but either way his career at the firm was over and he would be leaving.
In Dons view, and I have no reason to believe him wrong, the partners had not acted
with the best interests of the firm in mind. Don had the respect of every manager I knew,
was considered the most proficient manager in the office, and had brought in significant
new clients. But, the partners were political and vying for position and, through that,
additional personal gain.
At about the same time, I received another lesson in politics and personal gain.
Firm policy required that every year, for every client, the CAAG staff would perform a
high-level review and assessment of the clients computer systems. It was called a
classification review because we would assess whether the systems were complex,
simple, or somewhere in between; simple meant that the financial audit team would
be able to address all the financial reporting risks without computer audit specialist
assistance. For example, there were no complex calculations that couldnt be audited
manually. If the systems were classified as complex, that not only meant that the
financial audit team could not address defined financial risks manually, but computer
audit specialist assistance was mandated. This typically included some combination of
technical assistance in documenting and assessing controls in the computer-reliant
processes, the use of audit software (for example to reperform calculations), and the
assessment and testing of integrity controls.
CAAG would complete and write a report documenting the classification review. The
report would be sent not only to the general practice manager and partner, but to the
CAAG group manager, the CAAG partner in charge of the region, and the CAAG
partners in the national office (including Stan).
One day, I received an angry call from the regional CAAG partner, based in San
Francisco. He said he wanted to hear why I had classified all the systems at a fairly
large client as simple and had not recommended any CAAG assistance on the audit. I
explained that the reports provided a clear audit trail, that there were no complex
calculations, and that the general practice audit team would be able to address all the
financial reporting risks without our (CAAG) help. He asked if I understood that his
personal performance, as well as that of the group manager, was based primarily on the
number of hours of CAAG work. I confirmed that I understood, but prudently refrained
from remarking that adding CAAG hours did not necessarily lead to savings in general
practice hours. Sometimes, it just meant that total hours increased without an increase in
audit fees meaning that the overall rate per hour, a major performance metric, dropped
and so did firm profits.
The regional partner could see he was not persuading me to change my classification
assessment, so he tried another tack.
He asked if I was familiar with the firms new audit software suites for general ledger
and accounts receivable. I said I was very familiar with them. He then asked if the
software suites would work with the clients systems. I said they would, but that they
would not add value to the audit because existing client system reports provided similar
information. In a voice showing his frustration with me, he asked about the relationship I
had with the general practice manager and partner, and I replied that it was strong. He
asked if they trusted me because like them I was a CPA, and I confirmed that I believed
they did.
Then he went over the line. After asking whether if I had recommended audit software
they would have accepted it, and hearing my answer that I thought they might, he paused.
Clearly, he was thinking about ordering me to change my report and including a
recommendation to use one or both audit software solutions. In the end, he told me was
I had learned my first lesson about individual motivation, that while many (thank
goodness) are driven by a desire to serve the organization, many are more interested in
serving themselves.
Understanding what drives people is important for several reasons:
As a manager, you need to motivate your staff
You also need to influence others, your peers and your manager
As an auditor, you need to understand why people act the way they do and how
to influence them to accept your suggested changes
It is also important for auditors to understand motivations when assessing fraud
risk and investigating potential improprieties
I was faced with a decision: did I want to be a partner with a firm with this level of
politics and actions driven by self-interest?
Over the next year, I worked with a variety of managers and partners. Most were hardworking individuals of character and integrity. However, there too many were focused
more on WIIFM instead of what was best for their client and the firm. I decided to
leave.
But there is an important postscript. Over the next few years, after I had moved on, I
continued to stay in touch with many partners and managers at C&L. I saw the people
who played politics and looked after their rather than the firms interests prosper. For
example, one individual who had little compunction about lying his way to the top was
promoted to partner. However, it didnt take long for the firms leaders to see through
the politicians and with five years they had been fired.
I am told that the politics within PwC is far tamer today than it was in my experience.
Politics can get you to the top. It can even help you prosper at the top for a while. But
over time it will create enemies and sews the seeds of failure.
important than any title. Certainly, the compensation and potential growth opportunity
were excellent. I did not intend to stay in internal auditing, but to move into a
management role after two or three years, either in Information Technology (IT), in
Finance, or elsewhere. The beauty of Di Giorgio was that with many divisions in many
industries, there should be many opportunities for such advancement.
In contrast to the Disney job, where I was running away from C&L, I was looking
forward to and excited at the opportunity to work at Di Giorgio. As a mentor today, I
give people the same advice: only take a job when you see yourself excited and running
towards it. Dont take a job just to escape your current position.
Over the years, I have worked for a number of companies in a number of positions. As I
look back, some were good moves and others were not so good. But, each time I was
making the move towards what I believed was a good and exciting opportunity. I count
myself lucky that most worked out well, some extremely well.
programmer had accessed the programs that created the backups. He checked the code
and found the logic the programmer had inserted which he deleted. The CIO then
reviewed the other program changes the programmer had made and found the time bomb
in the middle of an authorized program change. Testing of the change by IT and users
had not detected the bomb because it was time-driven.
The CIO informed me that the programmer had been fired and the incident was being
investigated by the police.
Some auditors might have inserted themselves into the investigation. But, I could see
that the CIO was quite capable of handling it by himself. With the approval of the CAE,
I contented myself with monitoring his progress.
The second incident was at the corporate data center in San Francisco. The company
was using Hewlett Packard System 3000 computers for its corporate systems, including
the corporate financial systems. These were excellent systems: reliable and easy to use.
For a computer auditor who placed great value on the ability to perform data mining,
their IMAGE database management system and Query software made writing audit
software easy and fast.
I was doing an audit of IT general controls and met with the head of IT operations,
Brian, to discuss some preliminary findings. I told him that the system had not been
properly secured. Unfortunately, he did not believe me. Although he was responsible for
the data center, including security, he was not a technical person and relied on
representations from the Hewlett Packard representative that the password system was
strong.
I thought I could prove him wrong, so I met with the corporate CIO, Marshall, and
obtained his permission to do a little white hat hacking. We made a side bet of lunch
and with nothing more than a standard employee signon I went to work.
Within a week, I was able to sit down with Brian and give him a printed list of all the
employee user signons and passwords. I had won the bet. Without going into details, I
was able to find a password for a low security area in a set of operating instructions. I
used that to explore the system and found the file with all the passwords. It was
protected from write but not from read access and was not encrypted.
I didnt use this exploit to make anybody look bad, or to trumpet my own capabilities. I
used it to demonstrate to the IT folk that I had the ability to audit their systems, and to
On the topic of audit reports, Di Giorgio is where I had a memorable encounter with the
CEO, Bob Di Giorgio. When it came to writing my first computer audit report, which I
believe was on the topic of IT general controls over the corporate data center, I
expected it to be an easy task. After all, if I could explain data base technology to CAG
members, surely I could explain the state of system security to the board and top
management. I was wrong. Patrick made me write draft after draft, each time simplifying
the language and talking in terms of how the business might be affected by the issues I
had identified.
A week after I issued the report, I was summoned to the office of the CEO. Bob Di
Giorgio was the last in a line of Di Giorgio family members who had run the company,
taking it public some years previously. He welcomed me warmly and said he had
wanted to meet me. Bob blew away any concerns I might have had about meeting him by
saying that over the years he had read many audit reports on the topic of computer
systems and computer security. Mine was the first one he understood!
He commended me for taking a business rather than a technical perspective and we had
a productive conversation about the company.
A few months later, I visited the Dutch division, based in Antwerp, for an audit of their
IT general controls. Initially, everybody was very friendly and open. But, when I found
that the IT department consisted of just three people, the manager who ran operations
and two programmers, and that nobody was reviewing or testing program changes made
by either programmer, they cooled off. The manager said that he trusted his
programmers and didnt see the need either for the other programmer to perform
independent testing or for users to test program changes. He was supported by the
divisions general manager. I explained the risk: that while I had nothing but
professional respect for the two programmers, people make mistakes. A mistake could
lead to billing errors, failures to order the raw materials necessary for manufacturing,
and so on.
Fortunately, one of the top executives was visiting and he asked me to join him in a
meeting with the general manager. He asked about the audit and I told him what I had
found. He expressed concern and asked the general manager what he was going to do.
When the general manager tried to explain that his was a small company and he didnt
agree that action was necessary, the executive became quite angry. Even though I was
there, he told the general manager that he was taking a significant business risk. He used
my own words, my own explanation of business risk, to justify his making this a high
priority for the division.
Many years later, I would join my friend Jay Taylor, who leads IT auditing and more at
General Motors, in asserting time after time that there is no such thing as IT risk only
IT-related business risk. I was pleased to see the leading computer audit and security
professional organization, ISACA, say essentially the same thing in its professional
guidance: in both its guidance on IT-related risk management, and its overall COBIT
framework.
about a year after the CAE started, the only auditor left in the department was Dawn.
senior individuals within Finance and the CFO was an Executive Vice President.
Todays Standards for the Professional Practice of Internal Auditing (from the IIA)
make it clear that the CAE must report administratively to a level of management that is
very senior within the company, preferably to the CEO, and administratively to the
Audit Committee to the Board. I dont believe Bob was sufficiently free of undue
management influence over his activities as CAE.
I saw this in action in my only meeting with Mario Antoci while I was with Home
Savings. One of the areas I was responsible for auditing was the Legal function. During
the audit planning process, Bob told me that the SVP and President were concerned
about the effectiveness of the Legal department because there was no General Counsel:
each of the attorneys reported directly to the CEO. I agreed to perform an operational
audit of the Legal function, with emphasis on whether the collective leadership was
positively or negatively affecting their effectiveness and efficiency.
This was the first audit where I worked with attorneys. Each of the Home Savings
lawyers was courteous, open, gracious, and helpful: an experience I have found
consistently repeated over the years with few exceptions. They explained how they had
divided responsibilities and each felt they did not need a General Counsel. None
suggested that they should be considered for such a role either. However, they were not
allocating work evenly, were not making good use of the outside law firms they turned
to for additional expertise and resources, and it was clear to me that not only did they
need consistent leadership but better systems for managing case status and workload.
The business risk was that their valued insight and advice might not be available when
executives needed (some executives were already bypassing them and going directly to
outside counsel), and that some litigation may not receive the timely attention necessary
for a successful resolution.
I crafted the audit report very carefully indeed. I wanted to make it very clear that each
of the attorneys was not only capable but diligent and making a significant contribution
to the organization. However, the risk to the business if the situation continued was
significant: executives might continue to bypass the Legal team and obtain less than
adequate advice and services, putting the companys strategies, plans, and objectives at
risk. I made a number of recommendations for management consideration.
When I reviewed the draft with the attorneys, they were disappointed but recognized
that the audit had identified facts (such as executives bypassing them) of which they
were unaware. They agreed that action was necessary and they would support whatever
the CEO decided was necessary.
My next meeting was with Bob and the SVP. The SVP asked a lot of questions and it
was clear he very strongly supported the appointment of a General Counsel and was
pleased with the business justification uncovered by the audit. Bob said that he would
be meeting with Mario to discuss the audit, given the great interest in the topic he had
expressed earlier in the year.
I was pleased to receive an invitation to join Bob when he met with Mario. I can still
remember how stunned I was by the opulence (marble floors and golden tapestries) of
the executive floor and the friendliness of Marios executive assistant. Bob and I waited
in her area until we were waived into the inner sanctum.
Bob and I were momentarily surprised to find that the SVP was already in the room and
he and Mario had clearly been discussing my report, a copy of which was open on the
table. However, Mario greeted us with none of the decorum that the surroundings seem
to mandate. He showed himself to be very much down-to-earth and approachable, and
soon demonstrated how good a listener he was.
Mario told me that he had read the audit report with great interest and wanted to hear
more about the details. I opened my mouth to speak, but the only sound that could be
heard was the SVP answering the question. While Bob and I just exchanged glances, the
SVP laid out facts and business justification that not only were not in the report but on
occasion were contradicted by the report. To give Mario credit, I suspect that he knew.
However, he only had a few questions for me before saying he had the information he
needed and that he would be meeting with the CEO to discuss the actions that would be
taken.
Bob and I agreed that the correct result was probably being achieved, even though
neither of us was happy with the SVPs intervention. Bob said he would talk to him.
Over the years, I have seen and heard of other inappropriate intervention, influence, and
downright meddling by senior executives in the work of the internal audit function. I
strongly support the IIAs position that the internal audit function should be owned by
the Audit Committee[1] of the board (or equivalent governance body), that the CAE
should report functionally to that committee, be appointed or dismissed only by that
body, and have his or her compensation set by them. There will be more on this topic
later.
For now, I want to talk about a great compliment I received.
Another area I was responsible for auditing, in addition to IT, was Human Resources.
During the audit planning process, I met with the SVP for Human Resources.
Hazel Grandchamp was just like her name suggests: a grand, dominating presence. She
must have been in her sixties, had been with Home Savings since its infancy, knew
everybody that mattered, and was a force within the company.
I had hardly sat down in her office and explained my role within internal audit when she
told me that I couldnt audit Human Resources (HR)! She was polite but firm.
I tried to explain that internal audit had a responsibility that extended to every function
but she interrupted and said that she accepted our independent role. That wasnt the
problem. We couldnt audit HR because we had never worked in HR and didnt
understand the work they did. An audit of her area would be a waste of our and,
especially, her time.
I told her that I agreed we were not experts in HR. However, I believed that as internal
auditors we were experts in processes and internal controls[2]. I asked her to give us a
chance to show her how we could add value to her operations. Are there any processes
you are concerned about? Are there any operational problems that you are having
difficulty solving? After a few moments reflection, she said there was one problem
and she would give us that chance I was asking for.
One of her departments was Salary Administration. Every position within the company
was assigned to a grade level, and a range of compensation was established for each
grade. The only variation was by state. For example, lets say the Vice President of
Internal Audit position was assigned to grade 44. Salary for individuals within grade 44
was within a range from (hypothetically) $50,000 to $65,000 if the individual was in
California. If the individual was in Arizona, the range would be adjusted to, say,
$40,000 to $55,000 to reflect a lower cost of living.
The problem was that Home Savings was expanding rapidly, primarily through the
acquisition of smaller organizations in states where we did not have a presence and
therefore did not have established salary ranges. Salary Administration (SA) had to
complete the necessary research and establish the salary ranges as soon as possible
after the acquisition was completed (preferably before) to avoid operational and
employee morale issues. But it was not. It was taking SA longer and longer to complete
the work and the senior executives running the new operations were complaining louder
and louder.
Hazel had been demanding that her direct report, the VP for Salary Administration (lets
call him Jim) get on top of the problem. But all Jim would say was that he didnt have
enough people to handle all the acquisitions. Hazel didnt accept this excuse, telling Jim
that she had benchmarked his staffing to SA departments at other organizations. She had
made adjustments for the size of Home Savings (it was the largest Savings and Loan in
the US, comparable in asset size to a top twenty bank) and the number of acquisitions it
was making. Her assessment was that Jim had 10%-20% more staff than at comparable
institutions.
Hazel said that if we could help with this issue, she would be very grateful although
she made it very clear that she didnt think much of our chances!
One of my senior staff, Alan Marcum, had recently completed an IIA course on
operational auditing so I asked him to perform the audit. I would provide guidance as
necessary, but he would perform the fieldwork.
Alan met with the VP Salary Administration and then interviewed several of the staff.
While the VP told Alan the same story as he had told Hazel, that he didnt have enough
people and everybody was overloaded with work, Alans observations were different.
He saw that some people were leaving promptly at 5pm (the normal end of day) while
others were working far longer hours. Some were fully up-to-date while others were far
behind.
Alan and I discussed this and I suggested he gain an understanding of how work was
assigned and progress monitored. We knew that each staff member was responsible for
a geographical area, and I asked Alan to assess whether this meant that everybody had
an equal workload, and whether they were able to make adjustments when a major
project occurred, such as an acquisition.
Alan found that work was assigned purely based on geography, without consideration of
existing workload. In fact, the VP did not monitor and had no ability to monitor actual
workload. As work arrived it was passed straight to the appropriate desk without being
centrally recorded. If the staff member at that desk did not have time to work on the task,
it went into his desk drawer. When he was ready to start a new piece of work, he would
take the oldest item from the desk drawer. The VP discouraged a busy staff member
asking for assistance from anybody else, because he wanted to maintain expertise on
each geographical area.
This did not totally explain the fact that some were working late while others had time
on their hands. Diving a little deeper, Alan found that when special projects occurred
(such as an assignment to assist in the implementation of new software), assignment to
the special project was made regardless of current workload and work was not moved
around to compensate for the new assignment. These special projects were frequent and
reviewed the testing documentation and confirmed that the controls, as designed, had
been sufficiently tested and found to be operating as intended.
Carla was comfortable with this approach and we moved on to whether we had
sufficient information with which to assess the design of the controls and security.
Carla thought she needed additional information and was planning to meet with several
users and IT developers. I suggested we use a control matrix to help us see where we
stood. A control matrix is a simple table where each column represents a type of system
transaction, such as a deposit or withdrawal, and the rows are where you assess
whether the controls satisfy defined control criteria. We used control criteria that were
based on what I had learned at C&L: completeness, accuracy, validity, and
maintenance. So you take each transaction, in turn, and assess whether the controls
adequately ensure that all transactions are completely entered, processed, and recorded.
The controls that address that requirement are documented in the completeness row
for that transaction, as well as the assessment that they are adequate. Then you move to
the next row, the next criteria, and identify and assess the related controls.
We were able to complete the entire control matrix, filling in the controls that satisfied
each control attribute for every transaction. As we got towards the end, Carla started
showing signs of discomfort. By the time the matrix was full, she was visibly
concerned. She acknowledged that all control criteria were satisfied for all major
transactions. She also confirmed that she was confident in her understanding of the
controls. But, her experience was telling her that more work was needed.
We revisited the objectives of the audit, namely to provide assurance that the controls
and security of the system, when it was implemented, would be adequate. She agreed
that the control matrix had asked all the necessary questions and that the controls we had
identified met the companys needs. She was able to put her prior experience aside and
recognize that we had sufficient information to stop work until the testing had been
completed.
This was an interesting exercise for both of us. Sometimes it is difficult to know when
to stop work. There is always more to do, especially when your audit customers like
seeing you at their meetings, etc. The control matrix helped us make the right decision
and stop when there was no real value to continuing. I have used other techniques at
times, such as sitting down at the end of the day (you could do it at the beginning, but I
prefer the end) and making a list of the information you need before you can provide
your considered, professional opinion on the adequacy of the controls (or management
or risk.
The second incident came while I was performing an operational audit of IT. Some of
my interviews with the application development managers had identified a growing
backlog of user requests. I was reflecting on this when I saw Dave Wagner, the Senior
Vice President responsible for application development and to whom all those
managers reported. He greeted me and asked how the audit was going. I told him that it
was going well and that I was thinking about the user request backlog. I said that I was
thinking about recommending a change in the way user requests were prioritized.
Dave looked at me over the top of his reading glasses and said Norman, I dont think
you should suggest answers until you understand the problem. That set me back on my
heels and I left quickly, after thanking him for the comment.
I didnt know Dave that well at that time. I was lucky to get to know him much better in
the years that followed, even working for him for a while. Dave had a sometime acid
tongue, and I had just received a small dose of it but the comment was not only
appropriate and valuable, but gave me a telling lesson.
Too often I, as I have seen many auditors do often, have seen the symptom and suggested
a cure without understanding the underlying problem. I discussed this earlier as the
search for the root cause of a problem. In this case, I had leaped to the wrong
conclusion. While the managers had told me about shared backlog problem, at his more
senior level Dave had a far better appreciation of the issue, knew what could and
should be done, and was actively working to address it.
In addition to talking to the people with tactical, in the trenches, perspectives, I
should have interviewed Dave and obtained his strategic view.
A similar mistake is made by talking only to managers and not talking to those who toil
in the trenches. It requires a complete understanding before you can see the problem
clearly, and only then can you suggest solutions.
In this particular case, when I did sit down with Dave he was able to fill in a major
missing piece of the puzzle. He had discussed the backlog with each of the executives
responsible for the user requests. Those executives had helped develop the current
prioritization process. They were not concerned by the size or age of the backlog and, in
fact, only a few items needed to be completed within a month or two. However, Dave
wanted to do a little fine-tuning and we had a useful discussion about how that could be
done. I added some value by being a sounding board for Daves ideas and sharing my
experience of how other companies managed the user request process.
I saw a position on the organization chart for a Vice President, Administrative Support,
with responsibility for information security, contingency planning, management of the IT
facilities, accounting and procurement, standards, and more. That looked interesting so I
explained to Ron that I was interested, if and when a position opened up where I could
add value, in joining the IT management team. This seemed to both surprise and please
Ron and he said he would give it some thought and discuss it with his manager, Warren
Androus (the Executive Vice President responsible for all of IT and more).
We concluded our discussion without any promise on his part of a position, and with a
commitment by me that I would let my manager know that I was interested in joining IT.
I had the discussion with Bob Broderick the next week and he agreed, reluctantly but
gracefully, to support a move should the opportunity arise.
I had to wait a while for that opportunity to arise and it came in the form of a call from
Ron to meet. He offered me the position of Vice President, Administrative Support,
reporting directly to him. But he had changed the position since he had shown me the
draft organization chart.
In addition to what was shown on the earlier draft, the position now had responsibility
for technical documentation (which was not a problem for me) and network design.
Network design! I was shocked and said as much. While I had some technical IT
capability, I had next to nothing in the telecommunications and networking area. I didnt
want to take on responsibility for starting a network design function, including hiring the
staff and not only setting myself up for failure but possibly causing some damage to the
organization.
Ron told me that he was confident I would not only be able to handle the task but would
do well. He was relying less on my prior experience and more on his assessment of my
ability. He saw me as a thoughtful, analytical, and competent professional. Ron
explained that he would help me as much as he could (he was an expert in this area, as
in almost everything relating to technology), but he didnt think I would need much help.
He was also hiring a Vice President, Telecommunications, who would be able to take
over the network design area once I had it up and running well, in a year or so.
I decided to trust Ron. I was fairly confident I could handle the other areas and that
meant that I would be able to allocate more time to this new area. In fact, I was lucky to
inherit some excellent people (such as Joe Sileci, who ran facilities with authority; with
his Sicilian name, he would occasionally threaten to call on his relatives to help him
when he ran into opposition) and hire others (such as Ann Tritsch, who ran contingency
planning; Sharon Smith, a brilliant technical writer who built a technical documentation
team; George Szerbiak, who led the construction of two new data centers; and Jan-Jan
Wu Gross and Dave Kovarik, who led information security and successfully
implemented the ACF2 security system).
The year after I started, I had to complete performance appraisals for all my direct
reports. They had all performed brilliantly and so I gave them high ratings.
Ron came to my office and told me that I would have to change the assessments. HR
policy mandated that only a very small percentage of employees would get the top
rating, the majority would be assessed as average, and a few below average.
I argued with him that this would not reflect their actual performance and he continued
to respond that he had no choice but to follow corporate policy. But I won the day by
asking Ron to name the top five performers in his entire area (and he had about 500
people reporting to him). Four of the five were on my team, and the others were in his
top ten! He agreed to go back to HR and instead of making me assess my team on the
required curve he would assess all his 500 people, as a group, so mine could rise to
the top.
Ron predicted that my analytical, logical approach to problem-solving would make me
successful in starting the companys network design function. Without going into details,
I can tell you he was right. I thought through the problem at hand, its objectives and the
tasks that needed to be addressed as priorities, wrote a short paper that helped me
crystallize my thoughts, and reviewed it with Ron and his other direct reports. That went
very smoothly and I was probably more surprised than anybody else when the feedback
was that I was heading in the right direction. I hired a young man to perform the detailed
work, which he did very well, and when Ron hired a Telecommunications Vice
President about eighteen months later I was able to hand off a solid program.
I learned two lessons from this experience: the first was that common sense (which is
unfortunately not that common), allied with a logical and thoughtful approach, would
help me accomplish tasks that I had never imagined I could.
After this, I refused to set myself limits except where prior experience in the area was
essential. I gained confidence in my ability to take on and conquer new challenges. This
put me in good stead when I was asked to take on, for example, responsibility for the
support of all Home Savings in-branch equipment and much later to start a risk
management program.
The second came a few months later. The young man I had hired as my network design
analyst came from a troubled background in South Central Los Angeles. He was a
successful, diligent professional when he worked for me. But when the new Vice
President, Telecommunications took over, his performance fell apart. He had problems
at home, with his young family, and while I had been sympathetic and supportive, his
new manager was a tough disciplinarian. Instead of responding to the pressure, the
analyst disintegrated and started taking more and more personal time off at the expense
of completing his assignments.
To this day, I believe that if he had stayed on my team, the young man would have
worked his way through his personal crisis. I was not a great manager then (that story is
in the next chapter) but I was a decent listener and knew when threats would not work.
One of the toughest and saddest days of my life to that date came a little while later.
Ann Tritsch was my Assistant Vice President responsible for contingency planning. She
had a very tough job, because the company had nothing in place other than backing up its
data files on a regular basis. Not only that, but contingency planning was not a priority
for the IT managers whose resources and support she needed. For the first year or so,
Ann worked all hours and with both passion and dedication. She made excellent
progress, which was recognized by IT management.
But then she started getting sick and having to take time off for recovery each time.
Fortunately, her health condition was not serious and I knew she would catch up as soon
as she got back to full health. However, the IT department had put in place attendance
standards that were very strict and had punitive consequences when they were not met.
My peers, especially in IT Operations, noticed that Ann had been out sick several times
and put pressure on me to give her at least a performance warning.
I was very reluctant indeed to give one of my best employees any kind of performance
warning. I am talking about a class lady that was not only excellent at her own job, but
was always ready and willing to help her peers out as needed.
Then she got sick again and had to take a week to recover.
My peers took the issue to Ron and to the HR department. They asked how they could
continue to enforce attendance requirements for their staff when I wouldnt do it for
mine. It didnt matter that their staff were almost entirely hourly-paid employees while
Ann was a highly-paid middle manager. I was instructed to formally counsel Ann.
I did what I had to do, went to my room, shut the door, and cried. Ann didnt take the
counseling well: she became very angry, asking me whether this meant I didnt have
confidence in her, whether I suspected she had not really been sick, and couldnt accept
my words that we would get past this. Within a month or so, she resigned and left
Presidents and above. He and his top lieutenants explained that our expenses were too
high and we needed to make some significant changes. This was unpleasant but
understandable news for us to hear and absorb.
What to this day I believe was unacceptable, although understandable in a way, was the
presentation by the head of HR (Hazel had retired and been replaced by a much younger
and assertive executive). He explained that this was an opportunity for each department
head to make improvements in their team. While it was necessary to comply with all
applicable laws and regulations (for example, not appearing to discriminate against
protected classes such as females, people of color, or individuals fifty years of age or
older) executives should take the opportunity to ensure that they were surrounded by
people who supported them.
He made it clear, without saying so in so many words, that it was not only okay but was
desirable to select those who would stay and those who would be laid off based on
their loyalty to the manager, not their level of performance.
I believe this was morally and ethically unacceptable, even though it was legal and the
company had every right to fire good employees in favor of friends.
As one whose performance assessments had always been exemplary, but whose mentors
within the company had lost power and authority, I saw this as an indication that my job
was at risk.
Sure enough, the wave reached the shores of IT. I was interviewed by the consultant. He
asked many of the questions that I, in his shoes, would have asked. He even asked me
for my opinion of where changes should be made to improve efficiency and
effectiveness. But he didnt ask all the questions that would have enabled him to
understand the value and set the right level of administrative services within IT, such
as in contingency planning, technical documentation, and so on.
Within the month, I was given instructions to select employees within my department for
layoff. While the numbers were somewhat (in my opinion) arbitrary, key positions in
information security were not going to be affected and each of my areas would continue,
if only with diminished numbers. The good news was that the selection for layoff would
be based primarily on performance.
While nobody would come out and say it, it was very clear that I would lose my job. I
had never met the new head of IT, John Ounjian, and he declined my request for a
meeting. Clearly, I had the wrong friends in management and didnt have a place on his
new team.
Although we now had a list of those who would be laid off, management waited months
before they actually pulled the trigger. During that time, everything had to continue,
projects had to be completed, and none of the individuals whose jobs were to end could
be told. We were also forbidden to tell those who would be retained that their jobs
were not at risk.
I changed, inside and out, from being a driver focused on achieving targets and meeting
deadlines to being the morale officer for my people.
It wasnt only that I wanted to prevent people who were going to be retained from
leaving.
It wasnt only that I wanted to keep people performing at a high level.
I wanted to make sure that everybody was acting in their own best interest. So, I
dropped hints that stayed within the rules (barely) but would help people make the right
decisions.
For example, I had hired a junior technical writer about a year earlier. She had been a
secretary within IT for a long time but her ambition was as a technical writer.
Unfortunately, she didnt have a lot of writing skills and her learning cycle was
unacceptably long. As a result, she had been formally counseled and placed on a
performance improvement plan. Tragically, her husband was a manager within IT that
was also on a performance improvement plan. Both were destined to lose their jobs.
Neither was taking any action to look for new ones, and this disturbed me. I visited my
lady quite often and tried to explain, bending but not breaking the rules, that she needed
to act. I made it clear that individuals would be selected for layoff based on
performance and that those who had been formally counseled were unlikely to be
retained. But neither she nor her husband started looking for new jobs until after the axe
fell.
Some have said that this experience, walking around the office as a morale officer,
concerned more with the financial and emotional well-being of my people than of
myself, made me human. It certainly made me a better, more empathetic manager.
I have learned that when people believe you care about them, are vested in their
success, and listen and show respect for them as individuals as well as worked, they
perform at markedly higher levels. They are loyal to you as you are loyal to them.
Something must have worked, because when I did leave the company and joined
American Savings Bank, three individuals followed me.
Steve Costa was a consultant that had worked for me on special projects and I was able
to hire to run one of my teams at American. Mary Beth Pastore was a former secretary
of mine whom I had promoted into a senior accounting position at Home Savings; she
did great things for me at American in the procurement and contract administration area,
receiving high praise from our legal department.
The third was a lady whom I had not met before I interviewed her for an analyst
position. When I asked why she wanted to join my team, she said that I had a reputation
at Home Savings as a good manager to work for, one who listened to and cared for the
success of every employee. Her experience at Home Savings had not been a positive
one, and she was more interested in my qualities as a manager than in the company she
was joining.
I believe that one of the best measures of a manager is in the number of individuals who
follow him as he changes jobs. I have been blessed to have a number of great people on
several of my teams over the years (including Katie Vo, Lorie Reynolds, Mary Beth
Pastore, Steve Costa, Mike Wilmouth, and Marty Patton). Mike Wilmouth said:
Leaders come in many different forms and can typically be categorized as
either dictatorial or humanistic. Professional and creative people thrive in an
environment where guidance, not micro-management is provided to promote
personal and professional growth and further creativity.
I have known Norman Marks for many years and his leadership style is
humanistic and genuinely cares about people no matter whether in his personal
or professional relationships. As a result Norman has always been known to
attract only the best of talent.
customer was at the other end, we owned that issue until the customer was satisfied.
I received a call from a customer. She wanted information about how the company
would handle her mortgage, something of which I was ignorant. But I was mindful of the
company policy and took all her information and promised to call her back. It took
several phone calls before I was able to find the right person for her to talk to. He said
he would call the customer, so when I called the customer as promised I was able to let
her know she should expect a call from this individual and gave her his contact
information. That wasnt sufficient for me, so after a few days I called her again to
ensure she had not only received the call but now had the information she needed.
This was an enriching experience. We have all suffered from poor customer service and
as a result of this incident I know not only what good customer service is and how
important it is to the organizations success, but how easy it can be if done right.
I have taken the lesson of this experience, that whoever receives the initial customer
contact should own it until the customer is satisfied, to other companies where I have
worked. It is a simple but powerful concept.
Warrens plan to bring back the outsourced systems and infrastructure nearly worked.
The project team was able to show that bringing it back in-house would cut costs by
30%-40% and potentially improve the quality of IT services to the business. But, the
board told management to go back to FiServ and give them a chance to make a counter
proposal.
We were astonished when FiServ came back with a proposal that they take over all but
a few of the companys IT systems and infrastructure (in other words, we would move
from 40% to 90% outsourcing) and this would cut total costs even deeper than the insourcing option. This was accepted and we prepared for layoffs. FiServ would need
and make offers to very few of our people.
For some reason, which escapes me to this day, the CFO thought I was an asset that
should be retained and offered me a position within Finance. However, that position
was undefined and involved a move to Irvine and a very long commute. I decided
instead to look for another job. The company would surely be put up for sale, so any
position was insecure, and the whole savings and loan industry was struggling to
compete with the more efficient banks.
I learned another lesson from my time with American Savings Bank. When Steve Costa
set up his team, which included individuals to develop standards, life cycle
methodologies, and tools for IT, everybody he hired was a mature and experienced
manager (such as the late Don Hayes, who led the development of an application life
cycle methodology that was ahead of its time).
Even though positions on his team generally had only senior analyst titles, these greyhaired folk (if they still had hair) were interested in the challenges and opportunities to
provide IT with leading edge methodologies and tools. They did a great job, in a limited
period of time, and it is unfortunate that the FiServ outsourcing cut short the opportunity
to see effect of all their work.
The lesson was that hiring motivated and experienced people may cost a little more per
person, but they need little supervision or management, are far more productive, and in
general create products that are practical, relevant, and useful to the business.
When Jay offered me the position as Director of Internal Audit, he told me that he was
not hiring me for that job! He expected that after a few years, when I had rebuilt the
department, I would move into a line management position. How wrong he would be! I
was CAE for Tosco for more than ten years. Although I was offered one position after
only a year (as head of procurement for Tosco Refining Company), and considered for
another (CIO), top management and the board liked the work I was doing and wanted
me to remain as CAE. They compensated me well and grew my responsibilities over
time (for example, I added a contracts audit team to the internal audit activity, then an
investigations unit, and even picked up IT quality assurance).
When I first became acquainted with the company, Tosco had grown from its beginnings
as an investment vehicle in shale oil (Tosco stood for The Oil Shale Company) to own
four U.S. refineries. The first time I visited its Bakersfield, California operation (which
is where it had its IT operations), I flew there from Los Angeles in the company plane.
But by the time that I joined the company, it had fallen on very hard times. It was leaking
cash and struggling to remain afloat. Financial management met twice each day, just to
confirm that they had sufficient cash to make it to the next meeting.
Tom OMalley came to the rescue. Tom had made his fortune as a trader with one of the
large Wall Street firms. With a small group of investors, he purchased a controlling
interest in Tosco with a view to selling it off in pieces. Three smaller refineries were
sold, leaving just the major asset, a refinery near San Francisco, California (Avon). But
he couldnt find a buyer for the Avon refinery.
Tom decided to switch direction. He installed himself as CEO, one of his partners as
President, and brought in additional heavyweight individuals to run the company. Jay
Allen was hired as CFO and he, in turn, hired Bill Hantke as Corporate Controller and
me as Director of Internal Audit. Tom also hired Wilkes McClave as General Counsel.
Other key players included Jim Cleary, President of Tosco Refining Company; Bob
Santo, Financial Reporting; and Pete Sutton, who led the teams that acquired crude oil
for the refinery and sold its products, and the derivatives trading desk.
The company decided to diversify its operations and acquired a phosphate fertilizer
company, Seminole, in Lakeland Florida. But within a few years, Seminole would be
sold and Tosco refocused on its oil and gas refining business.
When Tom took over as CEO, the year I joined as CAE, Tosco was a $2 billion
company and marginally profitable. By the time I left, more than ten years later when
Tom engineered a sale to Phillips Petroleum, the company had grown to $28 billion in
revenue and was the largest U.S. domestic refining company with eight refineries across
the U.S.A.
It was a tremendous success. I attended the last call Tom and Jay had with the analysts
that covered the company to review its quarterly earnings.
After Tom opened the meeting, one of the analysts interrupted and asked to speak. He
said that he and the rest of the analysts wanted to show their appreciation for
managements delivery of value to the companys shareholders over the last ten years.
The analysts applauded, clapping their hands for a few minutes while those of us in
management smiled at each other somewhat in shock, because none of us had ever
heard of analysts ever doing this.
Tosco was the best company I worked for, with the best management team by far. Tom
was an entrepreneur and encouraged his management team to be entrepreneurial.
Managers were empowered and respected. Those that performed well were rewarded,
not only financially but through promotions.
The culture was excellent, with great attention paid to employee safety. (In later years,
the Avon refinery had several fires and explosions and people lost their lives. Tom and
the board decided that although this had been a highly profitable operation, it was also
highly complex and difficult to operate at an acceptable level of reliability and safety,
success.
Other acquisitions included refineries in or near Philadelphia, St. Louis, Los Angeles,
San Francisco, and New Orleans.
The company diversified again when it acquired the Circle K business in Tempe,
Arizona (near Phoenix). It consolidated its convenience store and gas station business
(together about 6,000 locations) in a new Tosco Marketing Company, in Tempe, led by
Bob Lavinia.
At the time of its sale, Tosco was a $48 billion company; about 60% of its revenue and
a larger share of earnings came from refining operations, the rest from its marketing
company. Tom was CEO, Jay was President and CFO, and Dwight and Bob were
Executive Vice Presidents and Presidents of our two divisions: Tosco Refining and
Tosco Marketing.
Top management and the board were extremely supportive of internal audit and gave me
great freedom to be innovative as CAE.
I believe that for an internal audit function to attain world-class performance, and to be
recognized as such by management and the board, it needs a combination of:
An innovative CAE that has a deep understanding of the business, is able to
influence and persuade management and the board as necessary to effect
change, is flexible and able to adapt to changing internal and external business
conditions, and is able to hire, retain, and motivate an outstanding team of
professionals
A talented team of internal audit staff that also has a deep understanding of the
business. Between them, they have the technical skills and experience necessary
to address all the risks that matter to the success of the organization (this may
involve supplementing the staff using co-sourcing partners and guest auditors
from within the business), and the soft skills to listen, communicate, influence,
and persuade
The support of the audit committee, board, and top management. This includes
providing the CAE with the necessary resources to address and contribute
useful insights into the risks that matter to the success of the organization, and
the freedom to be innovative and agile when needed
I had this trifecta at Tosco, and I believe I won the lottery in the process.
change that had been made to the log file itself. She investigated and found that one of
the system programmers (a group with incredible technical skills who sometimes
thought of themselves as the gods of IT and above any security rules) had wanted to
change a system file. But his access to that file was restricted. So, he found a way to
alter the access rules to allow him to make the change, change the rules back when he
was done, and then remove the log entries that recorded the fact that he had changed the
rules. But, when he changed the log file, that change was itself recorded in the log file.
Deb didnt have the resume of a systems programmer, nor the advanced degrees that the
rogue programmer held. But her curiosity, intelligence, and perseverance found the
security breach and she was even able to identify the specific lines of code that had
been changed, by whom, and when.
I value those skills, attitude, and the potential they represent far more than any formal
training or certifications. I had been working with an executive recruiter, the late Jamie
Mahar, for some years. He always called me to tell me about his latest superb
candidate. He extolled the individual for perhaps five minutes, during which time all he
talked about were the candidates certifications, formal education and training. I would
shut him down by asking whether the individual could think.
Too many auditors are trained not to think. They are told to follow an audit program or
checklist that somebody else created (in some cases, the checklist may have been
developed some years earlier when the environment was different, and in other cases
taken from a textbook without specific tailoring for the organization being audited). One
of my tasks, as a manager and developer of these people, was to break those chains and
insist that they think for themselves.
I had to find a way to assess each candidates intellect, curiosity, imagination, and
ability to learn during my interviews with them. The standard questioning based on the
resume would not work, especially as candidates were generally prepared and trained
by the executive recruiter on how to answer such questions.
When I interviewed with the chairman of the Tosco audit committee, Michael
Tennenbaum, I learned a lesson in non-traditional interviewing. It didnt help that I had
been told that this brilliant man was eccentric, driving a pink Rolls Royce Corniche to
and from his aerie office near Beverly Hills (he was a Vice Chair with Bear, Stearns)
and at the age of 74 skied a grand slalom course at Vail. I entered the meeting with the
great man already a little intimidated, but I was somewhat prepared for the barrage of
questions about why I had twice postponed my interview. He tested my mettle and
whether I could stand up to him and for myself. (This helped him assess whether I
would be able to stand up to management should the need arise.)
I was not ready for the next line of questioning. Instead of asking about my prior
experience, he asked me what I read. He explored how my mind worked, whether I was
open to new ideas, could work with management and not just be a thorn in their side,
and whether I had the intellectual ability to contribute as a direct report to the audit
committee and an advisor to top management.
When I interviewed potential new hires, I wanted to obtain the same kind of insights
into their mind brilliant or stale. So, I developed a style of interviewing that many find
unusual. It has multiple benefits: in addition to helping assess peoples ability to think, it
gets past the barriers created when recruiters train their candidates how to answer
questions during an interview because I ask questions they cannot predict.
The essence of the interviewing technique is to help the candidate first become
comfortable by asking them questions about their resume and why they have applied.
They are ready for this and confident in their replies.
Then, I describe a situation (based on a real life experience that they should understand,
at least in principle) and ask how they would approach an audit. If they ask for an audit
program, that would conclude the interview. But, if they ask questions to improve their
understanding of the underlying risks they would earn points of respect.
It doesnt matter whether they come up with the same approach that I would take, or
even if they overlook an important issue. What matters to me is whether they are able to
think through a situation they have never encountered and suggest an audit approach that
makes sense and demonstrates that they have an intellect and can use it.
I have been told that candidates are not able to read whether I am satisfied with their
answers and whether they are doing well in the interview. But they do say that I make
them feel comfortable and stretch their ability to think on the fly. That is what I am
trying to achieve and it seems to have worked well over the years.
In hindsight, I have been blessed to have had the support of some brilliant people over
the years. I am very proud of the teams I have led. Of course I have made mistakes and
some of the hires didnt work out as well as I had hoped. But, most of the mistakes
occurred when I made the mistake of placing too much trust in an individuals resume
and too little on their intelligence, or placed too much trust in a direct report to hire
well without ensuring that they understand how to assess intellect, curiosity, and
imagination.
I mentioned before that one way to assess a manager is to see how many people follow
him as he or she changes jobs. I have been lucky to have quite a few do that as I moved
to a new company.
Another measure is how well your people advance in their careers. I am proud of the
number who have moved into CAE, CFO, and other senior positions. I thank them for
making me successful through their hard work.
At Tosco, I started the internal audit department by hiring only managers. That is an
approach that I continued as I built the department at Tosco (to as many as 28 in the
internal audit part of my team by the time the company was acquired) and hired internal
auditors at my subsequent companies.
My style of auditing is very much focused on addressing the risks that matter and
working collaboratively with management to improve the way they are managed.
This requires individuals who can leverage their experience and intellect to drive
business-practical change, rather than individuals who can only follow an audit program
or checklist.
Risk-based auditing is not about selecting a sample of transactions and testing whether
they meet certain conditions, then reporting on whether the controls are working as
desired. It is about assessing whether the risks that matter to the success of the
organization are being managed at acceptable levels. While some level of transaction
testing is usually involved, interpreting what you see as an auditor and finding ways to
improve business operations is far more important.
It is true that you can probably hire three senior auditors for the price of two audit
managers, or a larger number of people if you hire junior staff. However, not only do
junior staff have less to contribute than managers in terms of ideas and the ability to
influence management but they also require supervision and training by managers.
It is my experience that the time required for an audit manager to supervise a senior
auditor, including helping them with defining the project scope and approach, reviewing
the work during and after the audit, and rewriting the audit report, is at least as much
time as they would require to perform the audit themselves.
At Tosco, we built and maintained an internal audit department that performed more
audits at a lower total cost than our peers (based on benchmarking directly with them as
well as using IIA benchmarking studies), and was respected by the board and
management for making a significant contribution to the organizations success.
Management knew that when we performed an audit, they were going to work with
dedicated, experienced professionals who had the ability and desire to help them be
successful. You can do that when you are staffed with managers. It is far more difficult
when you have a less experienced team.
The Bayway refinery in Linden, New Jersey, frequently entertained visiting dignitaries.
I was in the refinery one time when the Refining Company Controller (Steve) called me
over. He told me that the previous week, he had been with Dwight Wiggins when the
Governor of the State of New Jersey visited and took a tour of the refinery.
Steve told that that as part of his description of the business, Dwight told the Governor
that internal audit gave Tosco a competitive advantage! Why was this possible? The
internal audit team gave Dwight assurance and therefore confidence that his processes
and controls were managing risks to the operation, and our contracts audit team was
helping drive costs down and quality up.
That same year, I was in Phoenix for a Tosco Marketing Company executive team
meeting (I attending both the Refining and Marketing companies executive meetings
when I was in town) when Bob Lavinia introduced a guest: the Republican candidate
for Attorney General of the State of Arizona.
Bob went around the table, explaining what each of his team members did. This is our
CFO, he makes sure we are financially sound Here is our head of Marketing, who
leads our advertising and branding programs. He continued in this vein and then he
saw me, hesitated, and then said This is Norman Marks, who runs our internal audit
team. He makes sure we stay efficient.
You can look in the mirror and tell yourself you are good looking. But the only praise
that matters is from somebody you respect, or your customer.
meetings of the executive team. Every incident was investigated thoroughly and tough
questions were asked of those involved in both incident and near-misses (where there
could have been an incident, but we were lucky). Direct supervisors and their managers
were called in to explain what happened, why, and what action they were taking to
ensure it didnt happen again.
My office, like most of the executives, was inside the refinery. We were personally at
risk should there be a fire, explosion, or chemical release. To portray our executives as
less than fully committed to the safety of our employees, our neighbors and the
community, and the environment in which we live, would be unfounded and contrary to
the facts.
I was and continue to be proud to have been associated with the management team at
Tosco, who always put people ahead of profits.
I am also proud to have worked with people like Jim Cleary, Dwight Wiggins, Tom
Nimbley, Tom OMalley, and many more at Tosco who acted like gentlemen. They
didnt talk about empowering employees; they just did it, listening to them, learning
from them, and always showing respect.
I have tried to demonstrate the same qualities as a manager. I have great respect for the
people on my team. I know that they often have greater insights and better ideas than I.
They see things from a different perspective, which can be very valuable. So I listen and
learn from them as much as I can.
I know not only that I can only be successful if I have a strong team (my success is only
a reflection of their success), but that when they feel respected, empowered, and
appreciated their level of work increases.
In Phoenix, we had many internal candidates for positions on our internal audit and
contracts audit teams. They came from all parts of the business and I was surprised, as
internal audit is generally seen as a path into the business rather than the other way
around.
Although I had direct reports for each of my areas, where possible I liked to be
involved in the hiring process. I interviewed one young individual who worked in
Finance and wanted to join internal audit. When I asked why, her answer was Internal
audit is the only department in the company that seems to be having fun! Every time we
pass your offices, we see smiles and hear laughter. She heard the sounds of happy,
empowered and respected employees who knew they were making a difference.
On another occasion, I was leaving my Phoenix office at about 7pm when I saw one of
my managers, Loretta Forti-Corson, still busy at work. I stepped into her office and was
welcomed with a smile. I asked Loretta why she was still working, to which she replied
that she would be leaving soon but had a few things she wanted to finish first. I knew
she was married and asked if her husband would be making dinner. She laughed no. I
said something about him being very patient as he waited for his evening meal. She sat
back and said Norman, I am having too much fun to leave right now.
concept of opportunity cost: the cost of doing one thing was not simply the out-ofpocket cost of the resources employed; it was also the lost opportunity of doing
something else. When we spent time looking at low-risk areas in, for example, accounts
payable, the cost was the lost opportunity to spend that time looking at higher risk areas
in accounts receivable.
Some organizations today perform a second risk assessment once they have prioritized
their audit universe. They take each higher priority area and identify the highest areas of
risk within that unit or process, and that is where they focus their audit of that area. The
result is an audit plan where the area is determined by relative ranking of risk factors
and the scope of each audit is based on a risk assessment of the risks within that area. In
other words, the unit, process, or location to audit is the result of risk-ranking the audit
universe. But what is audited in each selected unit, process, or location is based on the
risks within that unit, process, or location.
But I felt then and now that this leaves internal audit assessing risks and related controls
that matter to the local business but not necessarily to the enterprise as a whole.
I took a different approach. Instead of populating my audit universe with business units,
processes, locations, and so on, I went one level down and included the risks within
each of the above. I then compared these risks across the enterprise and ranked them
against each other.
The ranking would be based on their significance to Tosco, not just to the location. For
example, I might identify payments to consultants as a high risk area within
procurement and accounts payable. That would be compared to the accuracy of
customer pricing within billing and receivables to determine which audit was the
greater priority and should be included in the audit plan.
I considered this a risk-based audit planning process that resulted in addressing the
more significant risks to the organization. The engagements in the audit plan were
focused audits focused on those areas within each process or unit that represented
the greater risk when viewed with a wider lens, the lens of the entire organization.
During this time, I attended a number of conferences and answered a number of surveys
where the question was asked: How large is your audit universe? The intent was to
compare the number of auditors to the potential number of audits. Most people
answered with the number of business units, locations, and processes what they
considered auditable entities.
I had fun with my answer. Since I could audit any process or area many different ways, I
answered that my audit universe was infinite. (If asked to explain, I might take the
example of accounts payable and say that I could perform a controls audit; an
operational efficiency audit; a search for duplicate payments; a search for indicators of
fraud; an audit of controls over payments to contractors, sole-source vendors, and so on;
an audit of controls over payments to vendors in China or Mexico; and so on, and so on.
One of the byproducts of the revised audit approach was that I was able to cut the
average audit from several hundred hours to (typically) less than two hundred; many
were only 120 hours or less.
With a small staff (just four auditors in 1992, including me), we were able to complete
about 50 audit engagements. A better to way to think about that is that we were able to
assess the controls over more than hundred risks (if the average audit addressed a
couple of risks).
On average, my audit teams completed about 12 audits per person each year.
But this still wasnt enough for me. While it was risk-based, we were still thinking
about units, locations, and processes. We were not stepping back and thinking about the
risks that matter to the success of the enterprise as a whole.
A jaw-dropping moment happened when I explained my risk assessment and audit plan
to the audit committee of the board.
The CEO, Tom OMalley, sat in on audit committee meetings in the early years. While
this was sometimes intimidating, I was pleased to see him give the audit committee and
internal audit his valuable time and attention. (He was always 100% present. In other
companies, I have seen the CEO flit in and out of the meeting, sometimes taking
committee members away to have private discussions and disrupting the committee in
the process).
Tom made a lasting impact when he asked whether I had considered risks related to the
blending of gasoline, diesel, and jet fuel. As it happened, I had but it was not
considered high risk; it was more a compliance issue than anything else. I told Mr.
OMalley that I would revisit the risk assessment and he agreed that I should. (This was
a subtle hint that I heard and understood!)
When I talked to Dwight Wiggins after the meeting, he told me that when he was with
Exxon they performed an enterprise-wide risk assessment. Jet fuel blending was
identified as their #1 risk! Poorly-blended jet fuel could lead to Boeing 747s dropping
out of the sky into densely-packed urban areas, with the potential to bankrupt the largest
(at that time) company in the world. A few years later, I saw the effect of poor blending
of diesel fuel when Southern California drivers had major dieseling and pinging
problems and fingers were pointed at us as well as a few other oil companies.
So, I moved to an approach where I identified the top risks to the achievement of the
companys objectives (a risk universe instead of an audit universe), and then identified
the engagements I could perform to provide assurance that the controls were adequate
with respect to those risks and advice where they did not.
This, for me, is modern risk-based auditing.
I use a metaphor to explain how this is different.
In the old days, I might decide to perform an audit of my car. After all, it is a high-risk
area. So, I will assess the quality and condition of the engine, steering, tires, air
conditioning, etc. Perhaps I will find some defects and recommend service and repairs.
These days, I would consider my objective: traveling from my home in San Jose to the
airport in San Francisco (42 miles). The risks include a breakdown of the car, an
accident involving my car or others, traffic congestion, and weather. My audit would
include looking at aspects of the car that I rely on to address these risks, including not
only the condition of the engine and so on, but whether I am tuned in to traffic and
weather on the radio. I would also consider how I can ensure I am sufficiently awake (if
my flight is at 6am) and how I would know whether to take an alternate route.
The older audit is focused on auditing the car; the second is auditing my ability to arrive
safely and on time.
Initially, I would sit down with the executives and discuss their business plan and
objectives. That was a good start but many business objectives (such as maintain a
positive cash flow) are never actually stated. So I needed another tool.
I attended a presentation where another CAE showed us how he discussed enterprise
risks with the management team (remember, back in those days nobody was talking
about enterprise risk management; risk managers were typically responsible for
insurance). I liked the graphic he used and have updated it as a discussion tool for every
company I worked at since.
Figure 1 (below) shows the 2010 version.
Depending on the executive and how he or she liked to work, we might look at every
entry on the diagram and I would ask him to identify those that were significant within
the context of the organizations strategies, goals, and objectives. Then we would look
to see if there are any risks that were not on the chart and talk about whether they were
significant.
But the purpose was not just to rate the chart entries. It was to stimulate a wide-ranging
discussion of the state of the enterprise.
The end result was satisfying in a couple of ways. First, the broad-based discussion of
the business was very well received by the executive. I frequently heard that ours was a
rare opportunity for the executive to think broadly about the business, rather than
focusing narrowly on his area and worries. This contributed to our mutual respect and
understanding: a valuable asset that I was able to leverage whenever it was necessary to
talk about the condition of risks and controls in his area. Secondly, we had a shared
understanding of the risks that mattered. I was able to use that to build the risk-based
audit plan.
I developed a rolling audit plan that had two elements: a fairly solid plan for the next
quarter, and a list of prioritized projects that I hoped to be able to initiate later in the
year. Even the next quarters plan was subject to change, should the business and its
risks change.
I told management and the audit committee that the purpose of the rolling audit plan was
to be agile. It was not only able to adapt to include audit engagements around new risks
and remove engagements where the risk had diminished, but I was now able to respond
to requests for assistance from management or the audit committee. Other internal audit
departments allocated up to 40% of their audit plan for management requests, but I felt
my approach was better.
Each quarter, or more frequently if needed, I would include a review of the audit plan in
my report to the audit committee. I would discuss what had been completed, what I
expected to do in the next quarter and by year-end, and explain why projects (and risks)
had been added or removed from the audit plan.
The audit committee and management readily endorsed this approach, as it demonstrated
agility and the flexibility to adapt and change as the business changed and the business
was certainly changing. It was growing fast, primarily through acquisition but also
organically as Toms strategies were paying off and our market share (and profits)
expanded.
Tosco went from revenues of $2 billion in 1990 to more than $28 billion in 2000. My
internal audit staff also expanded during that time, from 4 to 29 (including me). In other
words, the internal audit staff grew at about half the pace that revenues grew. However,
neither I nor the audit committee believed that we were leaving significant risks on the
table.
The risk-based approach enabled me to run not only an effective internal audit
department, but one that was highly efficient. When I looked at internal audit cost
benchmarks (such as the GAIN study from the Institute of Internal Auditors), we always
came in significantly below the average cost per dollar of revenue.
I didnt run into any more frauds (only attempts by an employee to place a logic bomb to
create havoc see Chapter 14) until I joined Tosco, when two unusual situations came
up in my first few years.
In the first, one of the audit team was performing an audit of safety at the Avon refinery
when she found a discrepancy in the safety reports. These were regular reports to
management by the refinery safety department of the number of accidents that resulted in
injuries, the number of lost days, and the number of near-misses (incidents that could
have, but didnt, lead to an injury). She was able to determine that the analyst in the
safety department had deliberately manipulated the statistics to make the safety record
look better than it was. The analyst admitted that she had done this. Her motive was not
financial gain; she was hiding her managers poor performance.
We all commit so-called white lies, for example when our spouse asks if her new
dress makes her look fat! The analyst thought this was an innocent white lie. But the
potential harm was huge! Refinery management was not aware of the decline in its
safety performance and therefore had not taken any action to investigate its causes and
take necessary corrective actions.
In this case, appropriate disciplinary action was taken against both the analyst and her
manager. Although there was no proof of complicity in the fraud by the manager, he
signed the report and should have known it was fraudulent.
The second situation, a couple of years later, taught me more about human moral
weaknesses.
Donna Philpott, the Assistant Controller for our refining operations, called me. She had
just received a call from the California Bar Association telling her that one of our
employees had filed a curious complaint against one of their members.
The employee, who was an accountant in our Concord office, alleged in his complaint
that he had entered into an arrangement where the attorney would set up a dummy
corporation and send Tosco invoices for fictional services. Our employee would
arrange for the corporation to be set up as a vendor and for the invoices to be paid. (He
had approval authority for invoices under a certain value.) The agreement was that the
attorney would split the proceeds with the employee.
The complaint was that the attorney had kept all the money to himself! Clearly, he
couldnt be trusted!
We investigated and found a couple of other vendors with the same postal address as
the one in the complaint. One of those vendors was managed, not in the Concord office,
but in the Seattle office. We didnt have access to the complete history of transactions in
that vendors accounts, so I called the Seattle Controller, Tim.
My team and I had, I thought, been very careful to keep the investigation quiet. I am a
strong believer in limiting the number of people in the know to ensure that the
potential culprit doesnt hear about the investigation until we are ready. The first risk
we are managing is that he might destroy evidence. In addition, sometimes other people
are involved, potentially including individuals in management. We dont want them to
know, for the same reason.
Finally, and this is important, we must be careful not to damage anybodys career or
reputation by letting others know their conduct is being investigated. In many cases, the
people we suspect of inappropriate conduct are innocent; if people (especially in
management) have heard they were suspected of fraud that might lead their managers to
have questions about their performance and lose trust in them.
So, when I called Tim to ask for his help on a confidential matter and told him we
needed the history on a particular vendor, his reply shocked me:
But Norman, I was expecting you to ask for information on three accounts, not just this
one. Someone in the Concord Controllers office had loose lips! After I hung up with
Tim, my next stop was to talk to Bill and Donna and stress the importance of keeping
this kind of information to themselves. The next time I was in Seattle, I had a similar
conversation with Tim, because the investigation was common knowledge in that office.
The individual involved eventually confessed to fraud and the last I heard, he was a
former employee in police custody.
I formed a set of principles from these experiences that have served me well over the
years, although at times they have been difficult to observe:
1. Anybody, even your closest friend is capable of committing fraud.
Circumstances change and anybody can, in a moment of weakness, rationalize
theft and fraud.
2. It is critical to keep investigations confidential. There is a great risk to morale,
let alone peoples reputation and careers, when investigations are public.
3. Never assume guilt. For a start, that is a legal definition and judgment that
should only be made by the companys attorney. But, even more importantly,
we dont have all the facts to make that determination until everybody has had a
chance to tell their story and that includes the individual suspected of the
fraud. Often, I have had to hold my investigators back from their growing
suspicions because the target has not had a chance to respond; when they did,
they sometimes had proof of innocence.
There will be more on the topic of fraud and investigations in later chapters.
Lorie Reynolds and I performed an audit of information security over the companys
primary data center in Concord, California. By now, Tosco had grown significantly,
adding a second large refinery in Linden, New Jersey (the Bayway Refinery, acquired
from Exxon) and a smaller refinery and gas station business in Ferndale, Washington
(acquired from BP). But, the companys financial system and other legacy applications
were run at the Tosco Refining Company (TRC) data center and managed by TRCs IT
department, led by S. Denny Smith.
We knew going into the audit that the legacy systems were quite old, written in COBOL,
and severely patched over the years. They were no longer supported by the vendor, but
generally met the requirements of the users.
(As an amusing aside, initially the IT folk gave me the respect technical people often
give accountants when it comes to technical matters little or none. So, as part of an
audit of the refinerys legacy system one of those COBOL applications I decided to
read the code and was able to point out a number of coding errors. (Rather than delete
superseded code, they had branched around it because they didnt fully understand the
purpose of the code. There were two failures here: first, when they wrote or maintained
code, they didnt document (whether in system documentation or in Notes within the
code) what they were doing; second, when they branched around code rather than
deleting it, they created a risk that a future change would activate the original code and
cause the program to fail.) By pointing out how they had made these errors, and
demonstrating that I could not only read but critique their work, I obtained their lasting
respect.)
What we didnt know until we performed the audit was that the only security over the
legacy applications was within the applications themselves and that only applied to
online transactions. There was no security to speak of over batch jobs that accessed the
application files for overnight and other processing.
The risk was high. While we believed that user controls would prevent any major
failure when it came to either financial reporting or other critical business processes,
the risk of business disruption from a security breach was significant.
But we didnt make the leap to insisting on immediate corrective action. For a start, we
knew that the company planned at some stage to move much of its IT production to a
new data center at Bayway. We didnt know when that would happen or what would
move.
Lorie and I met with Denny and his manager, Bill McDaniel. We learned that
management planned to shut down the entire Concord data center in favor of a new
Bayway data center. In addition, because of anticipated company growth and a desire to
upgrade to a modern set of applications, the plan was to replace the legacy systems as
justification was the very high level of capital spending by the Marketing Company,
especially compared to the level of profits, and the need to ensure capital was focused
on projects that would drive revenue and/or lower costs.
Rick and Loretta (who would be the audit project lead) came to me with a proposed
scope and objectives. The plan was to review the process for reviewing AFEs that had
been submitted by the field to Finance (where they were handled by a team led by Mike
Passaretti, a graduate of my internal audit team at the Bayway refinery). The audit focus
would be on how Finance confirmed authorizations, recalculated and verified the
business justification, obtained all required management approvals, and after the project
was completed performed a post-implementation review to validate that spending and
benefits were as described in the AFE.
This was a very traditional audit approach and I probably demonstrated how I felt about
it by yawning (purely for effect).
I am great believer that internal auditors need to get out into the field and listen to
managers and staff in the trenches if they are to understand the business, its risks and
opportunities.
Tom Peters talked about this:
If you want to understand how a business really works, talk to the janitor.
Now I am not going to say that I spoke to the janitor, but I did spend a lot of time talking
to the people running the business. At the Refining Company, I talked to refinery unit
operators, line managers, procurement people, pipeline operators, oil tank managers,
and so on. At the Marketing Company, I similarly talked to the people who ran the
company from the front lines and interacted with its customers and suppliers every day.
I not only met with convenience store managers, but spent time riding with district
managers as they drove around their areas. That gave me the opportunity to get to know
them, their troubles and concerns, as well as see them in action as they worked with
individual store managers and staff.
On one of those excursions, the district manager told me about how one of his store
managers had come up with a great idea. His combined Circle K store and Union 76
gasoline station was at one corner of a major intersection in Los Angeles, with two of
the other corners occupied by other branded gasoline stations. The city had sent a notice
to the manager letting him know they would be performing major street upgrades at the
intersection that would close much of it (including access to all three gas stations) for
several weeks. The district manager helped him put together an AFE requesting a
modest investment in a new entrance to our unit. The benefit would be huge, as ours
would then be the only open gas station at this very busy intersection.
The AFE was approved, but it took the divisions headquarters people a couple of
months to review and approve the spending. By then, the roadwork had been completed,
the intersection re-opened, and the opportunity lost.
Both the district and other managers of our store operations believed that the delay in
this AFE was typical. In fact, they told me that there was a greater risk to the business
from such delays or even failing to approve AFEs than any risk that might be created
from capital projects that were not justified.
I shared my experience with Rick and Loretta and we changed the objective for the
audit.
Instead of the traditional definition of scope and objectives, I asked them to answer this
question:
Does the AFE process meet the needs of the business, considering the risk of
inappropriate expenditure, the need for timely decisions, and the
administrative cost of the process?
Loretta found the traditional part of the audit, assessing the controls over the risk of
inappropriate expenditure, easy and straight-forward.
But the challenge when it came to timeliness was greater and more interesting.
It was relatively easy to find out how the process worked. Once a month, the division
CFO gathered all the Vice Presidents and they collectively reviewed all the AFEs and
the analysis prepared by Mike Passaretti and his team. They would take about half a day
to discuss them and decide which they would propose should move forward and what
the priority was for each.
The next meeting, typically the following day, was with the division CEO, Bob. The
CFO and all the Vice Presidents would review with Bob the AFEs they believed should
go forward. When he felt that the total was too high or disagreed with the VPs
recommendations, the executives had to debate which would be approved, which might
be deferred, and which would be declined. This meeting also took a half-day on
average.
Because of the intense review and approval process, each executive was careful to
ensure all the AFEs they proposed had complete and accurate analyses included in the
package. Mike and his team were equally careful with their review and analysis. This
the language of the executives they are attempting to inform or persuade (which is the
objective of an audit report) are unlikely to succeed.
Loretta said that Bob responded with silence, clearly thinking about what she had said.
Then he shocked her by telling her that he was the problem. He recognized that his
insistence on discussing and approving every AFE could not continue. Bob told Loretta
she had done an excellent job and that he would like to talk to me.
When I met Bob later that week, he repeated his praise for Loretta. Then he asked for
my opinion. Again I was smart and didnt give him my opinion straight away. Instead, I
asked him why he wanted to approve every AFE.
After a short hesitation, he said that perhaps he should only approve major capital
expenditures instead of every one. I concurred, saying that was what I was used to and
would advise.
But I kept at it. Why had he insisted on approving every AFE? This was not what he had
done in his previous positions with the company, nor was it what he was used to
working directly for Tom OMalley a consistent and effective delegator.
Then he looked again in the mirror and saw his true self.
Norman, I can see now that I didnt trust my direct reports enough to make these
decisions!
We talked about this for a while. Either he had the wrong people in these key positions,
in which case he needed to replace them, or he needed to trust the people he had and
delegate more effectively. He didnt hesitate before saying he had excellent people; he
just had to let go, take a little more risk, and trust and delegate.
For the next couple of weeks, Loretta and I had a trail of VPs visiting us to express their
thanks for Lorettas great work. Bob had changed the entire process, with new
delegations of authority such that the VPs could approve most AFEs, the CFO would
have to approve all over a certain value, and Bob was only involved in truly major
capital expenditures.
Incidentally, the story I told in Chapter 23 about Loretta having too much fun to leave the
office at 7pm was during this project.
Surely, this is a story worth telling your grandchildren. It was .dynamic, stimulating,
a major bond builder among co-workers, a source of buzz among customers, and
inspiring, exhausting, hot, cool, sexy, where everyone wants to be.
The cover sheet was the first part of my answer to that question.
If either of the answers to the two questions on the cover page was Yes, I would
include a sentence (at most two) explaining the issue. Then they could read the rest of
the report (or at least the Executive Summary) for more.
If the answers were both No, unless they had a particular interest in the topic
addressed by the audit, they might not read further and they didnt need to.
There was more that I wanted to do to make sure my audit reports were easy for board
members and executives.
I wanted to avoid the need for anybody, including myself, to have to highlight what the
executives and board members needed to read.
I wanted the audit report to be the highlighted content, with everything else either
omitted or relegated either to the end of the report, included as an attachment,
communicated in another way (e.g., to operating management at the closing meeting), or
omitted entirely.
In other words, I wanted the executives to be able to read just the first 0few paragraphs
and obtain the most critical information and satisfy their needs.
The first page of the audit report, behind the cover page described in Figure 2, is an
Executive Summary and starts with the most important piece of information the
executives needed to hear: our opinion on the adequacy of the controls over the risks
included in our scope.
Figure 3 is the first part of the Executive Summary of a report from my team at Business
Objects.
The traditional way to express an opinion in an audit report is through a rating scale,
such as one that uses a three point scale of Satisfactory, Needs Improvement, and
Unsatisfactory.
I dont believe that a rating scale conveys to the executive reader what they need to
know.
If we are tasked with assessing controls over risks, we should not only be telling
management whether the risks are being managed effectively but explain, in business
language, the effect on corporate objectives.
In Chapter 7, I told the story about how I asked Audrey Lee to explain what a draft audit
report following her Shenzhen audit meant (see Figure 4). I asked her what she would
tell the CEO if they were in an elevator and she said: I would tell him that the controls
in Shenzhen are not strong enough to support the planned 20% expansion of our business
there.
This is providing management with the information they need to run the business. It was
Rating Number of
Significant
Issues
General Accounting
3
Procurement
4
Inventory management
6
Employee health and
2
safety
IT security
7
Customer billing
6
Code of conduct
3
training
Other
Issues
5
7
6
1
8
3
6
In those days, we mailed the audit reports. Later, we started sending them as attachments
to emails.
I modified my approach to include the most critical information that I wanted all
recipients to read in the email. If there were no issues meriting their attention, they
could choose whether to download and read the attachment or not.
I recognized that if I made it easier and faster for time-strapped executives to receive
the information they needed from me, they would be more likely to open and read the
email. But, if they knew as they read the email only that there was an audit report
attached, which might be many pages in length, they would probably defer reading until
they had time (which sometimes was only over a weekend or when they were on a
plane).
Figure 5, below, is an example of an email I sent to the executives and board members a
few years later.
Figure 5: Example of an Emailed Audit Report
I recognized early on that I have multiple people to whom I needed to communicate the
results of my teams work. In addition to the executive management team and the board,
who wanted high level information that might affect their work, I needed to share with
operating management much more detail: what exactly was not working the way they
wanted, and what should they do about it.
The first opportunity to communicate information that management needs to know is
during the audit itself when the issue or question first surfaces.
It is important to share these with operating management promptly, not only to confirm
the facts, but to help them initiate corrective action quickly.
After all, we share the same goal: ensuring that risks are managed effectively.
We should not consider them and they should not consider us as adversaries.
Our goal should be to effect improvement, not to report as many issues as we can.
Frankly, I dont mind at all if management corrects issues before the report is issued. I
will either drop the item from the report, especially if there is no need for executive
management to know the weakness existed, or give management full credit for making
the change.
By the way, I had an unsettling experience at an audit committee meeting (this was preSOX).
The external auditors shared information about the internal control weakness they had
identified during their controls testing. They said that the risk from one of those
weaknesses was fraud. However, I was not told about the weakness until just before the
audit committee meeting perhaps 8 weeks after their controls testing identified the
issue.
I was not shy about sharing my views on the delay in informing me, as the head of the
internal audit function, that there was a control weakness that represented a risk of fraud
that the external auditors considered significant enough to report to the audit committee
of the board.
The audit partner tried to tell me that he was not able to share the issue until the manager
had reviewed the working papers and then discussed it with him; their standard process
was for him to have that discussion of the results of testing only when the testing phase
of the audit was finished.
I told him that was unacceptable and why. When I asked, he confirmed that operating
management was also not informed until the week prior to the audit committee meeting,
when the draft audit report was sent to them for comment.
When a control weakness opens the door to theft or fraud, management needs to know
immediately so they can close it.
In the same way, we have an obligation to management to inform them of any risk or
control concern as soon as possible so it can be addressed.
The next opportunity is the closing meeting. This is a vitally important meeting where
the audit team and management can review the results of the audit engagement; ensure a
common understanding of the findings the facts, what they mean to the business, the
level of risk and whether it is acceptable; who will take action, if necessary, and what
will they do by when.
Some issues, where the internal audit team believes that the risk is low, can be
addressed by management at the closing meeting, and there is no need to inform more
senior management or the board, I see no reason to include the issue in the audit report.
We dont keep score with the number of findings in the audit report, so why include low
risk items in what we send to executive management and the board? I see no need.
Some issues and agreed action items need to be shared with senior management but
dont merit the attention of executive management or the audit committee. I like to
include these in a separate memo to management; I might make reference to this in the
audit report, saying something like Additional issues, not meriting the attention of
executive management, have been shared in a separate memo to operating management.
My focus is always on providing each stakeholder with the information they need to run
the business, when they need it, in a clear and easy-to-consume fashion.
In todays environment, I am always looking for ways to use new technology to make
internal audit communications more effective. One option is to find a way to integrate
information about audit results into the dashboards and other information that
management uses to run the business.
If they are getting key performance (and possibly risk) metrics on their tablets, why
cant they also see whenever they want it the condition of risks and controls as
reflected by our latest audit assessments? Why cant they see whether corrective actions
are being made on a timely basis and which may be late?
One technique I have used, and I know a few others have as well, is to issue audit
alerts when we find an issue in one area of the business that might affect others. For
example, if we find a defect in a report used by one location when we perform an audit
there, we might share that information (without blaming anybody) with other locations
that use that same report. There are a number of ways to do this. My team issued an
email to those who needed to know; others might share the information using internal
social media networks.
There is one more topic to cover in this chapter: the difference between communicating
the results from an assurance engagement and after a consulting or advisory engagement.
The primary customers for an assurance engagement are the board or audit committee,
followed closely by executive and operating management. But the customers for a
consulting or advisory engagement are in management.
Unless there is a risk or control issue that merits the attention of the board or individuals
senior to my customer, I will find the best way to communicate the results to my
customer (which might be in a formal audit report, a less formal memo, or an informal
but documented meeting) and limit distribution to my customer. I might inform executive
management and the board that I have performed a consulting engagement, but usually
they dont need to be informed of the detailed results.
At Tosco, the company embarked on a major initiative to implement the Oracle financial
systems. With the full support of the audit committee and top management, I put my most
senior people on the long project (it would last a few months). In addition to Lorie
Reynolds and Tom Wisniewski, whom I knew I could rely on for quality work, I also
assigned auditors such as Roger Herd who could bring an in-depth understanding of the
business.
I remember calling a meeting to make sure everybody understood my thinking on the
role they should play. I explained that while they should not make management
decisions, they should do whatever it took short of that to help management understand
potential risks and gaps in controls, and suggest how controls might be implemented
(before the system went live) to address those risks.
I asked them what they would consider a successful internal audit engagement on this
project. Their replies were all about providing key information to the project team,
identifying potential problems and helping management resolve them.
I put a different spin on what constitutes success.
I told them that if the project failed, whether from poor project management, inadequate
user involvement, poor security or controls, or any other reason, I would not be able to
call our involvement a success.
We would only call our involvement a success if the project itself was successful.
The team looked at me as if I was mad. I can still see their faces in my memory. But I
held to my guns and told them that would be how I would evaluate them individually
and as a team.
Fortunately, the team trusted me and adopted my approach. Also fortunately, the project
was successful and both I and senior company management recognized the team for
their contributions.
A few years later, Toscos Circle K convenience store division embarked on a high risk
(in my opinion) systems conversion. The company owned about 6,000 stores across the
United States and did not believe its current systems would be able to continue to
support the business.
The IT department worked with management of store operations and related
departments in a disciplined process to identify their needs and select a solution they
believed offered the best long-term capabilities.
When the project was given the go-ahead from executive management, together with a
budget in excess of a million dollars for hardware, software, and consultants from
Accenture, I again assigned some of my best people. Three IT audit managers (Tim Cox,
Bruce Taylor, and Will Helton) were joined by an experienced audit manager (Jennifer
Busch) with a business and financial focus.
They soon came to my office with shell-shock in their faces.
They asked me whether I knew what solutions the project team had selected. I didnt, so
they told me.
The company was going to replace all the systems in the individual convenience stores.
These ran the sales registers, maintained inventory and other records, and once or more
each day uploaded information to the central system in our Phoenix data center. Both the
hardware and the software were going to be replaced.
The software was designed for and used only by clothing boutiques in shopping malls. It
had never been used in convenience stores.
It was going to run on hardware that it had never run on, and which also had never been
used in a convenience store business.
There was no evidence, at least not to my teams satisfaction, that the hardware and
software would work well together and be able to handle the volume in a typical
convenience store.
As if this was not enough, the central system that collected data from the stores, was
used by our Store Accounting staff to run reports analyzing the business, and then fed the
financial and other enterprise applications, was also being replaced. This time, the
software was one that had been used in a convenience store business but the hardware
on which it was going to run had not and the software had never run on that hardware.
The central system had never worked with the new store systems, of course.
As you can imagine, the audit team was very concerned. They believed, with every
justification, that this was a project with a high risk of failure. Such a failure could have
a massive effect on our business, effectively closing down our stores if things went
badly.
I gave them my speech about their success being intertwined with the success of the
project, and this was an opportunity to be of huge value to the company. They probably
muttered to themselves about their mad manager, but they left determined and resolute.
During the course of the project, I was able to hire a highly technical IT auditor, Alan
Proctor. This was fortunate as the project team had decided they needed to upgrade the
security side of the central system. Alan not only provided technical insights they could
use on the alternatives (he knew them, they didnt) but was also able to steer them in the
right direction to avoid some of the potential security loopholes.
As the go-live date neared, my team asked to meet with me and discuss the situation.
Tim and Bruce spoke for the team when they said that there was a high risk that
something would crash. It wasnt just a matter of controls and security. The size and
scope of the entire system, when you consider the number of stores, the volume of
transactions, and the fact that everything was new and the pieces had never been used in
combination, was very complex.
The project team had not been able to test everything working together with anything
like the volume of transactions that could be anticipated upon go-live.
Tim an Bruce believed that management should be informed that going live without
additional testing in an environment more consistent with go-live conditions (i.e., with
more realistic volumes) was high risk in their view, unacceptably high risk.
I encouraged them to share this at the upcoming project steering committee meeting,
when the CFO and CIO would be present. After they left, I made sure that the CFO and
CIO knew that we had an important message to share and that the team would have
sufficient time on the agenda.
I didnt attend the meeting myself (I trusted my team and had other matters to attend to),
but my team did well. They informed me that top management had listened carefully;
they had asked questions of the project team who had confirmed the facts upon which
Tim, Bruce, and the others had based their assessment.
However, they considered not only the risk and cost of going forward with the
implementation without delay, but the risk and cost of a postponement while they
performed additional testing. Apparently, it would take some extended period of time
for them to design a test environment with similar volumes as the live environment. In
addition, they would have to extend any delay until after the year-end close which
would result in the loss of key consultants from Accenture.
The CFO and CIO decided to take the risk and forge ahead.
My team were downcast. However, we talked about what we could do to reduce the
risk of a devastating crash and/or mitigate any damage.
They decided that they could identify the areas where the system was most likely to
crash.
Brilliant! To this day, I am proud of this imaginative solution.
The team met with senior IT and project management to discuss which areas were most
at risk. IT and users put people in place to monitor each of these high risk areas, with
instructions on what to do should they fail.
As it happened, the new system failed in several areas all of which had been
predicted by the team! The prompt actions by the people watching these areas mitigated
the damage to the extent that it was barely noticeable.
The overall project manager came into my office to tell me how grateful he was to
everybody on the team, and to me for making them not only available but willing to do
whatever they could to help the project succeed.
He was followed by the CIO. He told me that he would never again implement a major
new system without first obtaining an assessment and advice from my team of IT
auditors.
Auditing forward also means auditing the risks that impact today and tomorrow, not
limiting your focus to what has happened in the past.
Is there value in somebody telling you that the road in front of the house you lived in last
year is being repaired? You only want to know about road conditions where you are
likely to drive now or in the future.
In the same way, internal audit needs to provide assurance and consulting advice on the
risks of today and tomorrow. Telling management what has been a problem in the past
has some limited value, but only to the extent that those conditions continue to exist and
similar problems may continue into the future.
Wayne Gretzkys father advised him to skate where the puck's going, not where it's
been.
Internal auditors need to take this advice to heart and audit where the risk is going to be,
not where it has been.
That requires:
1. Being sufficiently agile to change the internal audit plan as risks and
business conditions change; and,
2. Knowing that risks and business conditions are changing.
I have previously discussed my approach to audit planning, which I believe gives me
the required agility.
Knowing that risks and business conditions are changing is achieved by meeting with all
the key business leaders frequently and listening to what they have to say about the
business, our competitors, changes in regulations, what is happening with customers and
I believe a world-class internal audit function not only audits forward and helps the
organization avoid issues, but is focused on enabling the organization to take corrective
actions when they are required.
One of the first IT audits that Lorie did for me at Tosco was of the contingency plans for
the Northern California data center. Her budget was 100 hours and I checked in with her
to see how she was doing after a couple of weeks. She shook her head in reply and
sighed, not very well, Norman. I am going to need at least another couple of weeks
before I can finish the audit and give you a report to close. I asked her why and she
explained that she had found so many problems that it would take her that long just to
make sure she had them all, could review them with the local CIO, and agree on
corrective action.
My reply was that I thought she had finished the audit.
Lorie looked at me in shock. I explained that from what she was telling me, she had
already completed her assessment: the contingency plan was inadequate and major work
was needed. She agreed with the assessment but repeated that she needed the extra
hours to write the report, define the actions necessary, and obtain management
responses.
I told her No. You can finish the audit by writing the audit report with just one finding:
the contingency plan needs to be fixed. But I will give you an extra month to work with
the CIO on a consulting engagement, helping him figure our precisely how to make that
fix.
Lorie took that idea to the CIO who loved it, as did senior management.
Our focus on working with management to effect change, rather than writing an audit
report and getting management responses, was warmly welcomed and the plan was
updated promptly. Not only that, but Lorie was able to help them implement a process to
maintain the plan so that it remained current.
When internal audit is effective, you get a positive answer to the question Does
internal audit help you identify the need for change and improvement in the business,
and then to get those changes made?
the same office, he is based in our US office and I am based in the Singapore
office, this does not impose any problem if I need to contact him. He will
reply to all our emails almost immediately regardless of time and this makes
me wonder if he ever sleeps. If I have to relive my life again, I would like to
work with Norman again from the start of my career so that I can get a good
head start in my career development under his mentorship.
What I love about this, apart from the memories of working with this fine lady, is that
she recognizes that I am always trying to make her (and everybody else) think. If I
always give my answer to a question from one of my team, how can I expect them to
learn to think for themselves? They almost always have the answer within them; I just
have to help them see it for themselves. That remains my objective when I write, blog,
and speak. It doesnt matter whether everybody agrees with me, as long as I make them
think!
Cary Morgan ran the Sarbanes-Oxley compliance program for me at Business Objects.
He later stepped up to run the internal controls program for SAP (including SOX but his
responsibilities included internal controls for all objectives, not only external financial
reporting) after they bought Business Objects. He saw me as his teacher and mentor:
You provided me the opportunity to learn. You allowed me to grow in areas
of responsibility and held me accountable for my actions. When correction
was needed you asked questions that lead me to the proper solution rather than
dictating the answer. You encouraged me to contribute to the team and allowed
me to be recognized for my achievements without overshadowing with your
presence.
Example: When I first met you I was operating under the mindset of PCAOB
Auditing Standard No. 2 catch everything in a tight net and then weed out
what you didnt need. You quickly saw the financial benefits to Business
Objects of early adoption of PCAOB Auditing Standard No. 5 (AS 5) and
evangelized the top down, risk-based approach. You taught us (we were
pretty much all a new team back then) the mantra of Is this control precise
enough to detect or prevent a material error? If not, is it needed? Does it need
to be refined?
We didnt need any external training or coaching on AS 5. You were the
trainer. Training sessions were question and answer sessions. You taught me
how to think and ask reasonable questions to arrive at a logical conclusion.
We had only known each other for a month or so and I was still a contractor
when you put me in charge of coordinating the worldwide SOX 404 process
for Business Objects. No doubt that was a bit of a leap of faith on your part,
but I appreciated you allowing me to contribute to not only the team, but to
Business Objects even though I was still an outsider at the time.
I am proud of Cary. Senior SAP management was sufficiently impressed by his SOX
and leadership abilities that they moved him to Germany to run both the SOX and
internal controls programs for the company.
Ivy Yeo, who was an audit manager in Singapore with Rosnah, also comments on my
ability as a teacher:
You are the best teacher in my life! You just know when is the time to give
me a straight answer to my question (for questions which are beyond my
ability to solve). You know just when is the time to answer my question with
another question to stretch my ability to think further and discover the answers
on my own. My life is never quite the same after working for you. You
continued to help me out after I left Maxtor. You remained the best teacher in
my life :)
I like to think that I hire the best, mentor them as needed, and then get out of their way.
I insist that everybody learns to think for themselves. For example, I find that the people
I hire straight out of public accounting (even those in the internal audit services side of
the accounting firm) have been trained not to think. They have been trained to follow the
directions of their manager and in the audit program, and not to exercise any
independent thinking of their own. One of my first tasks with these people is to teach
them to question everything and use their intelligence, intellect, curiosity, and
imagination as tools for success.
A leader is someone who is followed. Lorie Reynolds, who worked for me at Tosco,
Maxtor (as a consultant), and then Business Objects focused on that and how I always
asked her to stretch herself:
I have had the pleasure of working for Norman Marks for 11 of the 24 years
that I have known him. During this time, Normans relentless pursuit of making
himself the best leader put him in front of the crowd. I know that there are
those of us that have worked for him that would work for him again anytime
and anywhere and some of us have shown that.
Throughout the years, I have had many bosses and only two of those were true
leaders. Norman was one of them. Theres a clear difference between being a
boss and a leader. A leader is a motivation for others and inspires individuals
to aim high and attain that aim. However a boss only supervises his
subordinates. Norman has high expectations from the people that work for
him. For instance, he knew my capabilities better than I knew myself; he
challenged me beyond my comfort level and then pushed me to my maximum
potential.
I mentioned Tim Cox back in Chapter 29. This is what he shared:
It was my pleasure to work with you, even for the few years that I was at
Tosco prior to the acquisition. The thing that always stands out in my mind
was your placement of trust in those you hired. You provide full support, even
in the toughest of times. I remember when the new inventory control system
(name escapes me) was going on. While the company had hired a big-name
consulting firm to play a big role in the project, they did not have the expertise
nor drive to be as efficient and effective in collecting and documenting our
business requirements. The requirements were written so loosely that they
could be easily misinterpreted and that turned out to be one of the downfalls of
the project. I remember how much you supported our project audit team, and
how you would learn all that you could, never doubting us, so that you too
could relay a consistent message to senior management. I have not seen nor
felt such management support before or since that time. That is why, when
Tosco was sold, it was truly heart-breaking to me to have to leave that
environment. I still look back with fond memories of those days.
Tim doesnt give himself enough credit. He was a leader on the project he mentions and
which I described in Chapter 29. He was not only trusted by me and the rest of the team,
but by IT and the project team. Why? Because he was straightforward at all times,
dedicated to the success of the organization, and performed brilliantly.
In other words, he was easy to trust.
Katie Vo worked with me at Maxtor and then at Business Objects. She had some kinds
words to share about trust and loyalty.
Trust We all know that Norman is confident (not arrogant) and intelligent.
Trust is not about only confidence or intelligence, but more about being fair
and honest to the people that he associates with. He is always fair to his
employees and I have never seen him demonstrate favoritism to anyone. He is
honest and direct to the point. Sugarcoating is non-existent in his vocabulary.
When I first met Norman, I was intimidated by his intelligence. My fear was
would this man make me feel stupid every day? As a matter of fact, I wasnt
sure if he would even hire someone like me. However, that is just the surface.
The real Norman is more than just confident and intelligent. He is a good
person all around. He does not come to work with a personal agenda. Modern
day business leaders tend to put their own interests ahead of the organization.
Hes a firm believer that you are hired to do what is best for the Company and
he will give you the tools to ensure that you are successful. This is the tone that
he has set and communicated with this to his team from the very beginning. A
character trait that truly defines Norman is that he generously gives trust to
everyone. From the projects he assigns to his team to the decisions they have to
make on a daily basis, Norman always trusts that his team will do what is right
and in the best interest for the Company. The relationship that Norman has
built with his team is founded on trust and communications.
Loyalty Norman is exception at building great teams. He knows how to put
When I hired Teo Han Kheng as an audit manager in Singapore with Maxtor, she was
only in her twenties. But she had the presence and attitude of a natural leader. I am
proud of what she has to say:
What makes a good leader? Norman comes to mind - being able to motivate
team members to excel and perform at their best, feel taken care of for their
development and welfare, and most importantly, constantly thinking and
learning. A good leader need not have no faults, but should still garner
everyone's respect despite not being perfect.
Thats a great note on which to leave this chapter.
there was another opportunity for me where I could be of value to the firm and at the
same time advance my career.
The partner lost his composure. He told me that I was an ingrate. They had made me a
senior manager, even though I was not that great an auditor. If I didnt like the position, I
should resign.
I was shocked but kept my own composure. I thanked him for his time and left.
After I settled down, I went to see the partner I had met in New York. He was as
shocked as I at the senior partners reaction. He was quick to calm me and assure me
that I was very highly rated within the firm (later, I found out that I had been earmarked
as having the potential to move up to partner). He suggested I give him some time and
not make any precipitative move, such as resigning.
I waited several weeks and then decided to ask the senior partner to meet me for lunch. I
was pleased when he agreed.
But he surprised me at lunch by accusing me and the US firm of underhand behavior. He
said that he knew that I had already accepted a position in the New York office and
refused to listen to my denials.
Shortly thereafter, I called Stan (the US partner in charge of the computer audit practice)
to warn him. He told me that should I need to leave the UK firm I should call him but
not before then, otherwise people would accept the accusations as true.
A few weeks later, I saw the senior partner from a distance. My blood boiled just
looking at him. I knew he was there to stay, so I had to leave.
After I resigned, I received a letter from the partner in charge of the UK firms HR
function. He told me that he was very disappointed in my lack of loyalty to the firm,
demonstrated by accepting an offer from the US firm before I returned to the UK.
I replied without much hope. I recognized that the poison spread by the senior partner
would stick. Why he did it, I dont know.
Fortunately, Stan kept his word and I was able to join the Los Angeles office as the
manager in charge of their computer audit team.
But I inherited another difficult set of individuals there!
I worked with some great people at Coopers & Lybrand in their Los Angeles office. But
the culture was not positive. I understand that what I encountered was localized and
doesnt persist today, but in those days many of the partners and all the managers
working to become partners were highly political.
What we might call dirty tricks were not uncommon. One aspiring senior manager
told me that he joined every committee he could and claimed ownership of every
achievement by that group, even if he had nothing to do with it. He cozied up (there are
less pleasant phrases) to every partner so he could get their vote, making sure they knew
how great he was even if he never worked with them.
A partner told me that I should always try to sell services to a customer (internal or
external) even when I knew they didnt need those services.
My group manager told partners I was stealing work from another manager, when the
truth was that he had decided (against my recommendation) to give the assignment to me
because the client liked me. That group manager said this to discredit me because he
thought I was a threat to him and his prospects.
Clearly there was no way I was going to change this environment. It was also clear to
me that I didnt belong.
My personal belief structure, my ethics, prevent me from being anything other than
honest and straightforward.
With the support of my family, for which I am grateful, I left a position where the
leadership of the firm had assured me I would make partner.
There are some people that are so difficult to work with that it is necessary to leave.
But there were also situations where I was able to change a difficult situation and make
progress.
While I was at Coopers & Lybrand, I took a course on dealing with difficult people. I
would recommend this to anybody and feel that I learned a great deal from the
instructor.
For example, I learned to let an angry person talk, while I listened actively and
attentively, until they had said everything they needed to say. I would prompt them with
questions to ensure they had said everything and were not holding anything back. It is
important to everybody to be heard, and that alone can calm people down. David
Augsburger said Being heard is so close to being loved that for the average person they
Over the years I have worked effectively with people that I dislike, including some that
I did not think were ethical, competent, or able to think logically. But, I worked hard not
to let them know how I felt.
For example, when I joined one company (which I will not name, for obvious reasons),
I knew the executive that I would be reporting to. I had worked within his organization,
although not directly for him, for several years and knew that he could be a bully. But, I
needed the job and apart from him the opportunity was excellent a fine company and
an interesting position.
I set myself a two-part goal. The first part was never to let him know that while I
respected his intellect and experience, I didnt like him as a human being. The second
part was that I wanted him to both like me and respect me for my work.
Unfortunately, I didnt work for him for long (both of our positions were outsourced).
But at the end I knew that I had succeeded; he recommended to the CFO that he find a
position for me within his team.
One executive for whom I had great respect, as a professional and a human being, was
Dave Wagner at Home Savings. I had only had periodic and limited conversations with
him (including the incident described in chapter 17) when I was the leader of the IT
audit function and he ran all the banks application development and maintenance teams.
had already decided to take. My audit report would encourage executive management to
support his plans.
Dave and I had a great relationship after that. After I had moved out of internal audit and
into IT, I had the opportunity to work for him an opportunity to realize how fine an
individual he was.
As an aside, when I was on his team, Dave had weekly meetings with his direct reports
(of which I was one). He would dole out assignments and they always seemed to come
to me. One week, I told him that I had a lot on my plate and perhaps somebody else
would appreciate the opportunity he had just handed me (I used that word with a
smile). Dave smiled back and told me I should feel complimented by his giving me so
many opportunities.
Be professional, patient, listen, and show respect. These are the primary techniques I
use when dealing with difficult people.
It helps enormously to recognize that difficult people usually have a reason for being
difficult.
Sometimes, it is because they have something to hide. That is the normal reaction of
internal auditors when they feel their customer is withholding information or access,
avoiding them, and so on.
But more often there is a valid reason at least in the eyes of the problem manager.
For example, when I was at Solectron management of our Malaysia operations was
more than just difficult to work with. They were nigh on impossible to work with!
that we would find world-class ideas and practices that we could ensure were shared
with our other facilities.
When I met with the corporate Executive Vice President responsible for procurement
and logistics, he was not only highly supportive of the audit but keen to show us what
we would now call an entity-level monitoring control. His team used analytics to chart
actual prices obtained for raw materials, by product and facility, against the prices he
had agreed with our primary vendors in global contracts.
Figure 6: Monitoring of material prices
Figure 6 is representative of what he showed me. He had charts like this for every
global contract, with similar results.
My reaction was that it supported my impressions of the effectiveness of the operations
teams in different parts of the world: US operations were not obtaining the best price,
Europe was doing better, and Penang was world class.
But the EVP blew me away when he said his problem was with Penang!
He tolerated the US and Europe results, saying he could explain their variances away
due to premiums for delivery and so on. (I thought the explanations weak.)
But he said that Penang was ignoring the global contracts he and his corporate team had
negotiated. Instead they were driving hard and aggressive deals with local dealers and
subsidiaries (for exactly the same materials), and this was putting his global contracts at
risk.
I told him I understood and we would consider that in our audit.
But, I knew that our margins were tiny and a small difference in the price we obtained
for key materials could make the difference between profit and loss. I expected to find
practices in Penang that the others should adopt, not practices we should stop them from
doing.
With his concurrence, I decided that our audit would include visits to four locations:
Charlotte (probably the best run US operation); Bordeaux (probably the best in Europe;
Penang; and Suzhou, China (rapidly becoming our largest operation).
I put together a dream team of auditors: Audrey Lee (Asia Pacific director), Shelley
Hobbs (Americas director), and Mike Wilmouth (my expert in procurement and
contracts auditing). Their schedule was to visit Penang first, to see how our best
procurement team worked, then go to Suzhou, Bordeaux, and finish with Charlotte.
We went through the normal processes of sharing with each site our audit plans and
schedule. As normal, Penang was difficult to deal with (slow to respond) but we settled
on a date for the audit to start.
I was at home watching TV with my family when I received a call. It was Shelley,
telling me that Penang was not permitting them to do the audit!
Audrey and Mike confirmed that when they arrived at the main office in Penang, they
were not allowed beyond the lobby. They were told by the financial controller that
because management had not agreed to the audit, it could not proceed. After arguments,
they were permitted to enter and use a conference room. But neither the facility general
manager nor the vice president in charge of procurement would meet or even talk to
them by phone.
I tried calling but was not able to reach any of the executives in Asia, so I sent the
regional president and the Penang management head urgent emails and told the team to
do what they could. I would talk to the corporate executives in the morning (US west
coast time).
In the morning, I talked to the corporate executive vice president for procurement. He
was astonished and tried calling Penang, but his vice president wouldnt take his calls
either! He sent emails and left voice messages without any response.
Eventually, the cooler heads in regional management prevailed and instructed Penang to
cooperate. They did and we were able to complete the audit as planned.
The only comments we included in the final audit report relating to Penang were, as we
had anticipated, complimentary.
We did not take issue with their working hard to get better prices, as we all felt the
corporate team in the US had not negotiated effectively and it was more important to
focus on upgrading those efforts than blaming Penang procurement for doing what was,
overall, best for the company.
I dont know for sure whether this very rough patch helped or hindered our relationship
with Penang. But I have to think that the fact that we never lost our cool, always acted
professionally, and didnt try to get the Penang management team disciplined, helped
our cause.
A year or so later, we had an amusing incident on an audit where the tide finally turned.
Wendy Ng led the audit, which included a look at segregation of duties in the accounts
payable area. Although she was a financial rather than an IT auditor, she found that one
supervisor not only had access to enter and approve purchase orders, but could process
receipts and approve payments. Not a good situation!
At my request, Wendy and the team checked and were able to confirm by inspecting
transaction records that the supervisor had not exercised any of the additional
capabilities. She had never accepted a receipt nor had she approved a payment both
of which were outside her job responsibilities.
Wendy met with the manager in IT responsible for the application systems involved. For
a few days, the manager tried to persuade Wendy that she was wrong and that the
supervisor did not have the rights in question. It took a call from me to the CIO for Asia
Pacific before IT confirmed the facts and acknowledged that Wendy was correct.
The IT manager told Wendy that although the supervisor had the rights, they had an
effective control in place.
What was that control?
We dont tell people that they have any additional capabilities. We only tell
them what they need to know.
She wouldnt change her position, so it fell to me again to talk to the CIO for Asia
Pacific.
In the end, we were able to come to an agreement. The weakness existed; it had not been
utilized to commit a fraud; Penang did not have an effective control in place; and,
management did not have an easy solution.
The application in question was software that had been acquired from a small Asian
vendor and was no longer supported. It would be difficult and, in ITs estimation,
expensive to change the way that the software worked so they could limit individuals to
the access they needed for their responsibilities.
We agreed that our report would identify the weakness and that management would
respond that they believed the cost of corrective action would exceed the level of risk.
We would leave the decision to corporate management and, if necessary, the audit
committee of the board as to whether they would accept Penang managements response.
I came out to Penang for the closing meeting, ably led by Wendy. The IT issue was
covered with no problem, but there were other issues that the team had identified. These
were significant from an operational point of view; management agreed with the facts
and told us they would respond with their planned corrective actions shortly.
As I was walking out of the conference room after the meeting, I turned around to
congratulate Wendy for her controlled, composed leadership. Before I could say much
though, I heard my name called behind me.
I turned around to see the Penang controller and CIO. They asked for a moment with
Wendy and me. Then came words I would never have believed I would hear:
Norman, we dont think we can solve our problems alone. Can you have
Wendy come and work with us so we can fix everything?
In the end, our ability to effect constructive change, with business-practical assessments
and recommendations, allied with our professional manner, brought Penang around.
When I left Solectron, I was pleasantly surprised to receive invitations to connect on
LinkedIn from two of the key members of the Penang management team: the senior
executive for the region and the CIO.
When there are problems with culture, such as when multiple frauds surface and those
involved claim that they believed they were expected to find a way to make the
numbers, the CAE has to stand tall.
Giving the audit committee the bad news that there is an issue with the organizations
culture is hard. The CAE knows that unless he is very careful (and lucky), this can be a
career limiting move if not the end of his time with the company.
It is easy to say that the CAE reports to the audit committee and not to management. But
when the CEO and/or the CFO wants the CAE fired, which can happen when the CAE
reports bad news, the CAE has to be brave. (I believe we should adopt Sara Bareilles
song, Brave, as internal audits professional anthem.)
Most CAEs who bring bad news and run afoul of the CEO or CFO leave their company
within the next nine months.
When I had my moment in the spotlight and told the audit committee that there was a
culture issue they needed to know, I took the steps I thought critical but missed one. The
result was not a good one.
The team had uncovered accounting frauds, primarily in the US but also in Asia. In the
US, general managers and their controllers had inflated their earnings, generally using
concocted journal entries. (We found this at multiple sites, but there was no evidence
either that managers of one site conspired with another, or even that they knew what the
other was doing.)
The managers did this so that they could achieve their financial targets; if they failed to
do so, they believed there was a high risk their site would be closed down.
In Asia, for a number of years financial management had used cookie jar accounting to
manipulate earnings (they put profits in a reserve or provision account when times were
good and withdrew them when needed to improve profits).
Their motivation was different than in the US: they were highly profitable, but wanted to
inflate their earnings to make up for shortfalls in other parts of the world.
Unfortunately, all of the financial managers involved said they felt encouraged to make
the number by the finance leadership in corporate.
There was absolutely no evidence that any of the corporate finance leaders ever
encouraged them to make their numbers through inappropriate accounting.
Certainly there was pressure to perform and achieve targets, but we didnt find anything
to indicate that corporate told site managers to do what they did.
At the same time, it was clear (at least to me) that corporate finance had not done
enough to stress the importance of financial integrity and responsibility to finance
professionals across the organization.
The audit committee knew about the investigations and the frauds. I had included that
information in my regular reports, and when necessary had conversations between audit
committee meetings with the chairman of the committee.
Fortunately, none of the frauds had been individually or in aggregate material to the
financial results of the company as a whole. However, I believed the audit committee
needed to know the root cause of the frauds a culture that seemed to encourage
making the numbers without stressing the need to do so through performance rather
than fiction.
I knew that this was not going to be an easy task for me.
It was complicated because I didnt report with a solid line to the audit committee.
After I joined the company, a new CFO arrived and changed my direct reporting line
from the audit committee to him (without objection from the board). While he allowed
me full access to the committee, I knew he was not happy with my independent spirit.
My first step was to talk to other CAEs I respected and to people at the IIA. They were
supportive but only confirmed what I already knew: I had an obligation to tell the audit
committee, it was not going to be easy, and this was the kind of situation where the CAE
may be shot as the messenger of unwelcome news.
So I sat down with the CFO. He listened attentively and did not argue when I said I felt
obligated to report to the audit committee.
Without him asking, I volunteered that I would tell the audit committee that I had no
reason to believe that anybody in corporate finance, including him, had deliberately
created this environment. But, I felt that the appropriate action would be for him to issue
a message that reinforced the expectation that everybody involved in finance take
ownership for the integrity of the numbers they reported.
He agreed that I would start the briefing to the committee. He would then add his
comments, confirming that to the best of his knowledge nobody in corporate finance had
encouraged or even known about the inappropriate accounting, and that he would
communicate his expectations as I had suggested.
I said that we needed to inform the CEO so he wouldnt be surprised by my report to the
audit committee (he generally attended the meetings). I asked that the two of us meet
with the CEO and brief him.
To my surprise and dismay, the CEO not only said he would take care of the CEO but
forbade me (with a severe look) from talking to the CEO.
I told the CFO I would talk to the chair of the audit committee, to which he agreed.
My conversation with the chair of the audit committee went very well.
He listened and asked the right questions. He agreed with the plan that I speak and then
the CFO add a few words.
He said that he would comment as well, confirming his agreement that the recommended
communication by the CFO should be sufficient at this point and that the audit committee
should support my continuing focus on the integrity of financial reporting at these and
similar locations.
I asked the chair if I should have separate conversations with the other two members of
the audit committee. He said it was not necessary. They were both strong supporters of
mine and he said he would find a way to talk to them informally and in person ahead of
the meeting. (The audit committee normally met on the second or third day of board
meetings.)
On the day of the meeting, the CFO and I were alone in the board room for a few
minutes. He asked me if I was ready and I said I was.
I thought I was as I knew all of the audit committee members appreciated my work, had
always been exceptionally friendly, and both in meetings and in one-on-one
conversations had demonstrated their trust in me. After all, I had been working with
audit committees for about a dozen years by then.
I started my presentation by reminding the audit committee that we had found a number
of accounting frauds. None were material, but we were concerned about why there had
been so many in the last year. I explained that I interviewed each of the responsible
finance controllers to see if I could understand what had motivated them.
I told the audit committee that the common thread was a message from corporate finance
(not always the same person) that they needed to make their number.
None of the controllers said they had been told to make up the numbers, but they all
felt the pressure. I talked about the COSO Control Environment component and the idea
of tone at the top.
I said that I had spoken to the individuals in corporate finance whom the controllers had
been talking to, but there was no indication that they had wanted the financial controllers
to do more than work with site management to improve the results for the quarter, for
example by offering additional discounts to accelerate sales.
No sooner had I said that there was no evidence that the CFO or any of his direct
reports either knew about the frauds or were any way involved than one of the audit
committee members started yelling. He was yelling at me.
The yelling director had been my most ardent supporter. For example, he had asked me
to attend the IT committee meetings, which he chaired, because (he told me) he valued
highly my insights and advice.
Now he was yelling at me. He challenged my saying that I had no reason to believe
anybody in corporate was involved. He screamed, with a face to match, that he didnt
believe me; I was hiding something from him and the other committee members.
I admit it: I was in shock.
My face was as white as his was red.
I repeated that I had no reason to believe corporate was involved. I was not hiding
anything. I was not colluding with the CFO or anybody else.
I looked around for support.
The CFO was sitting back in his chair. Quiet. Calm. Not coming to my support and
looking as if he was not even thinking of it. He looked neither surprised nor
disappointed.
The audit committee chairman was leaning forward, looking worried. He didnt say
anything for what seemed like an eternity.
When he spoke, it was to calm the board member down rather than voice support for
me. The third board member added his voice of reason.
Eventually, the presentation and the audit committee meeting were over.
But not before I had lost my trust in the CFO, much of my credibility with the screaming
board member, and some of my confidence that the audit committee chairman would
support me when management did not even when he agreed with what I was doing and
saying.
By the way, the external auditors were present and they also knew what I was going to
report. They didnt say anything in the meeting, but I didnt expect them to and dont
blame them for their silence.
I survived but the CFO felt little to no pressure to say anything about integrity in
accounting.
I left the company within the year and was happy to do so!
If I were to do this all over again, I would have taken one more important step.
There was nothing I could do about my reporting relationship. For whatever reason, the
audit committee had not stood up to the CFO and insisted that I report directly to them. I
could also not have done anything about the refusal of the CFO to let me brief the CEO.
But what I should have done is brief each of the audit committee members, preferably
with the audit committee chairman on the call, before the meeting.
If I had done that, I would have found out what the chairman told me when I called him
after the meeting.
The irate director had been on the board of another company where there had been
financial statement fraud and the CFO had been involved. When I started talking about
making the numbers, all he could think of was what had happened at his last company.
He knew that I reported to the CFO and was afraid that had influenced me.
It didnt make sense. I would not have even raised the issue if I had been colluding with
the CFO, but he was not thinking rationally.
I should have ensured that each of the committee members, the CEO and CFO, and the
audit partners not only knew what I was going to say, but had asked all their questions
and voiced their concerns before the meeting. If they had been briefed in a less formal
setting, with nobody watching how they reacted, the audit committee meeting itself
would have been a smoothly orchestrated and successful event.
As you can imagine, those few minutes when I was confronted by a screaming friend (or
so I had thought of him until that moment, when he became a screaming fiend) will live
with me forever.
An epitaph is suitable. Within a few years of my leaving, the company admitted failure
and allowed itself to be acquired by its strongest competitor. Its culture problems went
beyond financial reporting; internal division and infighting among the executives led to
the loss of customers and revenue, an inability to rationalize operations, and the death of
the company.
were under a time and material contract. The vendor was to bill us at agreed labor rates
for each category of employee; different rates were established for different levels of
experience, from master to trainee.
However, Bill found that the vendor was billing everybody at master rates!
He met with the owner of the company and asked him about this. The vendor said that
the billings were correct! Bill asked how that could be. He had looked at the
employees backgrounds and while some clearly merited the master title, some had no
related experience. They were trainees and should have been billed at that rate, at least
for the first year.
Bill estimated the overcharges at around $600,000 (a lot of money in 1991).
The vendor stuck to his grounds. He asserted that he was the person who determined
whether an individual was a master or a trainee and he had decided they were all
masters. Nothing in the contract prevented him doing that.
Bill and I met with management, who were understandably shocked. Although the
manager in charge of refinery maintenance was concerned that we not damage relations
with the vendor, his manager pressed him to negotiate aggressively.
We not only obtained a full refund, but the vendor changed his practices (we continued
dealing with him as his firm was the best available option in our area) and Bill proved
his immense value to the corporation.
In the first year, Bills work delivered an ROI of about 1000%. In other words, as a
result of his audits, management was able to negotiate and recover overcharges that
were about 10 times what the audits cost.
Management was keen for me to expand the contracts auditing function. I was able to
hire an outstanding, experienced and talented leader for the new function in Connie
Chapman. Over the years, with her leadership, we built the team up to about 28 people
(as many as I had in the traditional internal audit side) and they consistently had an ROI
of between 10 and 12 times cost.
One year, Connie and her team audited the largest vendor of our marketing business
(Tosco Marketing Company, or TMC , headquartered in Phoenix, Arizona).
Management and the vendor settled the negotiation of the overcharges we reported with
a combination of a credit to our account of about $6 million and a reduction in charges
going forward.
Later that year, I attended the TMC executive off-site meeting. The purpose was to
review the nearly-completed year and agree on plans for the upcoming year.
The TMC CFO led the opening session with a review of the financial results for the
almost-completed year. The first slide was a summary of actual vs. budget.
Somebody noticed that the CFO had a line item, below the pre-tax profit line, with
audit results. When asked, he said that this represented the contribution of my
contracts audit team. He had put it below the line because it distorted the financial
results for the year.
We then spent about an hour talking about whether the CFO should project similar
savings in the new year.
On the East Coast, we had a similarly strong contracts audit team, led by Matt Melone.
Not only did Matt bring experience, insight, and results, but he initiated a maturing of
our contracts audit work.
With his leadership, we moved from after-the-fact recovery of vendor overcharges and
identification of poor contracting that led to costs exceeding our intention, to a more
proactive approach.
Matt established such a positive relationship with management of our East Coast
operations that they asked him to consult on contract structure.
One of our problems was that when we audited a contract, we found not only
overcharges but loopholes that the vendor had exploited. Frequently, we were only able
to negotiate the recovery of a portion of the overcharges and help management fix the
contract going forward and we had lost the time value of the funds involved.
Matt started performing pre-audits before a contract was negotiated. (This was also
being done on the West Coast, but I think Matt perfected the idea.) He was able to help
refinery management negotiate better contracts, not only more favorable in terms of
pricing but also minimizing vendor overcharges.
The President of our Refining Company, Dwight Wiggins, loved the work we did. He
commented to me that when he toured a refinery during a turnaround he looked for the
white hats worn by my auditors. I asked him whether he liked to see that because he
could see we were on site and working with the vendors.
No, Norman. I like to see the white hats because I know the contractors can
see them and know they are being watched! Its a great deterrent against
fraud.
The contracts audit team represented about half of my team at Tosco. But, I had two
other groups that were not performing traditional audits.
The first is one that is often within the internal audit remit: investigations.
Until Tosco acquired the Circle K convenience store business, investigations were
handled by a combination of HR (for suspected violation of HR-related policies the
most common occurrence); Environment, Health, and Safety (for issues related to their
compliance responsibilities); Security (for routine theft and damage to property); and,
internal audit. Now that we had a convenience store business, we needed a team of
specialists to investigate suspected fraud and so on.
Over the years, I had not only received training in fraud investigations, but had
performed a few investigations myself. I knew that should the investigation be
performed ineptly, a risk to the organization far greater than any loss might be created.
In addition to the principles I discussed in Chapter 25, experience has shown me that:
1. Investigations should only be performed by individuals who have been
sufficiently trained and experienced. When I formed a team at Tosco, one of the
requirements was that the investigators hold a Certified Fraud Examiner (CFE)
credential and had demonstrated, to my satisfaction, their abilities by
performing investigations under the direct supervision of a CFE
2. The determination of whether a fraud has been committed is a legal
responsibility. The investigator reports the facts, an attorney determines
whether there has been a violation of the code of conduct and/or law, and
management determines any disciplinary action
3. Although evidence will often build during an investigation that points to the
guilt of an individual or group, investigators should not allow themselves to
start to believe in that guilt until all the evidence is in. Very often, the suspect
is not interviewed until late in the investigation so there is always a possibility
I could write many pages about all the frauds that we uncovered, but I will share just
one, my favorite.
Marty Patton was auditing a small subsidiary and found a curious journal entry. If I
recall correctly, the journal entry consisted of a debit to the bonus accrual (or similar)
and a credit to revenue. It was a very strange entry. He was looking at the piece of
paper it was written on when he noticed some writing on the back. It was a calculation:
Target
Projected Actual
Difference
x
(y)
z
Years later, at Business Objects, management asked that I start a group to audit our
customers compliance with the licensing terms of our contracts.
Like many if not most software companies, we had a lot of revenue leakage as
companies extended their use of our software beyond what was permitted by the
license. Under the charismatic leadership of Steve Wozniak (not the Apple co-founder),
the license compliance team brought in millions in additional revenue to the company.
There was one other group that I picked up at Tosco.
The head of IT operations (Bill) asked to meet with me and asked me to do him a favor.
Bill told me that consultants had advised him to start a Quality Assurance group. It was
charged with ensuring all new applications and changes to existing applications were
developed according to company policy and properly tested. I thought that was a great
idea, one I knew my IT audit group supported.
Apparently, the consultants had suggested that IT outsource the function to them, as it
was one of their areas of excellence. Bob had tried that but was very unhappy with the
results, so he hired a QA manager and brought it all in-house. Now he had decided that
managing QA from within IT wasnt going to work either.
Could I take on QA in addition to Internal Audit? He said that I had a reputation for
excellence as a manager and leader (flattery will get you everywhere) and thought that I
would be successful taking QA where it needed to go.
I asked him about whether I could consider QA as an independent function (of IT
management) and he agreed that would be a key to its success. I realized that there
would be some level of synergy with the IA audit team, so I agreed to take it on and Bill
transferred the budget and staff.
There were only two people in QA. Each was outstanding, so it didnt take much for me
to help them stay on track. In fact, the toughest part of managing QA was helping them
establish and then maintain a constructive working relationship with IT.
Apparently, the positive relationship and reputation that people like Tim Cox, Bruce
Taylor, Will Helton, Don Villa, and Alan Proctor (my IT audit team) had with IT
management and staff was the key to get QA past the problems of their past.
I took on QA for these reasons:
1. It would not impair either my independence and objectivity as CAE
2. It would not impair my ability to provide the assurance and advisory services
that I considered essential
3. It was the right thing to do for the company as a whole
4. The audit committee gave their formal approval, based on it all of the above
I am always open to taking on other responsibilities when I can satisfy those four
requirements.
Over the years, I also stepped up at management request to take on the responsibilities
of being the Chief Compliance Officer (including Ethics) and Chief Risk Officer.
Rick Teubner was an audit manager of this ilk in my Northern California team (led by
Roger Herd) at Tosco. This is what he has to say:
You demonstrated to Executive Management that IA is adding value in excess
of costs, which ensures the function is well-funded. Even though we were in
an environment where budgets were highly scrutinized, we had the resources
to do our work properly and budgets didnt negatively impacted employee
retention or morale. An effective leader supports the team with appropriate
resources.
Your audit team had the appropriate level of expertise and knowledge to
execute their audits. Some IA functions are tempted to primarily hire junior
staff, following the model used by most CPA firms; however, its difficult for
inexperienced auditors to work effectively with auditees. An effective leader
doesnt expect the groups being audited to train the audit team.
Having geographically based audit teams, with you traveling to the locations
regularly, ensured that each location had a continual audit presence. When
auditors travel to outlying locations periodically, rather than having a home
base in the region, some parts of the organization wont get the attention that
they need and the audit presence is limited. An effective leader views all
operations as being within their sphere of influence, regardless of distance to
the location or travel preferences.
Your audit plans are based on the appropriate risks to the organization, based
on industry knowledge and feedback from the operational leaders. Its easy to
develop an audit plan that attempts to cover everything end-to-end, but these
plans ultimately result in limited coverage as auditors scramble to touch on
each area of operations without providing in-depth coverage of any risks. An
effective leader addresses the important risks with the appropriate level of
coverage and doesnt waste time on immaterial activities.
Your audit results are presented in a manner that helps an organization
improve their business, rather than the zero-sum game that many audit
organizations fall into of auditors attempting to make themselves look good by
making someone else look bad. When an audit function becomes adversarial,
audits become more difficult to execute and all recommendations are dead on
arrival, which reinforces why you put effort into having a good relationships
with your auditees. An effective leader doesnt have to rely on making others
look bad in order to show the value that they add to the organization.
You encourage auditors to be concerned about their image, and to avoid the
typical stereotypes that give many auditors a bad reputation. Simply put, its
hard to be effective if people dont enjoy working with the audit team. An
effective leader creates a brand image for their audit department and
reinforces the need to create the right impression.
I have presented several times around the world on the topic of My ideal internal audit
department. Here are its 18 attributes:
1. Praised by the audit committee and top management because they help them
sleep at night.
As I mentioned earlier, I believe the primary mission for internal audit is to provide the
audit committee and top management with the assurance they need as they direct and
manage the organization.
They need to know not only that value is protected, but that the enterprise has the
people, processes, systems, and organization (including controls) to seize opportunities.
They need to know that the organization will be able to execute on strategies and plans
and achieve or exceed its objectives.
This means that the internal audit team must focus on the risks that matter to the
organization, including the risks that are emerging and will be important to future
success.
It also means that the CAE must communicate assurance, not just provide traditional
audit reports with a list of findings.
There should be a formal report to the audit committee and top management with an
opinion on the adequacy of the organizations ability to manage the more significant
risks to its objectives at acceptable levels.
Those risks can exceed acceptable levels due to failures in business processes; the
identification, assessment, evaluation, and management of risk; and in governance. All
of these should be considered and addressed as appropriate in the audit plan which is
updated dynamically as risks change.
The ISO 31000:2009 global risk management standard has a number of principles. One
of which is that effective risk management is dynamic, iterative, and responsive to
change.
Internal audit should likewise have a plan that is dynamic, iterative, and responsive to
change.
2. A cool place to work.
How do you get the most out of people? Let them feel enriched, valued, and able to
make a difference.
Theres a reason that Silicon Valley firms let their people play while they are working
because when people enjoy their work they are innovative, imaginative, and deliver
results.
There is no reason that internal auditors cant enjoy their work and obtain both personal
The audit programs from the last audit of the area at the same company were from a time
when the risks were probably different, the staff and even the processes may have
changed. While they can be useful reminders of things to consider, every audit program
should be considered a new task.
Mike Wilmouth worked for me first, as a Contracts Audit Manager, first at Tosco and
then at Solectron. This is what he has to say:
I was on one of my first contract audit assignments and approached Norman
to determine if a standard audit template existed by which to cover specified
basic elements to ensure quality expectations were met. Normans response
was that no such template existed except in my mind and it was up to my
imagination and experience to make the determination as to the project scope.
Norman has promoted in my life and career an out of the box approach to
analyzing any life situation no matter whether in a personal or professional
setting.
The norms of any of our professions are continuously being challenged by
out of the box thinkers that are both personally and professionally rewarded
in ways that the normal aspects of our jobs will never offer.
When assessing what look like deficiencies in controls or risk management, auditors
need to think. Does this really represent a risk that is at an unacceptable level for the
organization? How can it best be brought within acceptable levels, given cost and
resource constraints? What is the root cause? What would I do if I owned the business?
Paper after paper talk about the new software and technologies available to improve the
professional practice of internal auditing.
In my opinion, the most underutilized tools and the ones most likely to bring immense
value are:
The auditors ears: so they can listen to what people have to say
The auditors eyes: so they can not only see issues and their indicators (such as
a messy warehouse) but pick up the 80% of communication that is non-verbal,
and
The space in between: so they can think about what they hear and see. They can
make accurate assessments and make valuable suggestions for improvement
5. Where people are set free to choose an audit approach that stimulates and
develops, as well as getting to the heart of the problem tackling the root
issues head on.
There are more than a hundred ways to perform an audit. I know, I once put together a
mind map (Figure 7, below) that attempts to capture at least some of them. If I were to
update the mind map, I could probably add quite a few more with all the new
technology and other ideas available.
Figure 7: Audit Choices
I like to agree with the auditor who leads the project on its scope and end-product
(typically assurance on one or more risk areas). Then I let the auditor determine how
they will perform the audit.
They might opt for one of the techniques included in the mind map, or they might come
up with something that is new to me. Perhaps they have seen a novel use of technology
and I am always keen to hear about such innovations.
For example, my friend Mark Gosling (currently CAE at NetApp, but at that time CAE
of Verisign) told me about an interesting use of gamification software.
A simulated stock exchange is set up and the only stock is the project you want to
monitor. It might be an IT implementation or any other initiative. Everybody involved in
the project, including the project manager and his team, the business users, other
affected departments, and consultants can participate by buying or selling shares in the
project. When there is general optimism that the project will succeed, people will want
to buy and the price goes up. When prospects dim, the price falls. By monitoring
changes in the price of the stock, auditors can monitor the true feelings of those involved
and whether they believe the project will succeed or not. If and when it drops, auditors
can interview participants to find out whether issues have been identified but not
was forced to get the job done with people who not only didnt have a CPA but may not
have gone to college. This put an immense burden on him, because he had to insert
himself into every activity. He was overloaded, tired, and mistakes will happen.
My team told me this and I asked them what they thought about the staff this manager had
working for him. Were they as inept as he said?
Absolutely not, they insisted. Although they didnt have the CPA certification, they had
many years of experience in this type of accounting and a deep understanding of the
business deeper than the manager!
I had known this manager for several years and knew he was bright, immensely hardworking and dedicated, and considered a top performer by senior management.
My team went back and asked a few more questions. The staff told them that they didnt
believe the manager trusted them. He gave them tasks but never explained why he
wanted something done. So they never really knew whether what they had done was
right. The manager kept all information about the business and its activities to himself;
they did the best they could, but morale was low and they were all looking for other
jobs.
The manager confirmed what they had said. He didnt trust them beyond performing
tasks to his detailed instructions. He kept all decisions to himself because he was the
only CPA, the only one qualified and trained to make the decisions.
This was tough. It was clear to me that the manager was the problem. He was an
abysmal leader and wasted the talents of his staff. He either had to change or go.
I met with the CFO and then the CEO of the business unit. They decided to let the
manager go.
He had been somebody I considered a friend, somebody I respected. But he had been
promoted beyond his management capabilities.
A new manager was appointed and soon the accounting group was back on an even keel.
The audit report we issued after the audit was completed didnt detail what we found.
That was addressed directly in meetings with management and the audit committee. I
find that is usually the best way to communicate sensitive issues.
When we limit our communication of audit results to the formal audit report, we limit
ourselves. In this case, the audit report included a comment that I would discuss the
matter further with senior management and the audit committee. But what I had to say to
them was entirely in person, verbal, and not written down.
There are times when special skills or insights are needed that internal audit does not
possess. But many of the projects given to the consulting arms of the accounting firms
might have been given to internal audit at a fraction of the cost and probably with
better results.
There are also times when internal audit doesnt have the bandwidth to take on
additional projects without impairing its responsibilities to provide assurance on the
risks that matter.
Yet, a sign of a world-class internal audit department is that the CAEs phone is always
ringing.
I once had a period when my IT audit team in Phoenix was turning over at annualized
rate of 400%!
I was not worried about it. I was proud of it!
No sooner had I hired a new IT audit team member (they were all at manager level or
better) and exposed them to management than IT offered them jobs. Soon the entire IT
security team was managed and staffed by people I had hired for internal audit, led by
Dick Leonard and Richard Busch.
I am proud that so many of my team has gone on to executive positions (including as
CAE). While some CAEs prohibit anybody leaving to join a business unit until they
have served two years. I dont take that position. When the company as a whole and the
employee both benefit from the move, I will support it.
However, I frown on the idea that people are hired for their potential after they leave
internal audit. I also dont like the idea of a rotation of people through internal audit
who are not competent to perform quality audit work. I am totally opposed to making a
top performer CAE for a period (e.g., out of marketing or finance) when he or she is
unlikely to provide the leadership necessary to make internal audit world-class.
When people are motivated by their career outside internal audit, they are at best
conflicted and at worst unable to be objective.
8. At the exit interview, the manager says (sincerely) thank you.
Customer surveys paint a picture, but it is questionable how real and reliable that
picture is.
When an audit identifies a lot of issues, the survey is unlikely to be glowing. When a
survey comes back glowing, it could simply be because the audit found little and so
caused minimal trouble for management.
I believe the best feedback from an audit is what you hear from your customers (both
operational and senior management, and the audit committee) and what you see in their
eyes when they provide feedback in person. We all know how to distinguish honest
from false notes of appreciation.
The way that management works with the internal auditor prior to, during, and following
the close meeting speaks volumes.
Even more is said when, as CAE, I meet with management at all levels and ask if we
are adding value to their organization. I dont want to hear that we are OK, as that
usually means they are putting up with us rather than seeing us as adding value. I prefer
to hear that our audit at least confirmed, through our opinion, that everything is working
the way they want. Even better is when they say that our insights will help them
improve.
Better yet are comments (which I have received and mentioned earlier):
You havent done an audit I wouldnt gladly pay for
I wont go forward with an major systems implementation ever again without
first obtaining the insights from your IT audit team
Can you help us figure out how we can make the necessary changes?
Can I hire your auditor?
Are we really adding value if our customer doesnt say, with appreciation, that we are
helping them and the organization succeed? Its to be treasured when they say that when
you are not present.
9. Fully leverages the organizations risk management processes (automated
processes, by the way).
If the organizations risk management processes are sufficiently mature, internal audit
should place as much reliance as possible on their identification, assessment,
evaluation, and monitoring of risks. Internal audit should adapt the enterprise risk
reporting rather than seek to duplicate it.
For example, Andrew MacLeod is the CAE at the Brisbane City Council in Australia.
He works closely with his organizations risk management team.
When it is time to update his audit plan, Andrew takes the enterprise assessment for
each risk and modifies it based on a number of factors, such as the number and level of
issues found in the prior audit; whether there has been significant change in people,
processes, or systems; and so on. These factors represent the level of confidence he has
that the controls management relies upon to manage that risk are operating effectively as
designed. The end product is an audit-adjusted risk universe on which he will base his
audit plan.
Before internal audit can place reliance on the enterprise risk management program, it
has to audit it. I think the IIA has done a good job providing guidance in its Practice
Guide: Reliance by Internal Audit on Other Assurance Providers.
If the risk management program is not sufficiently mature, the CAE must ensure that the
audit committee and top management understand the facts and what they mean.
For most organizations, the greatest risk is that they dont know what the risks are! They
make decisions, set strategy, and monitor performance without appropriate
consideration of risk and uncertainty, and without taking the actions necessary and
appropriate to optimize results.
In these situations, internal audit should become an evangelist for risk management. It
should help management at all levels understand what they are missing and how to
address it. It should also work with the risk management team as both their cheerleader
and mentor, as appropriate.
I do not believe that internal audit should assume responsibility for risk assessment and
taking actions to manage risk. These remain a management responsibility. Internal audit
can lead the risk management function as long as management retains ownership and
responsibility for risk assessment and decisions about what risks to take, how to manage
them, and so on. I like the IIAs Position Paper: The Role of Internal Auditing in
Enterprise-wide Risk Management.
10. Fully leverages advanced continuous monitoring and auditing capabilities as
part of a risk-based audit program.
While internal audit can be world-class without relying heavily technology tools, my
ideal internal audit department will:
Provide every auditor not only with a laptop, but with a tablet
Enable every auditor to use analytics, including mobile analytics, to obtain the
information necessary to be effective in understanding the business and its
trends, automated testing, and monitoring risks
Always be looking at how technology can make internal audit more effective
and more efficient. It is not sufficient to understand enough about technology to
be afraid of it (which is where most internal auditors are, as they focus on
downside risk instead of upside value). Internal auditors must always be
looking for ways to leverage technology for advantage
Leverage the technology and systems that the organization and its management
use to run the business. I dont understand why internal auditors have to
implement their own reporting tools when management already has something in
place that can be used, perhaps with a little tweaking
Share what it finds with management
Be willing to take chances to explore the potential for doing things different
I talked earlier about the use of gamification. Another new concept that might be useful
is crowdsourcing.
One company was having difficulty with employees buying in to its code of conduct
policy. There were complaints that it was onerous, not business-practical, and didnt
always make sense. So they put a draft update to the policy out for comment and
suggestion by every employee. They made it clear that they wanted employees to suggest
new wording, changes to policy, and so on. The employees responded with many
comments and great ideas. The final document was embraced by the organization.
I can see how internal audit could share a risk and ask for ideas on how best to address
it.
When it comes to new ideas, it is important to be open and receptive to any source.
Managers with 20 years of experience dont have the insight into how new technologies
like Pinterest could help internal audit. But a new intern might, even if they are not in
internal audit.
11. Where the CAE sends a message to the CEO asking to chat, and the CEO
comes to the CAE's office.
This happened to me at Maxtor. About 18 months after I joined, the CEO was replaced
and the former chairman of the board, C.S. Park, took over. He was a very experienced
former CEO who had led a larger company in the same business.
By then, I had built something of a reputation and C.S. had interviewed me when the
board was debating whether the CEO was effective.
Even so, I was not prepared for the way in which C.S. (very soon after he became CEO)
responded when I sent him an email asking for a few minutes to discuss a situation and
get his input. Within five minutes, he was knocking at my door.
When internal audit is world-class, management is quick to make itself available every
time the CAE calls.
First of all, the CAE has to know to ask for management time only when it is necessary,
not just to chat about the weather. That way, calls from the CAE (and his direct reports)
are known to be important to the manager.
Then the CAE has to make good use of his time with the executives. They are all
immensely busy and their time is a scarce resource that needs to be respected by
internal audit.
So say what needs to be said, confirm understanding, and leave.
I once gave a presentation at a risk management association conference. Afterwards, the
president of the association asked to sit with me over lunch as he had a problem he
thought I could help with.
He told me that while he reported directly to the CEO, he always found it difficult to get
time with him. When he was able to arrange a meeting, the CEO seem to lack interest in
what he was saying and was reluctant to act on his recommendations.
As this gentleman was speaking, I realized the problem. I didnt want to listen to him
either, because he was boring! He spoke in a monotone without any passion in his
voice, and used technical rather than business language.
If I didnt want to listen to him over lunch, how could I expect a busy CEO to want to
listen?
When management doesnt find time to talk to you, or starts looking out the window as
you are speaking, its not a management problem. You are most likely the problem!
We need to talk in the language of the business about things that matter to the business,
and make sure the individual we are talking to understands how they affect him.
We especially need to listen. People love people who listen to them, so try not to cut
them off. Very often when managers talk and talk, they are talking about things we need
to know issues in running the business; risks we need to be aware of.
Management will open their calendars, minds, and ears to you when you constantly
demonstrate that there is value for them in doing so.
12. Expanding into new and cool stuff, even if not traditional audit areas, such as:
Process improvement
Six Sigma/Lean
Audits of risk management and governance processes
At Solectron, the company decided that Lean Six Sigma would help drive down
operating costs and increase both efficiency and quality. This was so important that it
hired its new COO because he had a proven record of success with Lean Six Sigma as a
GE executive.
They succeeded. Inventory was reduced while at the same time making the flow of
materials to production faster and more efficient.
I attended Lean training myself. While I was never going to be a black belt, it at least
gave me a basic understanding of the fundamentals. I sent each of my senior managers to
training so they could not only talk the new language of the business, but use the
techniques for operational auditing and so on.
By the way, Lean has now extended from its roots in Toyota Lean Manufacturing to Lean
Finance.
Internal audit can use the concepts of Lean to ensure it is focused on quality product that
is valued by its customers, eliminating every activity that does not add value as seen by
its customers. I discuss this in my world-class auditing training. Much of what we spend
time on, from time reporting to audit working papers, to audit report content that
stakeholders dont need to hear, is waste muda in the (Japanese) language of waste.
There are many risk areas where internal audit has rarely dared to go. Topics that we
are only now starting to consider include risk management and governance processes.
I am not going to spend a lot of time on either that would be another book of its own.
But let me just say this:
- Effective risk management lets management and the board make far more
intelligent decisions and have more confidence in running the business and
taking risk, and improves both short and longer-term performance. How can
we look ourselves in the mirror when we fail to tell the audit committee and
top management that they are driving the company towards objectives without
any visibility into the road ahead, its dangers and opportunities?
- A failure in governance (and this extends way beyond the code of conduct)
can be enormously detrimental to organizational success Lord Smith of Kelvin
chaired the UKs Smith Committee on Corporate Governance that provided
guidance to audit committees. He told the IIA International Conference in
Kuala Lumpur that the fish rots from the head down. Should we not inform
the audit committee when the executive team is fighting with the CEO or among
themselves, or when we see that the CFO does not have the confidence of his
team and peers?
13. Where internal auditing is seen by management as a competitive advantage.
In Chapter 22, I told the story about how Dwight Wiggins told the Governor of the state
of New Jersey that internal audit gave Tosco a competitive advantage.
Why is this not a common occurrence?
If internal audit adds value to the organization, and world-class internal audit teams add
far more than others, shouldnt the organization therefore have a competitive advantage.
I believe this to be the case although it is not often recognized either by the CAE or his
customers.
Why cant the CAE shoot for the moon, where the value of internal audit (which
includes all the informal consulting and advice it offers) is so great that it is seen as an
advantage in the market?
Risk management functions are sometimes held out that way. It is time for internal audit
to join them in the limelight.
14. Where the CAE is never satisfied.
OK, you and your team have been recognized as adding huge value and being worldclass.
Do you stop there, confident and happy in your success?
No. What is world-class for your organization today may be insufficient for tomorrow.
The CAE should have a thirst for change and growth. Learn not only from other internal
audit leaders and what they do well. Learn from leaders of other organizations entirely,
like Marketing and Sales.
I like to read magazines like Fast Company because they profile innovative and
creative thinkers in all walks of life. Maybe what works for them could, with some
tailoring, work for me. At least it might stimulate me to think about something I had
never thought about before. It might stimulate me to challenge what had worked for me
in the past.
Innovative leaders think outside the box. They create something that excels and they
love it. They love it so much it becomes a box for them and limits their ability to
discard it in favor of something new.
We should not only think out of the box, but stay out of the box, and kick it as soon as
somebody builds one.
Acknowledgments
The number of people that have influenced my professional growth, both those for
whom I worked and those who were on my team, is huge. I have tried to create a list,
but know that I have forgotten many names. I hope they will forgive the omission.
Alan Marcum
Alan Proctor
Ann Tritsch
Audrey Lee
Beate Morrow
Ben Washington
Benjamin Chiang
Bill Baker
Bob Broderick
Bob Di Giorgio
Bob Lavinia
Brian Jenkins
Bridget Timberlake
Bruce Taylor
Cary Morgan
Charles Luellen
Charlie Clegg
Cheng Sim Meng
Chester Lin
Chris Lowe
Christine Toh
Clarence Frame
Clive Malcolm
Connie Chapman
CS Park
Dan Griedl
Daryl Graham
Dave Kovarik
Dave Peterschmidt
Dave Wagner
David Clark
Debra Davies
Derek James
Diana Marks
Dick Leonard
Don Hayes
Don Villa
Duston Williams
Dwight Wiggins
Ed Hajim
Frank Jastrob
Frederic Cordel
Gary Campanella
Gary Canady
George Hermann
Gerry Ziolkowski
Ginger Doherty
Glenn Davis
Gordon Dow
Graeme Hopgood
Greg Myers
Hazel Lau
Heinz Fridrich
Houston Flournoy
Ian Brown
Ivy Yeo
James Fanshawe
Jan-Jan Wu Gross
Jarlath O'Neil-Dunne
Jay Allen
Jean-Francois Heitz
Jeff Mullis
Jennifer Busch
Jeremy Hacking
Jim Cleary
Jim Tolonen
Joe Ingrassia
Joe Johnson
Joe Tang
Joe Throckmorton
John Schwarz
Joyce Lang
Judy Kershaw
Julio Leung
Kathleen Mack
Kathryn Munro
Kathy Sanborn
Katie Vo
Keith Budge
Ken Ebbage
Kevin Gilbert
Kiren Patel
Kurt Lauk
Larry Geiger
Laura (Morton) Nathlich
LeRoy Larson
Loretta Forti-Corson
Lorie Reynolds
Lynn Bruneau
Mario Antoci
Mario Palencia
Mark Aurelius
Marshall Johnson
Marty Patton
Marty Ziomek
Mary Ann De Leon
Mary Anne Marks
Mary Beth Pastore
Mary Reis
Matt Melone
Michael Tennenbaum
Michal Brooding
Mike Guadagno
Mike Jacobs
Mike Ketchum
Mike Passaretti
Mike Wilmouth
Mollie Bickerstaff
Nancy Bush
Norman Miller
Norman Stratton
Osamu Yamada
Patrick Sheehan
Paul Low
Peter Schlesiona
Peter Scott
Phil Burbach
Phil Cotton
Randy Saylor
Richard Busch
Rich Schmidt
Rick Allen
Rick Klaus
Rick Teubner
Rod Perry
Roger Herd
Ron Reed
Rosnah Ismail
Salman Qayyum
Shelly Hobbs
Sofia Goh
Soo Wai Mun
Stanley Halper
Steve Costa
Steve Johnson
Steve Wozniak
Suzanne Pesko
Tabitha Gallo
Tan Wee Liat
Tan Yee Lin
Teo Han Kheng
Tim Cox
Tom Farrell
Tom Wisniewski
Tony Gooey
Valerie Uyeda
Vic Pacheco
Wai Lim
Warren Androus
Warren Ligan
Wayne Budd
Wes Scott
Will Helton
A proud moment: I receive the IIAs 2004 Thurston Award from IIA chairman Bob
McDonald for the best article published that year in the Internal Auditor magazine. I
was fortunate to receive the same award ten years later in 2014.