Mason Duede: "Internal Audit can be a sort of boot camp for training future leaders"

Internal audit: A wealth of knowledge to be discovered

For a large part of your career, you worked in internal controls at a Fortune 100 company, but can you tell us about the very beginnings? Why did you choose internal audit?

Mason Duede: ‘Let me turn the question around: “Why me?” I found it to be a case of “3R”, the right person at the right place at the right time. I’m confident that my profile fit the company's needs for a certain mission. And in any case, I was flattered to have been selected. I was motivated by the opportunity to join an organization with a worldwide span of activity and, throughout my career, I was not disappointed by the variety of challenges and experiences I was afforded, from both a technical and human point of view.

‘I worked in accounting and treasury early in my career. Moving into Internal Audit was a natural step, as it often figures in the finance journey. So, from that standpoint, it was a mutual, rational choice, and one which immediately pleased me.

'Nevertheless, it was only once I undertook my work in internal audit that I began to see the wealth of knowledge to be gained and the professional satisfaction to be derived. I encountered practically every aspect of the business, including the shop floor, which, strangely enough, is sometimes terra incognita for purely finance people. It also made me wonder why internal audit seemed to be reserved to the finance trade. Many other profiles are well-suited to performing audit and, everyone benefits from the experience.

SOX: deep diving into processes

‘As it turned out, another case of “3R” emerged. As an outcome of some serious malfeasance, legislation was passed in the United States imposing minimum standards of internal control for companies listed on American stock exchanges, what we all know of as SOX, the Sarbanes-Oxley act.

'I contributed to rolling out SOX processes for the company's European entities. And that was a challenge that contributed to my professional growth and, also, to improving processes for the company. Many saw SOX initially as a “check the box” exercise, intended to cover the risk of investor lawsuits. The unexpected consequence of this “deep dive” into processes was a better understanding of the inner workings of the company and heightened, as I like to call it, “organizational intelligence”.

‘Deploying the SOX system and coordinating and facilitating the action plans to remediate the issues arising from the testing and certification programs led me into project management. I was trained in 6 Sigma methodology and had the opportunity to lead numerous process improvement and change management projects, most of which were launched because of findings in our internal control and risk management work.

Internal audit boosting organizational intelligence

That concept of 'Organizational intelligence' is rather intriguing. Is it a kind of intelligence the company acquires about itself or something the auditor acquires?

Mason Duede: ‘The idea occurred to me during a discussion in which I was exhorting the importance of a strong internal audit function and process. It’s a concept that originally was coined by some academics. I suspect the expression was already in our zeitgeist. The notion captures how collective knowledge in an organization is cultivated, organized, communicated and used.

‘My personal view roughly coincides with the definition advanced in academic circles. A twist on the concept could be my intuition that the whole of collective intelligence rarely is equal to the sum of its parts. Put another way, the group intelligence of a team of “intelligent” individuals is likely to be lower than the “quantified” sum of their individual brain-power or knowledge. It all depends on how the organization manages to harness and coordinate those individual sets of knowledge and competencies.

‘Organizational intelligence is not the product of Internal Audit, but performing internal audits facilitates and enhances the exercise of “organizational soul-searching”, leaders seeking to understand the inner workings of the enterprise.

'The auditor embarks on this voyage of search and discovery, acquires knowledge and shares it, but, more importantly, assists the teams he or she is researching to discover knowledge about their processes. For decades management gurus have been preaching the importance of transversal knowledge and leadership in business and other organizations, of developing meaningful metrics and ways of assessing performance, yet we often encounter companies in which silo thinking and practice still prevail and where deficiencies and inefficiencies go undetected lacking an adequate level of organizational intelligence.'

The main qualities of a good internal audit department: Trust, Clarity, Independence

According to you, what are the essentials of a good internal audit department, and what are its advantages?

Mason Duede: ‘There are many qualities required to perform internal audit successfully and which characterize a good department. I shall focus on three.

‘A sense of trust: Internal Audit must display the three “C” - Calm, Confidence, Coherence. The Audit team must be guided by an unwavering sense of purpose and a mission to provide assurance to the organization. This requires coherence in word and action; calm, steady execution of audit tasks and confidence in one’s subject matter knowledge and ability to perform. If these elements are not in place, Audit will not gain the trust and committed cooperation of the client and the remainder of the audit process will not be effective.

‘Independence: Whether the Internal Audit process is set up internally or supported by a third-party service provider, auditors must maintain complete independence and objectivity. Management and other stakeholders may not influence or deter the audit process or the auditor’s professional judgment. By no means does this requirement preclude courteous, good-humored cooperation. Nevertheless, it must be clear that open communication and transparency are essential to obtaining the desired outcome of the process, that is, added value by uncovering process deficiencies and discovering areas of improvement.

‘Clarity: This quality could actually be the fourth “C”. By clarity, I refer to clear purpose, organization and communication. The scope of an audit project must be clear and comprehensible to the “auditees”. This allows for efficient and effective process description and analysis, data gathering, assessment and output reporting. The audit work papers must provide clear and comprehensible descriptions of expectations and how work is performed. During interviews, the auditor must demand clarity in communication with stakeholders and process owners. Finally, audit reporting must provide focused, clear results and recommendations for the audit sponsors and committee.'

Not playing the blame game

How do you, from an internal audit role, get the necessary information and/or cooperation from the employees being audited?

Mason Duede: ‘Good question about a soft skill that any successful auditor has to acquire. Often, people seem to perceive Internal Audit as some sort of secret police. And when that is the case, they clam up and await torture. There is this cliché borrowed from the police world that “anything you say can, and will, be used against you”. We would agree that not much of anything constructive can emerge from that kind of situation.

‘The dilemma is found in the tension between that sort of severity and demonstrating that you are not playing the “blame game”. We must obtain solid, meaningful information about processes, and gaining insight quickly and efficiently is critical. Yet it is no use to pretend that it’s no big deal either. The key is building trust and bringing across the message that worse than finding issues and flaws is, in fact, not finding them.

'After all, it is in everyone’s interest to reveal defects and find ways to improve. To quote Ray Dalio: “Understanding what is true is essential for success and being radically transparent about everything, including mistakes and weaknesses, helps create the understanding that leads to improvements”.

'It can be a delicate game, but respect, trust and clarity enable internal auditors and their partners to reach successful outcomes.’

The C-Suite's eyes and ears

How is internal audit relevant to the C-suite?

Mason Duede: ‘Internal Audit can and ought to serve as the C-Suite’s eyes and ears throughout the organization. Yet not in the sense of some sort of spy network or internal “security agency”. Internal Audit’s mandate is established by the company’s audit committee which is charged with governance of the organization’s financial condition, ethical conduct and responsibilities toward stakeholders. Thus, the audit function is independent of the C-suite; which is of utmost importance to the organization’s leaders, who, reasonably, should be interested in obtaining a clear and objective view as to the state of the enterprise’ control system, financial condition, compliance effectiveness and ability to cope with risk.

‘While the relevance of the Internal Audit function is generally admitted, what can be disturbing is that recent studies have shown that executives’ confidence in the value added by internal audit has been declining. This is somewhat paradoxical given the emphasis within the profession on the importance of performing audit efficiently and bringing value through more effective detection of process flaws and pertinent recommendations for improvement.

‘It is in this sense that the profession and the execution of the function within organizations have evolved. I suspect that the expectations of the C-Suite have evolved in the same direction. The bar is placed ever higher and we in the internal audit profession are increasingly challenged to attain higher standards of performance and to increase the value we bring to our clients.

Getting buy-in from management

How do you make sure that your recommendations are acted upon (or are being implemented) if you do not get buy-in from management?

Mason Duede: ‘What is the use of making recommendations if they won’t be acted upon? “Follow-through” is a notion used in different contexts. It is promoted as an effective means of improving one’s chances of success and its application is necessary to address the problem. A tennis coach will emphasize the importance of “following through” on a groundstroke. Yet once you’ve hit the ball, why does it matter where the racket head travels? The answer is that “follow-through” starts well before striking the ball. It all has to do with preparing the stroke, where the shot begins will determine where it ends up.

‘So, I have two pieces of advice to give on this point. First of all, let’s do our maximum to gain that “buy-in”. This draws on the answers to one of the previous questions. By being clear in our process and its deliverables, gaining the trust of our partners in the process and demonstrating our independence and objectivity, we prepare our stroke and maximize our chances that recommendations will be implemented successfully.

‘To be more specific, beyond the clarity and coherence of scoping, the work plan and issue reporting:

1. recommendations must address clearly and succinctly the issues,
2. we partner with management to ensure that the right owners are assigned to resolution,
3. we insist on comprehension, that is, the owners re-express and confirm their understanding of the issues and exactly what actions will resolve them.

‘Second, this effort in terms of partnering will pay dividends during the remediation phase. It is best to plan milestones and target dates and follow-up with both the stakeholders and the action plan owners. Communication has to be consistent, clear and firm. Stakeholders are invited to key milestone meetings, not necessarily each one, but regularly, at milestones that represent critical deliverables. Above all, it must be understood that the stakeholders, those who sponsor the remediation, will attend and hear the story. Naturally, discussions are courteous, even friendly, but you must express the reality of the situation - that recommendations represent a genuine enhancement of value for the enterprise. There is no magic recipe, just preparation and execution, leading to “follow-through”.’

Contributing to the organization's competitive advantage

How can Internal Audit help create a competitive advantage?

Mason Duede: ‘I would start by looking at the condition and prospects of a company lacking a control system and lacking an instrument to validate the soundness of that system. At least in the world as we know it, such a business would be at a profound disadvantage.

‘Internal Audit ought to be, nevertheless, more than a “necessary evil”. When performed with the ambition to facilitate the organization’s path to success, Internal Audit makes a critical contribution to enhancing competitive advantage.

'By ensuring robust compliance, IA supports the company’s reputation and avoids costs linked to regulatory issues. By enabling effective identification and management of risk, IA drives strategic performance. By fostering constant, penetrating review of processes, IA participates in a culture of continuous improvement.'

Can Internal Audit shape corporate strategy? How can it contribute to continuous improvement?

Mason Duede: 'Absolutely. Let’s look first at continuous improvement. This is a well-regarded concept linked to the Lean philosophy of which an important tool is the 6Σ methodology for process improvement. Essentially, projects using such methods are pursuing an audit undertaking.

'Internal Audit, on the whole, is all about the search for ways to improve a process, whether it concerns identifying compliance realignments or areas of strategic improvement. It has occurred to me that many audit work plans resemble a 6Σ project with their emphasis on defining, measuring and analyzing processes.

'As for shaping corporate strategy, while this notion wouldn’t enter into the scope of the audit mission, findings and insight arising from Internal Audit work can have effects on the direction an organization pursues or, at least, indicate a path toward enabling actions, either through the repair of process defects or implementing changes which support the strategy.

'In my view, Internal Audit is a strategic investment for any organization seeking to conform and perform.’

System and data security at the heart of control and compliance issues

Technology is transforming the way we work. What’s the impact for the Internal Audit function? How does it change the approach and the role of auditors?

Mason Duede: ‘Technology is and has transformed our ways of working and internal audit has been affected just as all professions. The effects are seen in two dimensions - what is being audited and how audit is performed.

‘Auditing today is as much about assessing systems as it is about the processes those systems support. Data is omnipresent. Every task, every action creates data. All business processes are measured. Reliance on good metrics is key to business success. So, the Internal Auditor is confronted by and exploits the data generated by business processes. System and data security are at the heart of control and compliance issues.

‘That doesn’t mean that an auditor has to be a data scientist or programmer to study and assess system security and output, but familiarity with general IT controls has become indispensable. In fact, the technological dimension has become so prevalent that Internal Audit often will focus attention on those areas which rely on manual processing as they represent the exception rather than the rule and are considered to be less secure.

‘Secondly, Internal Audit now relies on technology to research, record and analyze data to report the output of audit processes. Techniques such as data and process mining facilitate the task of exploring and analyzing transactions and procedures. This is technology with a small “t” but it would be difficult to perform work efficiently without using the computer and communication tools modern technology affords us.

‘In the final analysis, these are changes to landscape, but the basic principles of auditing are not called into question.’

Future challenges

What do you see as Internal Audit’s biggest challenges for the near future?

Mason Duede: ‘Well, I see four ongoing challenges to the Internal Audit profession.

'Coming to grips with technology, both in the way technology is changing the landscape of business and finding ways to integrate technological innovations into the Internal Audit tool kit.

'Building and sustaining the confidence that business leaders should have in the Internal Audit function. Internal Audit has a unique role in providing insights and constructing organizational intelligence, leaders should be able to leverage those insights with confidence.

'Being a truly “value-added” investment for organizations. Resources devoted to Internal Audit should provide distinct benefits to the organization by detecting both risks and opportunities for growth and profitability.

'Attracting and retaining talented professionals. Internal Audit as a profession is respected and satisfying. However, more needs to be done to attract and develop skilled auditors. The profession competes in this area with other branches of finance and management. We could emphasize the “generalist” aspect of internal audit which allows for diverse and enriching experiences not always found in more specialized domains.'

Internal Audit as the R&D side of consulting

What would you recommend to a young consultant starting in the Internal Audit practice?

Mason Duede: ‘Presently, many young professionals in finance and accounting get their start in external audit, working for public accounting firms, auditing companies’ financial statements. They gain valuable experience, learn the soft skills of working with clients - and then go on to other jobs, sometimes never returning to audit.

‘Internal Audit is sort of the R&D side of consulting. In the pre-Enron days, an auditing firm would study and assess a company’s processes and environment and then turn the task of implementing a transformation and improvements over to its consulting arm. This is no longer an acceptable practice, but the principle is the same. Auditing builds skills and knowledge which are transversal and numerous applications, both direct and indirect, in many other roles. Also, some consulting firms afford the possibility of seeing the business world in an international context, other cultures, languages, approaches to solving problems. So, my recommendation to a young consultant is to pursue the Internal Audit opportunity with an open mind and with the objective of gaining as much knowledge and experience as possible!

How would you leverage your experience in Internal Audit to excel in other finance functions?

Mason Duede: ‘As we know, there are corporations out there which use internal audit as sort of boot camp for training future leaders. That approach might be extreme, but it shows that the value of the internal experience is widely appreciated.

'Every senior finance manager whom I knew at the Fortune 100 company I worked for had done his or her stint in internal audit. Actually, I think that “leveraging” the experience would even be more effective in this day and age given the evolving philosophy of the profession, less doctrinaire than in the past, with perspectives oriented toward discovering the means to enhance performance. As Walt Coffey said: “Don’t look back, we ain’t going that way."'