Report Spotlights the Underbelly of ‘Audit Politics’

Try not to faint when you hear this, but—corporate political pressure on chief audit executives to alter their audit plans or results is “extensive and pervasive,” according to a new report from the Institute of Internal Auditors.

Based on the IIA’s latest research—which included survey results, personal interviews, and focus group discussions among some 500 chief audit executives—more than half of audit executives said they have experienced pressure to omit or modify an audit finding during their careers; nearly 20 percent said it has happened more than three times. Almost half said they were directed, usually by someone in executive management, not to audit a high-risk area. Nearly one-third said they were directed to audit a low-risk area so that an executive could investigate or retaliate against someone.

“We were really surprised by the extent of pressure,” says Larry Rittenberg, co-author of the research report and past chairman of COSO, the Committee of Sponsoring Organizations. “We found political pressure came from all parts of the organization. We really could not sort out just one individual function where most of the pressure came from.”

“We found political pressure came from all parts of the organization. We really could not sort out just one individual function where most of the pressure came from.”
Larry Rittenberg, Former Chairman, Committee of Sponsoring Organizations; Report Co-Author

Rittenberg and his co-author Patty Miller, formerly with Deloitte, say in their report that they spoke with audit executives who told harrowing stories of job loss and physical threats in the most extreme cases. “CAEs with impeccable service records in both the private and public sector lost their jobs or were encouraged to take other positions or early retirement for challenging management on political issues,” they wrote. But pressure could be much more subtle too, they said, such as staffing or budget cuts, or transfers to lower-level positions within the company.

Warren Stippich, GRC leader for Grant Thornton, has witnessed plenty of political pressure on the internal audit function, he says. “The statistics did not surprise me,” he says. “I’m glad to see they undertook this research. It’s something that probably needs a little light shed upon it. We all know there’s political pressure. It’s a bit like the unspoken elephant in the room.”

In Stippich’s view, no company is immune to the problems that stem from office politics. “Chief audit executives can’t be so naive as to say they will work for an organization that has no politics,” he says. “That’s not possible. The chief audit executive has to learn to be politically savvy. If he or she carries on too much about politics, they will perhaps be viewed as being too weak or politically immature.”

Stephen Shelton, a chief audit executive at a Fortune 500 company, says he’s never been inappropriately asked to add or subtract something from an audit report. “Where it does happen, it probably doesn’t come out of the blue,” he says. “It would be representative of an environment that wasn’t very strong from a governance perspective.”

RESEARCH FINDINGS

Below the IIA provides research findings about the extent of political pressure in internal auditing.
1. Political pressure on CAEs is extensive and pervasive.
As noted earlier, more than half of our survey participants (55%) had been subjected to pressure to omit or modify a finding; the vast majority (71%) noted the pressure was due to a concern that the report would reflect badly on key operating management. Further, almost half (49%) were directed to not audit a high-risk area, usually by an executive in the organization (80% of responders said the request was from executive management). CAEs with impeccable service records in both the private and public sector lost their jobs or were encouraged to take other positions or early retirement for challenging management on political issues.
2. Political pressure comes in many forms.
Some political pressure is not very subtle, e.g., physical threats (yes, personal threats were described in our interviews) or loss of jobs. But pressure can be more subtle, e.g., loss of staff, decrease in the internal audit budget, CAE transfer to a lower-level position within the company, or a CAE encouraged to take an early retirement.
3. Good corporate governance is crucial.
It is difficult for internal audit to be better than the underlying organizational culture and governance process. The need for effective corporate oversight (board and audit committees) was emphasized in the Committee of Sponsoring Organizations of the Treadway Commission’s (COSO’s) Internal Control – Integrated Framework in 1992. However, as described to us, some organizations do not have effective audit committees, and many governmental and private organizations do not have audit committees at all—or the ones they have are chaired by the organization’s CEO.
4. Political pressure can be managed and partially mitigated, but it always exists.
Political pressure might be analogous to a latent disease; it exists, but the internal audit strain can be kept dormant by highly effective CAEs. However, it requires a competent CAE, a sound internal audit function, a clear understanding of the business, conclusions based on factual evidence, and respectful relationships with executives and the board.
5. Professional competence is required, but it is not sufficient.
Ineffectual CAEs may be pressured to change findings or suppress reports because of inaccurate or overstated findings. However, we found that a number of effective CAEs and audit teams with a high level of technical competence and professionalism were still subject to political pressure. Internal auditors must understand that there is a difference between genuine disagreements and political pressure. All CAEs, no matter how competent or professional they are, must also be politically astute to anticipate and successfully manage political pressure.
6. Organizations, technology, and organizational objectives change.
CAEs must invest in change, whether the change is in the business environment, technology that allows internal audit to do more with the same resources, or continued investment in skills. Stated differently, the internal audit function cannot rest on “doing what it has always done” and expect to avoid political pressure. Organizations are constantly moving and changing. Internal audit must invest in change, whether it is building a better core staff or making better use of technology to perform audits. Richard Chambers, president and CEO of The IIA, describes the challenge as “Auditing at the Speed of Risk.”
7. Political pressure exists whether the CAE position is career-focused or rotational.
We did not find any empirical evidence that would support a conclusion that one approach or the other is best at mitigating or avoiding political pressure. Academic research has raised questions regarding a rotational CAE. However, through our interviews and observations we noted that many organizations that move to a rotational CAE are doing so because the previous CAE was not necessarily keeping up with organizational change, and that many rotational CAEs are astute at identifying and managing potential conflicts.
Source: IIA.

In Shelton’s view, a fine line exists between political pressure that’s inappropriately directed at the CAE and varying perspectives among stakeholders that have to be managed. “Sometimes what somebody sees as pressure really just represents different points of view,” he says. 

Rittenberg and Miller raise that issue in their research as well, as they say it points to one of the critical skills necessary for a chief audit executive to be successful: navigating the human element of large organizations. Regardless of an auditor’s technical skills and competence, he or she also needs to be politically astute to anticipate and manage the political side of things.

Brian Christensen, executive vice president of internal audit for consulting firm Protiviti, says he’s not sure how extensive or pervasive true political pressure may be, but enduring difficult situations is certainly an everyday part of the job. “They encounter those because when you’re auditing a process and there’s potential for observations that could impact someone’s job or career, those are going to be difficult conversations,” he says.

Where auditors experience pushback, he says, he believes it comes more from the operational leaders whose work is being audited, not necessarily from management or the board. “I’m less convinced it’s at the board level or senior management level given the current environment that everyone operates in with the corporate governance at that level,” he says.

Echoing the sentiment that auditors must be politically savvy to navigate any pressure, Christensen says auditors need “to become outstanding communicators.” That means assuring that senior leadership and operational leaders understand the role of internal audit and how audit gets its work done, and then conveying the results of internal audit work clearly and objectively. “It’s not enough to be fluent in a topic or technically competent,” he says. “The qualitative factors are what will make an auditor successful going forward.”

Michael Cangemi, a business adviser and author with Big 4 and corporate audit experience, says the independent mindset of internal audit is critical to enable auditors to stand up to politically driven demands or pressures. He remembers well his own experience of facing pressure when he assumed the head audit job at a company where the prior head of audit had been persuaded to steer clear of certain operations. “When I set up the internal audit practice, I had to be all about what’s good for business,” he says. “I had to focus on helping try to improve the internal controls and business practices of the company. That was the way I answered everything.”

Gary Sturisky, national consulting leader for McGladrey, says he likes to focus on the relational aspects of the audit leader’s duties. Audit leaders need to be adept at forming relationships with audit stakeholders so they won’t be viewed as the corporate police officers. “The challenge is where do you draw the line between working with the business while still maintaining independence and knowing when to push back?” he says. “It’s got to be a very astute individual to navigate that and find that balance.”

Tom Harper, general auditor for Federal Home Loan Bank of Chicago, says he can’t recall ever facing a senior executive who asked him to overlook an audit finding or steer the audit plan away from a particular area. “Maybe I’ve just been lucky,” he says.

If faced with an inappropriate demand, Harper says, he might begin by having a private conversation with the individual. “If that doesn’t work, I would maybe find suitable people who might be their peers, say general counsel,” he says. Then the discussion would likely elevate to senior executives. “The last resort is to start talking to the audit committee.”