Numbers I don’t have. But we must be with hundreds. Small Internal Audit Functions (IAFs) that truly operate internationally, with only a few employees in a few countries. Which is fun, very diverse and of course hard work. With this blog, I’d like to share some challenges our team faces and I will share our solutions. Please let me know your challenges and solutions!
Challenge 1: Building an international team
A team is as strong as the weakest link, and when you are the only person in a country, this is particularly true. Take our team: we have two employees in The Netherlands, one in Germany and two in China. We are all representing the department and must all be able to communicate with local management with sufficient seniority level. Therefore, we hire only auditors at manager level. All of us need to make an impact as an individual.
This automatically brings in another challenge: already employed junior staff. When I start in a new role as a CAE, I always make very clear that the team is essential, and that if the company wants a strong, modern IAF, all team members should be able to contribute as an individual. In my experience, sometimes existing staff would be a better fit for other departments, like internal control, quality management or finance. So team changes are sometimes needed.
Attracting good auditors is a challenge, because companies that host smaller IAFs usually are midsized companies without a strong, known brand. It is important to search for candidates who like and are capable of: working in a global and truly diverse intercultural team, having lots of wide responsibilities, being with only one or two colleagues on site, and traveling between offices. In my experience, in midsize companies the ability to truly make a lasting change is really present.
Challenge 2: Using the ‘correct’ auditing approach
An IAF with staff in several countries implies that you have to calibrate the different auditing backgrounds of the staff. Some countries have a stronger tradition in educating internal auditors then others, and the local IIA chapters are not equally supportive or present in all countries (IIA The Netherlands is very strong!).
To make cultural differences work in our favor, and leverage from the different experiences in auditing backgrounds, we work with mixed teams of at least two people, in which auditors from different countries work together. Additionally, we have at least one annual in-person team week, where we exchange ideas, work on team building and do team trainings.
In our case, we perform two main types of audits: country audits focused on key risks and general level of control in all business processes executed in that country, and thematic audits that are focused on a specific theme across all countries. Clearly, both audit types have different approaches.
The country audits have a standard scope (all key processes), a standard work plan including standard data analytical checks upfront and a standard audit report with focus on compliance to policies and procedures. Key in these audits is to identify the root causes, so proper improvement plans can be started by management.
The thematic audits however are far more diverse, have tailor made work plans and involve quite often broad surveys and external specialists from co-sourcing partners. These audits could give a certain level of assurance regarding proper functioning of a global process, but more often they give insight to global management how certain topics are managed and dealt with across all countries. An example would be how we treat theft risk of our valuable inventory items in our more than 30 warehouses globally, or, how we treat waste water management in all our 14 production facilities.
Challenge 3: The maturity of the organization
The companies I worked for until now were always very committed on improving their internal governance, structure and processes, because of upcoming listing, delisting, implementation of a new strategy and such. And although the CEO, CFO and Audit Committee usually know what they want, other management and staff were not always experienced with true value-adding modern internal audit functions. They often connected internal audit with financial auditing, external auditors and/or ISO/quality auditors… So, effort was needed to explain that we were not there to check the policies, but that internal audit focuses on the road blocks that might exist on the company’s way to realize the strategic objectives.
To overcome the challenges a small, international Internal Audit Function faces, an internal auditor working in such an environment should:
- like to identify risks rather than checking compliance,
- help local staff and management in navigating between business needs and regulatory necessity of internal control (in the COSO definition),
- understand company politics to get things done, and
- be a coach, so that people can talk to him/her safely, with the knowledge their concerns could be ventilated in a proper way at the proper levels.
Yes, it is a challenge to work at a small, international IAF, but it is also very rewarding. One of my interns once said to me “you know, internal audit is actually quite sexy”. That says it all. Do you agree?
Author: Arjan Man, director Global Internal Audit of Atotech Group (a leading surface-finishing solutions provider, delivering chemistry, equipment, and service to support diverse industrial end-markets) and Board Member of IIA The Netherlands, firstname.lastname@example.org