Many Internal Audit Failures Stem from Misalignment with the Company Strategy

Editor’s Note: This is part one of a six part series on the internal audit value chain, which can act as a blue print for building a successful internal audit function. Click here for the other articles in the series.

We’ve all heard the many clichéd ways to describe when multiple components are aligned in their goals or strategy: “We’re all in this together,” “we’re on the same page,” “we are singing from the same hymnbook,” “we’re operating on the same wavelength,” “we’re in lockstep,” “we’re rowing in the same direction.” And there are plenty more.

The reason there are so many clever ways to say the same thing is that achieving alignment in a common goal is critical to the success of any group endeavor. Even one person marching to the beat of a different drummer can threaten the success of the entire group. This dynamic plays out in all facets of business activity and we’ve seen countless examples of when a person or group causes problems when they have different objectives or are not in alignment with the larger group.

One area where this is all too common is in misalignment between internal audit and the enterprise-wide strategy and line-of business (LOB) priorities. I would argue that it is this misalignment that is at the root of many recent corporate blunders that have resulted in costly and embarrassing public scandals and reputational damage. When internal audit or other assurance functions and business units have different or misaligned approaches to executing the strategy, disaster is often not far behind.

Over a six-part series here on Internal Audit 360° I will walk through what I call the Internal Audit Value Chain. These are six links that when all executed properly and working together can elevate internal audit and provide great value to the organization. They can act as a blueprint for building a successful and robust internal audit function. The first link in the Internal Audit Value Chain (IAVC) is strategic alignment. Future articles will cover the other five links. Keep in mind that these priorities are not static and vary as enterprise-wide objectives and needs evolve.

Together, the six links of the IAVC are:

1. Alignment on strategic direction
2. Risk management and monitoring
3. Operational effectiveness
4. Quality and compliance
5. Financial reporting
6. Responsiveness to customer and regulatory needs

Misalignment Misfortune
The first link in the Internal Audit Value Chain, alignment on strategic direction, is crucial to building a value-oriented internal audit department and requires strong leadership from the top of the organization. On the other hand, strategic misalignment is a recipe for disaster.

Consider Facebook, for example. The social media giant likely ran into problems with the Cambridge Analytica scandal—where a third party improperly gained access to the data of millions of users—due to misalignment between the part of the business that is motivated to maximize revenue with partners and the assurance functions that are charged with protecting the company from violating the trust of customers and members, namely by ensuring that policies and standards designed to provide that protection are in place and upheld.

We can also see this misalignment festering in the problems that Wells Fargo created when employees opened millions of accounts without the permission of customers. The fact that so many Wells Fargo employees were involved in the scandal is a clear sign that their primary incentives, possibly linked to an ill-considered compensation incentive program, didn’t align with the goals of the army of internal and external auditors, regulatory administration, and compliance and risk managers at the large bank that never would have endorsed such a plan.

I define strategic alignment as an in-depth knowledge and application of the organization’s strategic direction, and agreement on its validity, by all the major LOB functions and processes of the organization. A misalignment occurs due to lack of awareness or miss-application in executing the strategy by various departments or LOB’s.

This quote by Sun Tzu, author of the Art of War, captures the difficulty in achieving success without getting what we call in the modern age “buy-in” from all those involved in the endeavor: “Unhappy is the fate of one who tries to win his battles and succeed in his attacks without cultivating the spirit of enterprise; for the result is waste of time and general stagnation.”

Why does strategic misalignment exist and remains unresolved for many public and private sector organizations? What is the actual cost if not resolved over time? The costs can be very high, as we have seen with Facebook, Wells Fargo, and many other examples too numerous to recount here.

Eight Causes of Misalignment
There are eight primary reasons why strategic misalignment occurs and why management and internal auditors fail to resolve those imbalances when they do occur. They include:

1) Lack of awareness: Executive management, board and committees, and internal audit missed the boat. No one within the organization recognized the misalignment between strategy and specific departmental goals. One problem here is that the overall strategic goals may be poorly communicated throughout the organization. What steps should management implement to prevent this from happening? Suggested actions include but are not limited to the following: Evaluating existing policies and procedures, developing adequate metrics and key performance indicators, implementing internal controls, and providing ongoing monitoring and oversight.

2) Management is aware and can’t resolve problem: If management is aware of the misalignment, do they have adequate processes and controls to resolve those disconnects? Remember, adequate processes and controls alone will not sufficiently resolve the problem. Some reasons management may be aware of the problem but can’t fix it include, weak leadership, rogue managers in key positions, poor corporate culture, and bad communication between senior executives and business units or functions.

3) Commitment to resolve misalignment looses out to competing priorities: Let’s assume management has a refined approach to resolve issues. Without the proper emphasis and sensitivity towards resource constraints (capacity), the LOB will simply evaluate requests for corrective actions in the context of other competing priorities. This minimizes the effectiveness of resolving strategic misalignments throughout the organization.

4) Tone at the top (business-as-usual attitude): With the proper tone, the issues articulated in causes #1 to #3 could not have occurred, or will result in minimal impact to the organization. The opposite is true for organizations without an appropriate tone. The business-as-usual attitudes and sub-cultures within LOB segments override enterprise-wide goals, exposing the organization to increased risks and significant losses, including financial and reputational damage.

5) Quantifiable costs of misalignment: Over time, management will identify and probably resolve symptoms from causes #1 to #4, such as missed delivery deadlines, quality and product recalls, increased costs, loss of market share, customer complaints, employee turn-over, lack of innovation, and other problems. Whatever losses that can be quantified at this stage are minimal when compared with the compliance and regulatory issues alongside sustained reputation damage.

6) Risks implication (unable to identify and mitigate risks): Managing high-level strategic risks (and achieving alignment on them) is impossible if they can’t be identified. It’s best to keep this brief with a recent example. Misalignment from enterprise-wide strategy and LOB priorities at Wells Fargo resulted in negative publicity that began in 2016 and will require years for the bank to resolve. In an effort to cross-sell services, the bank failed to identify and mitigate risks from opening accounts without customer’s permission.

7) Compliance implications plus added costs: When executives have to testify to congress, the next logical expectation is increased regulatory pressures. This is often a significant cost that can’t be adequately quantified in the short term. A combination of regulatory fines and seizure, class-action-law suits, and loss of top customers can accelerate the demise of the most profitable organization. In April 2018, for example, Wells Fargo accepted a fine of $1 billion related to auto insurance and mortgage abuses. Could steep fines serve as deterrent?

8) Inability to execute mission and impact to customers: For any business and government agency, the ability to execute mission and keep customers happy requires an alignment between the enterprise-wide strategy and LOB priorities. Skilled employees working as cross-functional and collaborative teams focused on the mission and customer is imperative. Facebook, for example, experienced a misalignment between strategy and LOB priorities with a vendor, Cambridge Analytica. The breakdown in policies as the LOB’s executed their respective strategies at Facebook and Wells Fargo is regrettable. In either case, customers have a choice. They can simply reject a brand or minimize how they use a product or service.

“Internal Audit touches all the primary activities in the value chain, and, in addition, can streamline support activities through compliance audits and process evaluations,” writes Emily Ray in her paper, “How Modern Internal Auditing Assists Organizations in Achieving Strategic Objectives.” To arrive at this conclusion, Ray adapted Michael Porter’s generic value chain model from his competitive analysis showing the primary and secondary value creation activities of an organization.

Internal auditors have to think in the context of the Internal Audit Value Chain and the steps required maintain that “value creation” objective for their respective organizations. Misalignments between enterprise-wide strategy and line-of-business priorities must be identified and resolved as soon as possible to avoid long-term financial losses and reputational damage. 

Click here for the other articles in the series.

Jonathan Ngah, CISA, CIA, CFE, CGFM, is a Principal at Synergy Integration Advisors, a consulting firm providing audit, and governance, risk, and compliance (GRC) solutions to federal government agencies, and private sector and not-for-profit organizations.

Did you enjoy this article? Consider making a small donation to support independent business journalism at Internal Audit 360°. Click Here!
And much thanks to all of those who have already donated. Our success depends on it.