There Are Three Types of Internal Auditors: Which One Are You?

As an internal audit practitioner since 2007 it has been my goal to make internal auditing more relevant and more effective in practice. During my time in the profession, and as a chief audit executive, I have noticed that there is a significant spread in the types of internal audit functions and the way they operate. And, of course, some internal audit functions are more effective than others.

While working on a study of the characteristics of an effective internal audit function, as part of my PhD studies, I interviewed many C-suite executives to get their perspectives on internal audit. One chief executive’s answers stood out. When I asked him to describe the characteristics of an effective internal audit leader, he said it was someone who is “swimming in the organization.” He explained that an effective internal audit leader knows what is happening in the company and speaks with everyone and every function at all levels of the organization.

In contrast, he described the subpar internal auditor as someone “who often eats lunch alone.” These are powerful metaphors that got me thinking about the different types of internal audit leaders and how effective they are in this era of COVID-19 and volatility, uncertainty, complexity, and ambiguity or VUCA. I have added a third to form a mini-typology of internal audit approaches that includes three distinct types.

Type 1: Internal audit leaders who are standing on the sidelines
Internal audit is an activity, so go swimming. Swim with the current or against the current (by raising a red flag when necessary), but do not remain at the edge of the pool watching what others are doing. Type 1 internal auditors are also known as “know it all” auditors or “masters of none.” They already think they know everything, so they don’t become involved. They are not inquisitive and remain more as observers than doers.

The impact of a Type 1 auditor is negligible. These types of internal audit leaders are most often ignored or marginalized in the organization. At best, Type 1 auditors deal with complicatedness, so sorting and saying what is happening rather than what should be happening—to the extent they get to address audit subjects that matter at all—is where they operate. They are often looking backward and fail to influence other leaders in the organization.

Type 2: Internal audit leaders who are swimming in a calm pool
The Type 2 internal auditor is getting involved, not just standing on the sidelines observing the game. To apply the “swimming” metaphor, they have jumped in the ocean, but they are hesitant to rock the boat. The Type 2 auditor applies the standards, slavishly (sometimes), but they are dogmatic, rather than pragmatic. The Type 2 auditor is impactful in the managing zone.

These internal auditors are not eating lunch alone, but they are also fearful of ruffling any feathers. They know the business and seek to understand it better. Still, they may be hesitant to push too hard on senior management and may avoid looking in places where they fear they may not like what they see. These are internal auditors who value relationships, strive to nurture them, and like to keep the peace.

Type 3: Internal audit leaders who are surfing in the wild ocean
The Type 3 auditor understands that internal audit thrives on accountability and learning, so they accept drowning as a risk of taking a stance. They manage fear and act without favor. The Type 3 internal audit leader constantly aims to improve. They understand that internal audit is nurtured by successful interpersonal relations, so they act as a critical friend who liaises with colleagues on all levels, and, like Type 2 auditors, rarely have lunch alone.

Type 3 auditors deal, of course, with complicatedness, so rather than sorting and saying what is happening, they act with pragmatism and impact, giving hands-on advice about what should be happening. The Type 3 internal audit leader operates in the pioneering zone, when and where it truly matters, and where the risks are. They are there, for example, when the organization is entering new markets, buying and integrating new businesses, and other pioneering activities. Moreover, Type 3 auditors influence behavior and increasingly deal with interactive complexity (scenarios). They are comfortable and more familiar with asking “what if” types of questions, too.

Pioneers and Innovators
I’m sure it’s clear by now that I am advocating for internal auditors to strive to be more in the Type 3 category. The effective internal auditor is not a behind-the-scenes player, he or she is a key actor in the governance arena. To heighten impact and gain relevance, the internal audit profession needs more Type 3 auditors and more pioneers and innovators. In the world of VUCA, checklists no longer help much.

To solidify the scope of action, building on the auditors’ social capital becomes mission critical. Relationship equity becomes key and a prerequisite for internal audit to be part of the solution and not the problem. High flexibility is indispensable. In the days of COVID-19, it may be a smart move for internal auditors to ask senior management and the board: “How best can internal audit help the organization during the crisis?” That conversation may lead to fresh perspectives and a new focus on the activities.

Internal auditors might as well (temporarily) assume roles beyond their traditional core remit, depending on the specific organizational context, and the Type 3 auditor is always willing (even eager) to jump in. There is plenty internal auditors have to offer. Bring it to the table. Shared goals, shared knowledge, and effective communication (frequent, timely, and problem-solving minded) are key ingredients of a successful value-adding internal audit function.

In a joint publication with Professor Marc Eulerich (2020) we apply a different terminology. We suggest a maturity model distinguishing the roles of internal audit as a governance, risk, and control (GRC) partner, trusted advisor, and value driver as maturing roles of the internal audit function. Assurance emerges as an overarching theme across all roles: The GRC partner delivers assurance services as core remit. The trusted advisor goes beyond to offer advice; however, often limited to subject matters in or associated with internal audit’s core competencies in the GRC arena. The value driver goes further, cracks the traditional boundaries and contributes to what truly matters in the respective organization, thereby also dealing with the not so familiar, the lesser or unknown subject matters, and the more complex issues.

A Decisive Moment
Aspiring to become a value driver (Type 3 auditor) might help and provide orientation for internal auditors to be ambitious and courageous and become stars in the darkness. Internal audit is well positioned to do so. This type of an internal audit function can work on all levels in the organization, act in and across functional silos, and provide a unique perspective of the organization and its challenges and opportunities. Through this approach, internal audit can earn a seat at the table and, more importantly, offer unique contributions.

There are, of course, differences between how CAEs and internal auditors view themselves and how senior management and the board views internal audit. You might think you are swimming in the organization, but others may view you as more of an “on the sidelines” leader, so it’s important constantly seek feedback and to advocate for yourself.

In the fast-paced world of VUCA, and even more so with the outbreak of COVID-19, we are all in the pioneering zone now. It is crunch time for internal audit, a decisive moment, to say so; an opportunity to shine, too. Type 3 auditors will shine. Business as usual or waiting for what is going to happen next are not options.

Dr. Rainer Lenz, CIIA, CIA, QIAL is a seasoned finance and audit professional with 30 years of international experience in global organizations, including ABB, Schlumberger, Actavis (now Teva Pharmaceuticals), Villeroy & Boch, and SAF-HOLLAND.