Minds matter – the psychology of internal auditing strategies

Talk to most internal auditors and they will tell you that their key motivation is to make things better in their organisation. Most internal audit functions state that their vision or purpose is to create meaningful and lasting impact on, and influence in, their organisations.

Unfortunately, the reality is often different – resistance and “politicking” cause delays, and managers tolerate our work but respond with superficial or unsustainable actions. This drains our time and sucks the energy out of the internal audit team.

All internal audit functions have strategies to manage or avoid the negative aspects of human behaviour. For example, we base our position in the organisation on independence and authority, we have rigorous and defensible methodologies that stand up to scrutiny, and we engage with management in meetings.

Yet the problems persist. This is often because we employ the wrong strategy for the situation, or we try all the strategies simultaneously – for example, giving management the opportunity to respond in our reports, while also telling them that the authority and independence of internal audit is sacrosanct.

Given the time and energy that internal audit teams spend dealing with managers’ reactions to their work, it makes sense to see time spent on the psychology of auditing as just as valuable as time spent on other audit approaches.

Changing the system

In 1969 Robert Chin and Kenneth Benne wrote a seminal study entitled “General Strategies For Effecting Change In Human Systems”. Internal audit exists to make change in human systems, so there are probably few academic titles that better describe what we do.

Chin and Benne identified three strategies:

Forcing strategy, based on authority and leverage. “I am internal audit and by the powers invested in me, you must make this change.”

Telling strategy, based on facts and persuasion. “I am going to give you data points and examples from our testing showing why your actions do not make sense, and therefore you will change.”

Participating strategy, based on relationship and open dialogue. “We will work together to see whether we can make things better. I will coach you towards self-realisation of change that we all buy into.”

Internal audit teams need to recognise which strategies they employ. Many will default, intentionally or unintentionally, to a forcing strategy when facing resistance. Many internal audit teams strive to achieve a participating strategy, but don’t support this with their actions and behaviours. In their study, Chin and Benne identified examples of things needed to support the different strategies. Focusing on the more progressive telling and participating strategies, these examples can be readily adapted to illustrate areas for internal audit to consider.

Telling strategy – a rational intervention

This strategy emphasises an approach to internal audit that would appeal to Star Trek’s Dr Spock– “I have the experience to be authoritative in this area. I have found relevant facts and data. The logic of these facts leads to a rational conclusion.”

Examples of techniques that internal audit can use include.

But as Dr Spock discovered repeatedly, a strategy based solely on rationality and logic is no match for emotion. We have all seen an emotional reaction from management derail the most logical conclusions.

For example, an internal auditor in an organisation that has gone through significant acquisitions might encounter resistance to recommendations that controls are integrated and aligned. This is not because management does not know it makes logical sense, but because people are emotionally invested in their legacy organisations.

Participating strategy – a normative intervention

A normative intervention deliberately attempts to change norms, attitudes and beliefs. Through collaboration, internal audit helps management to learn from experience. It often requires more time and effort, but delivers sustainable change.

Again, there are many techniques that internal audit can use.

Many of the techniques that support a successful participating strategy happen at the start and end of an audit. Set-up and positioning is key, including establishing a “contract” with management for each audit. The three Ps model can be useful to establish this.

Professional: internal audit is typically good at establishing the professional contract through elements such as terms of reference and scope documents.

Practical: internal audit is also good at establishing the practical contract – for example, agreeing the timing of work and dates for milestones.

Psychological: this tends to be neglected. We know that people don’t like being audited, but we accept their concerns and anxiety as part of doing an audit, rather than confronting it.

Of course, the psychological element of internal audit’s contract with management is messy. It changes over time and staff will experience varying amounts of anxiety about audits.

To ensure that it is given enough attention, an internal audit team can establish prompts or reminders. Simple things include allowing enough dedicated time and space in the initial audit meeting for both parties to address hopes, fears and expectations. Some auditors are uncomfortable talking about these issues, while managers may be reluctant to open up. However, with practice it can be highly effective.

It is important that both parties conclude the audit work together. Crucially, internal audit findings must be put in the context of an outcome that managers want to achieve. For example, it’s better to put a new control in place because, without it, management won’t be able to deliver good outcomes for retail customers (causing competitive, commercial and operational risks) than merely to comply with consumer duty rules.

Achieving transcendence

In 2007, Robert Quinn and Scott Sonenshein revisited Chin and Benne’s study. They identified a fourth strategy to deliver change in a human system – the transcending strategy.

The transcending strategy is based on understanding what is possible, while being able to transcend self-interest. While forcing, telling and participating can all (to greater or lesser degrees) change “how” something is done, transcending is needed to change “what” something or someone does.

Internal auditors do not always need to change the “what”, however if they do, they need think about using a transcending strategy.

Requirements for a transcending strategy are typically specific to the situation, but there are some key points to consider.

The motivation for change should be founded on “common good”, rather than on “self-interest” (which is associated with forcing or telling strategies). Further, the lever for change will be “integrity” rather than “dialogue” (which is associated with participating strategy).

Where does internal audit want to be?

Internal audit is much more likely to achieve what it desires if it selects the appropriate strategy.

Any strategy for creating change will depend on the outcome you want. Participating and forcing strategies are more useful when the desired outcome is one that causes change, but preserves the overall existing system. Forcing and telling strategies are most effective when the change involves imposing structure and control.

Internal audit’s strategy for creating change will also depend on the perspective that it wants to bring, and the perspective that it wants to be known for. The rational, factual basis of the telling strategy lends itself to internal audit providing a technical perspective. If an internal audit team is aiming to be a business partner, the interpersonal perspective of the participating strategy is key. On other occasions, internal audit will need a transformational perspective to support its role of change agent within the organisation.

Matt Cox is Chief Audit Officer, UK, at Allianz Insurance.

This article was published in September 2023.