Internal Audit – Charles D. Schrock

Accountability – the 3 lines of defense

If you have any connection to “risk management”, you have probably heard of the “three lines of defense” model.

The first line of defense (“FLD”) makes the risk decision at the point of its occurrence. Sweep the floor or don’t sweep the floor. Turn on the lights or don’t turn on the lights. Make the sale or don’t make the sale. Recruit this volunteer or don’t.
The second line of defense (“SLD”) sets policies regarding the risk. In many organizations, that’s a separate group with technical expertise. Maybe it’s the “Plant Safety Committee” that interprets and implements OSHA rules for the factory. Or it’s the “Information Security Group” that interprets and implements data security procedures.
The third line is the independent review, often by internal audit, to provide an independent and objective view .

Now let’s put this in the context of “goals”. As described in an earlier post, there really are only two kinds of goals within an organization. There are “mission goals” and “mitigation goals”.

As a reminder, mission goals are those that directly, intuitively, and obviously align with the overall mission. These goals are things like sales goals, production goals, brand recognition goals, financial reporting goals, cash management goals, etc.

Mitigation goals are the “anti-mission” goals. These detract from the mission goals, but in a necessary way. As an example – “Sure we want to maximize sales, but we will not do it in a deceptive manner.” “Sure we want to manage cash flow, but we won’t illegally hide funds in off-shore accounts.”.

If the organization is big enough, mitigation goals are owned by a separate unit with the right expertise. Maybe it’s the Legal Department, or Compliance, or Credit, or something similar.

And now we arrive at the point of this post – Accountability. Effective organizations thrive on accountability. Who are we choosing to entrust with that goal ? That’s accountability.

In the case of mitigation goals, these are always owned by a second-line-of-defense unit. It has to be their responsibility to assure that these bad things aren’t taking place. Part of the SLD’s responsibility is to define, and push down, procedures that will guide the first line of defense. The content of these policies and procedures must be clearly owned by the SLD unit. If they don’t achieve the mitigation goal, that’s SLD’s failure. They better be monitoring to determine if their strategy (policies, procedures) are achieving the desired results or not.

FLD, on the other hand, is responsible for executing those procedures. Period. If the procedures aren’t really very well-designed that’s not FLD’s problem. Remember, FLD’s primary role is to achieve their mission goals, not the various mitigation goals. But – to be clear – the FLD is responsible for following company policy – and that includes performing whatever mitigation procedures the SLD defines.

So, that’s it. It’s easy to assign accountability for mission goals. But mitigation goals will always create a tension – a push/pull – with those mission goals. That’s why it’s important to segregate these goals to a specific SLD group with the appropriate interest, expertise, and authority to make it happen. And they must understand that their role is “anti-mission” – and for good reason.

So what happens if the mitigation procedures are so onerous that they severely impact the mission goals? This is where FLD’s self-interest kicks in. If FLD is not achieving their goals and they contend that it’s due to onerous SLD mitigation procedures, it becomes FLD’s responsibility to raise the flag and ask for a reevaluation. But whether to comply with the mitigation rules? Not their option. They cannot pick and choose which mitigation rules they will recognize. If they choose to ignore the procedures, they have to pay the price for knowingly ignoring and acting contrary to policy.

One last point. If the mitigation procedures are negatively impacting a mission goal, and there’s nothing that can be done about it, FLD leaders have every right to petition for an adjustment of their particular mission goal. For example, let’s say that a food delivery service has the goal of delivering 500 free meals a week to the needy in their community. And they use volunteers to drive and deliver those meals. Subsequently, a mitigation procedure says that volunteer drivers may not have any driving infractions for the prior 5 years. That will obviously have an impact on recruiting volunteer drivers, perhaps making the mission goal impossible. Accordingly, it’s entirely appropriate for the individual who is accountable to deliver 500 meals to reopen that discussion and negotiate resetting the goal to, say, 300 meals per week. This illustrates the fact that mitigation always has a cost. That doesn’t make it inappropriate. But like any constraint it needs to be transparently considered in strategic planning.

Agile Auditing

This was published in Thomson Reuters – Internal Auditing magazine.
Volume 36, Number 1
January/February 2021 – page 16.

Agile Auditing is a trendy concept. That doesn’t mean it’s bad or good. But when something is trendy, its overall usefulness can sometimes get lost in its own press coverage. The real question is whether a new idea, like Agile, can help us be better professionals.

High Value Auditing: Becoming an Executive Multiplier

This was published in Thomson Reuters – Internal Auditing magazine.
Volume 34, Number 4
July/August 2019 – page 28.

We perform audits. We prepare workpapers. We verify compliance with established controls. When we find control weaknesses (or even worse – “irregularities”) we propose stronger controls.

These are the things that auditors are trained to do. And these things provide value.

But what if …

Risk Appetite and Risk Tolerance are Relevant Topics for Auditors

This was published in Thomson Reuters – Internal Auditing magazine.
Volume 33, Number 4
July/August 2018 – page 33.

Auditors live in the world of risk management. Two important – and often misunderstood – parts of current thinking around risk management are “Risk Appetite” and “Risk Tolerance”. We need to have a good understanding of these key concepts.

Using a Risk Management Framework for Internal Audit

This was published in Thomson Reuters – Internal Auditing magazine.
Volume 31, Number 3
May/June 2016 – page 29.

This is the last of four articles intended to help audit executives understand, evaluate, and use practical risk management techniques.

Strategy, Risk, and Results: The Focus of the (Strategic) Internal Auditor

This was published in Thomson Reuters – Internal Auditing magazine.
Volume 30, Number 5
September/October 2015 – page 16.

This is the third of four articles intended to help audit executives understand, evaluate, and use practical risk management techniques.

Understanding the Risk Management Environment

This was published in Thomson Reuters – Internal Auditing magazine.
Volume 30, Number 1
January/February 2015 – page 13.

This is the second of four articles intended to help audit executives understand, evaluate, and use practical risk management techniques.

Risk Management is a Key Operating Activity

This was published in Thomson Reuters – Internal Auditing magazine.
Volume 29, Number 4
July/August 2014 – page 15.

This is the first of four articles aimed at helping Chief Audit Executives become more integrally involved in their organization’s risk management activities. Risk management is a crucial activity in any organization and it is becoming more visible and more important each year.

Continuous Auditing – is it really “auditing”?

Thomson Reuters’ magazine “Internal Auditing” has an article in their current January/February edition called “The Value-Added Significance of Continuous Auditing”. This is my rant because I continue to chafe at the concept of continuous auditing.

Let me preface this by saying that I am not an expert on continuous auditing. Quite the opposite. I’ve been reading about it for years but have never found its basic premise to be sufficiently compelling to encourage me to develop any expertise.

Now, on its face, there is clear logic for reviewing controls more frequently than less frequently. But every time I imagine which controls I could actually review by continuous auditing, I stumble. I first image detailed reviews of “exception conditions” that might be highlighted through automation. But in my book, that’s the role of management, not internal audit. Maybe it’s just semantics, but I can’t really conceive of anything that I would audit on a continuous basis. I go back to the assertion that continuous monitoring of a process is management’s role, not audit’s.

Audit’s role, in my view, is to stand apart from the process. To second-guess. To avoid getting caught up in execution of individual transactions and focus on the big picture – asking questions like “What is this function trying to accomplish? What are the risks? How is management monitoring and mitigating those risks? Is management’s monitoring process sufficient, efficient and effective?

The article that I mentioned at the top of this post asserts a difference between continuous monitoring and continuous auditing. I can accept their assertion that management is responsible for continuous monitoring. But their further implication is that continuous auditing is similar to a quality control function by assuring that management’s continuous monitoring is taking place. I don’t think that this definition of continuous auditing is a universal concept. I don’t feel that my profession and my experience is in any way aligned with quality control monitoring. It seems that this view simply doesn’t align with the words “continuous auditing”.

So I’m back to my starting point. Continuous auditing is so fuzzy that it is, to me, unusable – yet it keeps getting discussed in the literature as a critical leap forward for internal audit.

What am I missing?

Auditing Reputation Risk

This was published in Thomson Reuters – Internal Auditing magazine.
Volume 29, Number 1
January/February 2014 – page 30.

According to a 2013 survey called “Exploring Strategic Risk” ⁽¹⁾,conducted jointly by Deloitte and Forbes Insights, reputation risk is now rated as the highest impact risk area.