How audit earns plaudits.

Okay, you've re-engineered every other area of your company. Now what about audit? Take a look at how other companies measure the immeasurable.

The finance function in most large companies is scrambling to focus more on finance activities that contribute economic value to the business and to eliminate activities of little or no value. That's worked out well for the transaction-oriented functions, where you can easily identify activities and processes and readily measure productivity. But how do you evaluate a finance function like audit, where the service is so ill-defined? We recently worked closely with the general auditors of some of America's top corporations to address these challenges and to identify best practices for internal audit. What worked in assessing internal audit can work anywhere in finance, so let's take a look at internal audit as a case study.

General auditors are buffeted by the same issues as CFOs. Their three key concerns are audit's mission and its value to the organization; the organization and human-resources approaches that best support the mission; and the cost management of both internal and external audit. Overall, it's hard to tell whether the internal-control environment in many companies is improving as a result of auditors' actions, raising doubts about their abilities to carry out their responsibilities. Companies without a measurement program for financial processes have no way of verifying improvements in the control environment. Meanwhile, management is demanding greater value from the audit process, implying that internal-control auditing isn't useful and often drawing auditors into the unfamiliar arenas of operating audits and efficiency findings, which are thought to have more tangible benefits. In fact, many audit organizations shift between the extremes of internal-control assessments and operating audits.

Many finance managers believe experienced auditors can't manage other finance areas; they suggest the functional expertise required in audit inhibits the development of management skills. More important, audit has a poor image, based partly on a historically combative and adversarial operating style, that makes recruiting staff from within the company difficult. The increased inter-twining of finance functions and information systems has made application-system skills a near-requisite for effective auditing. All of this conspires against transferring staff among various finance units, even though most managers know such career development benefits the company and employees.

While auditors search for guidance in determining the basic direction of audit, they don't have many quantitative measures of the cost of either internal or external audit. The eight companies we worked with, each with more than $10 billion in sales, had total internal audit costs of $200 to $900 per $1 million of revenue, a wide variation by any reckoning. It's little comfort that the companies closest to what we call best practice are clustered in the middle of the range, because audit costs are the product of a complex set of factors that make simple numerical comparisons worthless.

Our research identified best practices in the definition of audit's mission, human resources issues and cost containment. We worked with each of the participants through a detailed quantitative survey, a data review and intensive on-site interviews to define current practices of the audit department for each company's environment. No one company exhibited all elements of best practice, but a few were close.

THE ACTIVIST MISSION

All best-practice audit organizations share certain characteristics. For starters, they're committed to developing the finance organization's and the company's future leadership. General Electric is probably the best-known and most successful organization in this regard. Individuals who begin their careers in the audit department spend two to four years there, simultaneously going through a developmental training program to prepare them for other positions within the company. As a result, audit has a reputation for being a great place to develop professionally. For honing analytical and facilitation skills, building an extensive base of company knowledge and learning to implement change, there's no better laboratory than an internal-audit department with an activist orientation (see box on page 34).

Of course, you must support audit's mission with a complementary organization and human resources environment. Many approaches to organizational structure exist, but most were designed to support a passive audit mission and are therefore obsolete. The passive audit organization has trouble placing experienced auditors in desirable positions outside audit because the company considers the department ineffective and assumes its staff is tainted by this experience. Many audit departments become top-heavy, hierarchical structures, cemented in place by senior audit managers who insist on keeping some career auditors "to ensure quality" and to train and manage junior staff.

In contrast, best-practice audit departments are consolidated worldwide under the general auditor, operate with broad spans of control, have no career auditors, actively rotate staff into and out of audit and have an integrated auditor profile - that is, a blend of financial and information-systems knowledge. Each element of best practice reinforces audit's overall effectiveness.

When you consolidate all worldwide audit resources under the general auditor, you can better array those resources against the company's risks, usually through some form of high-level global risk assessment. Mobil, for example, has integrated its worldwide resources during the past few years, a move that's helped it develop consistency in staff skills and planning and save money. Another advantage of consolidating is the general auditor can ensure the quality, autonomy and objectivity of internal audit's work.

Best-practice audit departments operate with just three layers under the general auditor. At the top, senior managers direct operations and ensure the department meets its objectives. Below them, midlevel audit managers act as the auditor-in-charge for one audit at a time, spending about half their time on site and the rest on planning future audits, wrapping up prior audits and handling all administrative and communication roles. The third layer is junior staff, who work on one audit at a time from start to finish. This clear and simple structure, seen, for example, at Digital Equipment and Motorola, drives responsibility down to the lowest levels of the audit organization consistent with capability. Note that if your audit organization has more than 75 people, you may need a fourth layer to effectively manage operations.

These audit organizations also operate without a core of career auditors because this approach damages individual career development and the company's need for cross-fertilization. Motorola, GE and Digital have chosen the long-term development of people and corporate capability over the short-term expedience of finishing audits faster. This is one reason why the best-practice audit organizations we studied aren't necessarily the ones with the lowest costs.

COME ON AND ROTATE

Actively rotating staff into and out of audit at each of the three organizational levels makes the best use of this simple structure. At Digital, junior staff members with about three years of audit experience move into finance positions throughout the company. Midlevel finance professionals rotate through the department as audit managers and then out again after a similar period.

Finally, the best-practice vision of audit staff capabilities combines financial and computer applications skills. These auditors can support the finance organization as auditors, plus serve as valuable, experienced finance staff to the rest of the corporation. A small technical computer group that also performs technical computer audits supports the integrated audit department.

Best-practice audit organizations also focus on the most efficient ways to improve controls. Some companies, such as Mobil and GE, have achieved this by shifting away from auditing discrete entities and defining the audit universe in a more process-oriented way. This may mean, for example, that audit treats all sales operations in the United States or an entire business unit as a single unit for planning purposes. Similarly, audit can view the entire purchasing and payables cycle as a single function when it audits for controls. Audit groups that continue working with a high level of detail and then perform some audit activity periodically in each entity are allocating some scarce resources to immaterial risks.

Process-oriented or functional audits focus on the critical business processes or on major business units as a whole. At the same time, the audit team benefits from the broader business perspective it needs to achieve results, so the results are more likely to be relevant, which means management pays more attention to them. Outside auditors also find the results, which are tied to the financial statements, more relevant to their own mission. The functional audit takes the notion of partnership beyond the theoretical and into the realm of possibility.

HELP FROM WITHIN

Best-practice companies use the audit organization to help reduce external auditors' time and costs. Audit can achieve that goal not by doing the external auditors' work but by centralizing worldwide responsibility for the external-auditor cost under the corporate controller to achieve a global cost and service perspective.

The companies we studied also cut costs by setting specific productivity goals, reducing the annual close calendar and introducing another independent audit firm into the negotiations to add an element of competition. And they use quantitative measures of the internal-control environment to support resource reductions.

Best-practice companies recognize the need to address mission and organizational changes before focusing on cost. Only if you have good controls can you reduce the amount of money you spend on auditing. The best way to create a good control environment is to adopt the prevention mission - using audit to troubleshoot control breakdowns and devise business solutions - and couple it with an integrated audit staff.

Given all this, what responsibility does management have in ensuring audit achieves its full potential? Start by clarifying the role you expect audit to play. And encourage people to rotate into and out of audit functions, because no other barrier is more difficult for audit to eliminate unilaterally. The general auditor can make a great deal of this happen by cultivating good relationships with line managers. The auditor should go out and sell the audit staff's capabilities to other departments, and he or she must be willing to give up some of audit's most talented people in return for talented finance people in other parts of the company - a barter that's often tough for auditors to accept.

Also, get more involved with internal audit. Take the time to engage in a dialogue about the annual audit plan, the planning for specific audits and internal audit's options. The idea that more than one approach is acceptable may be novel for your organization!

The hardest issue is "how to get there from here." Our work with best-practice companies suggests three lessons for finance leadership. First, before you examine cost or productivity, focus on the value audit delivers. This then becomes the baseline against which you measure the department. Second, become comfortable relying on audit's judgment to some degree. The products of all the analytical functions are very difficult to assess quantitatively, so accept qualitative assessments rather than none at all. Finally, identify steps that can point the way to continuous improvement in productivity without driving toward a strictly quantitative measure.

RELATED ARTICLE: HOW AMERICAN STANDARD'S AUDIT STAFF DID AN ABOUT FACE

"We'd do all this careful planning and have everything worked out perfectly, and then a real customer order would come in and screw up everything," says Benson Stein, vice president and general auditor of American Standard. That's the way things used to work, anyway, until a leveraged buyout and heavy debt back in 1989 forced the company to take a deep breath and look at its operations with a newly critical eye. It began re-engineering with an almost religious zeal, substituting demand-flow technology, a just-in-time inventory concept, for the just-in-case philosophy that once permeated the company. From the beginning, audit was a vocal missionary for this new corporate doctrine. That experience, and those of four other companies whose internal-audit departments are driving change at every level of their organizations, are chronical in Financial Executives Research Foundation's recent study, Internal Audit and Innovation.

According to Stein, internal audit was key to making American Standard a more effective organization because "audit was the one group that went out to all of the business units worldwide and saw what was going on in the company. It had the broad perspective and the language capabilities to communicate effectively to our worldwide locations." So the audit staff was among the first to train in the company's new demand-flow technology concepts.

Of course, it wasn't a bump-free transformation, Stein recalls. "Auditors are just like anyone else - they're human, and people naturally resist change. We all wondered what would happen to the nature of our work as we migrated toward a process organization. But as we began to improve our processes, the audit staff members saw they were gaining control over their responsibilities, not losing it."

For example, the audit staff once took 60 to 90 days to compile its audit reports, "because we always had arguments with the business unit about how to word the audit report's recommendation," explains Stein. The solution: Get rid of the recommendations. "If you think about it," he says, "only the facts and the corrective action that operating management plans to take are important."

That was a big step for the audit department, which saw the recommendations as an important way to add value for the company. But now everyone's convinced it was a good move: The reports take only two or three days to complete, and as a result, line management has begun to respond much more quickly to the reports' findings.

Once audit got its own ducks in a row, it helped train other departments in demand-flow technology and began including any implementation problems in its audit findings. And audit kept its eyes and ears open for innovations it could implement in other areas. "Our Brazilian subsidiary came up with a much more efficient way to purchase office supplies," Stein recalls. "American Standard was a major purchaser of office supplies, so it was easy to talk the supplier into a 'kanban' replenishment system." Now employees no longer submit a purchase request and wait several days to receive needed items, which encouraged people to stockpile supplies, he explains. Small amounts of supplies are kept in bins in a storeroom to which all workers have access. An individual from the office-supply company restocks the bins frequently and bills American Standard monthly.

This has eliminated nearly all paperwork and freed up storage space - not just in Brazil, either. The audit staff told a Canadian subsidiary about the Brazilian system, and the subsidiary quickly followed suit. Thanks to audit, the kanban system is now also in place at American Standard's New Jersey location.

What's ahead for internal audit? Like the other four audit staffs in the FERF study, it's continuing to expand its new role to other parts of the company. "We want to help the company extend and improve demand-flow technology for all of our locations," Stein reports. Another big goal is helping management meet its goal of zero working capital and, eventually, a negative balance. At American Standard, it's clear that for auditors, there's no such thing as "business as usual" anymore.

RELATED ARTICLE: THE FOUR FACES OF AUDIT

Most audit departments fall into four categories. Two are passive, which means the audit department simply identifies and reports problem, and two are active, where audit becomes part of the solution to business problems. These four styles speak volumes about how companies view audit's mission. See if you can spot your own auditors.

* The detective. This is the most passive style. Auditors on a detection mission stick to identifying control lapses and recommending improvement to the audited unit's management. They usually feel their value is rooted squarely in their independence, that management is solely responsible for controls and that helping to solve business problems might compromise audit's fiduciary responsibility. So audit documents its recommendations to the hilt. But trouble's in store when the audit findings don't consider business realities or when management ignores the recommendation.

* The efficiency is guru. This approach is one (maybe two) steps removed from the detective mode. This type of audit department wants to add value to its basic duties and broaden its staff's experience, so it tries to do that by, for example, reporting on opportunities for improving efficiency or sharing methods it's learned in one unit with other units. The problem is that other managers tend to think auditors are out of their element and haven't spent enough time understanding their units' business. So audit groups that try to fulfill demands for more value by taking this route are often disappointed when management doesn't cheer them on.

* The activist. You'll find the activist in best-practice audit organizations, where the audit department prevents rather than merely identifies internal control problems. Not content to accept a narrow reporting or policing role, companies like Motorola and Johnson & Johnson achieve superior results by focusing audit resources on preventing control breakdowns and by encouraging audit to team up with management to produce better controls. These organizations build a top-notch control environment by performing financial-system development reviews and by educating management and assisting it in meeting control standards throughout the company. Their audit organizations avoid traditional notions of rigid independence from operating units. Instead, the combine partnership and objectivity by jointly developing action plans to improve control weaknesses.

* The problem-solver. Some audit organizations operate in the final category, in which auditors provide solutions. The audit staffs at Digital Equipment, General Electric and other companies conduct specific and separately planned and resourced business-performance reviews at management's request. This occurs only in companies where internal audit is known for effectiveness and adding value. These reviews sport multidisciplinary teams, a cooperative investigative approach and jointly developed conclusions. Conducting business-performance reviews isn't a requirement for best-practice audit departments, but it develops auditing and process-analysis skills, not to mention the business perspective so crucial to the department's core internal-control role.

Many audit organizations operate to some extent with two approaches, either the two passive or the two active modes. The key to getting active is to focus audit on improving internal controls and doing this jointly with management. Next thing you know, you'll be on someone's "best practices for audit" list. - JP

Mr. Pancoast is a partner with Gunn Partners in New York.