When the problem is management - how internal auditors can deal with bad management practices

Internal Auditor, August, 1998 by Lawrence B. Sawyer

The internal auditor's job is to find and stamp out risk. But what happens when the most significant risks are linked to flawed management practices?

A professor once reminded management guru Peter Drucker of his observation that no more than three to five percent of all businesses are well managed. "Good heavens," Drucker reportedly answered, "I must have been optimistic that day!" Although Drucker's droll comment brings a smile, mismanagement harbors significant dangers and risks. From lost opportunities, to squandered work hours, to unnecessary expenses, poor management can cost a company millions.

Given that mismanagement places organizations at significant risk, shouldn't internal auditors provide counsel on effective management as part of an audit? After all, the primary function of internal auditing is to identify risks to the enterprise and to reduce them by recommending appropriate systems of control. Poor management represents one of the greatest and most universal organizational risks, while effective management serves as one of the most significant controls in any enterprise. Providing informed, appropriate counsel about improving management should, therefore, be high on our list of priorities.

THE HEART OF THE PROBLEM

Management's four primary functions include planning, organizing, directing, and controlling; and almost every deviation or deficiency an internal auditor encounters results from the violation of some principle of management or good administration in these four areas. Every attempted corrective action will fail if that root defect is not corrected. Several problems identified in past audits help illustrate this point:

A planning PROBLEM A claims department was failing to complete a number of claims on time and was overlooking some others. The surface cause appeared to be that people were simply not doing their jobs. The corrective step the internal auditor accepted was a copy of a memo to the people urging greater care and diligence.

Unfortunately, that action merely shifted to the people the blame that lay with management. The manager had failed to establish a central log or register to keep track of all assignments in the department. Management had also neglected to establish a reporting system that would alert them about the number of claims on hand and the number overdue.

An organizing PROBLEM A production department experienced an excessive number of rejections of manufactured products. Poor performance by the inspectors was cited as the cause.

To improve the inspectors' practices, the director of manufacturing offered to issue special instructions. The root cause, however, was an unbalanced organization. The manager of quality control reported administratively to the director of manufacturing, who often overruled the quality control people to maintain schedules and reduce costs. The effective corrective action was to place the manager of quality control on the same level as the director of manufacturing.

A directing PROBLEM Internal auditors discovered that the data processing department issued reports that were not being used. The cause was considered to be the inability of the reporting people to design effective and usable reports.

The root cause lay in lack of communication, however. The recipients failed to return work that did not meet their needs to the issuing unit with an explanation of the deficiency. Also, the issuing unit was neglecting to ask recipients what they needed.

A controlling PROBLEM An engineering department seemed unable to complete long-term projects on time. The immediate cause appeared to be that people were not applying themselves sufficiently to meet due dates. The root cause was failing to provide for reporting milestones and periodic assessments on all projects that exceeded a given number of weeks.

Internal auditors who are well versed in the basic principles of management can get at the root of the problem and counsel management. Knowledge of management principles can be put to use in every type of audit, from research and development audits to inventory audits, and at any stage of the audit. The following scenarios may enhance internal auditors' understanding of management's four primary functions and show how to make the connection to management-focused audits.

PLANNING

Planning precedes all other functions; organizing, directing, and controlling all flow from proper planning. Planning includes setting objectives and goals; developing strategies; prescribing principles, policies, and procedures; devising rules and standards; and preparing budgets.

One management principle that organizations often violate is the need to communicate planning premises. Many managers fail to explain to their workers why a particular rule or procedure has been prescribed. But when this principle is violated, the plan will most likely not be carried out.

I remember a scrap generation audit I once performed. As various metals were processed, a great deal of scrap resulted. The scrap was segregated by type and thrown into wheeled containers. Periodically, the scrap people would come by with a small truck, pick up the containers, and take them from the production area, past the guard gate, to the scrap area about a mile away. At that point they passed another guard gate at the scrap yard, where the scrap was stored until sold.