Richard Chambers: Dominique, in my book, Agents of Change, I take the position that internal auditors should be seen as agents of change who are catalysts for transformation that creates value within the organizations they serve. What’s your view on internal auditors as agents of change, and is that how you would define an agent of change in internal audit?
Dominique Vincenti: Being an agent of change is baked into the definition of internal auditing. If you go back to the 1999 definition, which is still the definition that guides us all, it says that we are an activity designed to add value and improve an organization’s operations. It’s right there.
I think that Larry Sawyer said at some point that the internal audit function can be anything the director of internal audit wants it to be. Now, there is a lot to unpack in that very provocative statement, but what is retained from those words spoken 50 years ago now is Larry Sawyer back at that time was clearly telling the internal auditors of the world, “You need to be on the move all the time. You need to be creative, new, and different — that’s your job, now go and do it.”
Richard Chambers: From your experience, how receptive are members of management to internal auditors taking on these change agent roles? Do they prefer to see internal auditors stay in their bean-counting box or are they comfortable that we get out and we facilitate change in the organization?
Dominique Vincenti: Maybe I’ve been lucky or maybe this is what I was looking for, but at all the organizations I’ve worked for there was a match between my vision of internal audit and what internal audit should and could do. Those charged with governance — whether executive management or boards of those organizations that I had the privilege to join — expect it. So I cannot really say that I experienced resistance from management that internal audit would be a partner in change at all the organizations I’ve worked for — that’s even true of The IIA. I remember very, very distinctly when I joined you and Al and Bill, The IIA was again at a turning point and change was on the horizon. **It doesn’t mean that change is easy, but I think that the leaders I’ve worked with were always open to change.
My lesson learned during all those years, is when I have not been successful at being a catalyst for change, it would be totally unfair for me to point the finger at the leaders of those organizations. At the end of the day, the person that failed was me. In hindsight, when I analyzed the reasons for my lack of success in some of the changes that I wanted to initiate, it’s because I had a big vision, but I was not sweating the details. I could not influence properly, or tell the story of what I was trying to accomplish in ways that it would enlist people’s support. At the end of the day, when you want to be a change agent, you can have the best ideas in the world, but you have to do that with and through others and the greatest difficulty is to convince them. Every time I failed is because my influencing skills were not up to par.
Richard Chambers: Before internal auditors can be seen as effective change agents in their organizations, they have to be change agents in internal audit itself. Do you agree with that as a person who’s been a CAE now for so many years, and what are some of the things you’ve done to be a change agent in internal audit?
Dominique Vincenti: I will share two things that I try to do to be that change agent within internal audit. On a macro level, and usually with the internal audit management team, there are three questions that I like to revisit continuously.
I never take for granted, “Why do we exist?” That’s the mission question, but I think it’s good from time to time to go back and say, “Why do we exist?”
The second question is, “Where do we aspire to go?” That’s the ambition question. Again, we are constantly on the move. I don’t remember who said change is the only constant. If you stand still, the world is going to move anyway, it’s not going to wait on you.
The third question, if we are clear about why we exist and where we aspire to go, is “How are we going to win?” That’s the strategy question. That’s how to keep a sense of constant motion within the internal audit team — it’s kind of a technique I try to use.
At a micro level, something that I’ve found to be very successful is to embrace what is known by the car manufacturing industry as the kaizen culture, very famously embodied by Toyota. Here in the U.S. we call it a culture of continuous improvement. If I remember correctly, the word kaizen, in itself, means “a change for better.” I’d much prefer to keep that as the culture that we infuse at a micro level within the team. Everybody in the team needs to know that they’re empowered every single day to make micro changes to how we do things for the better. So, those are two things that I’ve been using to bring a change spirit in internal audit.
Richard Chambers: I’ve been talking about the concept of capacity multipliers for a number of years — things that internal audit can do to enhance its capacity to address more risk. The one capacity multiplier that I think towers above all others is technology as part of internal audit’s mode of operations in carrying out its responsibilities. How have you deployed or leveraged technology as a chief audit executive in the organizations that you’ve served?
Dominique Vincenti: Definitely data and automation is paramount to the multiplying factor that you’re talking about. Interesting enough, not easy to bring at the forefront of internal audit teams. I found it harder to convince our internal audit teams nowadays of the importance for everyone in internal audit to be data and technology savvy, experienced, and competent. Way harder than it was probably when you and I started in internal audit. When you and I had to embrace new technology, it sounds funny, but we started at a time where things were done with paper and pencil.
Richard Chambers: Oh, I started even before you, I think we were chiseling things in stone tablets when I started. But you’re right, when I started the most sophisticated technology we had in the office was a calculator.
Dominique Vincenti: When I started with technology, there was a separate team that was called CAATs, computer assisted auditing. I would say in less than two years in the nineties, you had to pivot from paper and pencil to having your own laptop and become a pro at Word, Excel, or their equivalent of that time, starting to write macros. Suddenly, we had no choice because we knew that if we were not embracing it, we would be irrelevant. CAATs teams disbanded because now CAATs was all of us.
Now, data science and data analytics in our day has become so complex. It’s not so much resistance, but I do hear, “how much competency do I need to have? Now you want me to be a data scientist, an analyst, a computer and technology expert, and a computer engineer!” Obviously not all of this, but there is a minimum that is very important for us to have so that we can harness the resources that exist in our organization. Fundamentally, before being an expert in technology is knowing what you want to do with the data. Knowing what data exists out there, what is the information that you’re going after, and then what you can have it do for you so that it works hard for your audit. Whether it helps you to describe a situation, whether it allows you to predict future trends, whether it allows you to identify unknowns — that part is not technical — it’s the analytical skills we’ve always had to cultivate in internal audit.
Richard Chambers: Bring out your crystal ball, Dominique, and tell me, what do you think the next ten years in internal audit could look like?
Dominique Vincenti: It could be bright, but it depends on us. Again, let’s not point fingers. If the next ten years turn out not to be as glorious as they should be for internal audit, I think we’ll have only one group of people to blame, and that will be ourselves. When I do my own risk assessment, what keeps me up at night? This famous question that we ask leaders, sometimes we need to ask it for ourselves. There was always one answer. And the answer is relevance. Am I relevant? Is our team relevant? Is what we do relevant? That’s what scares me the most about us as a profession. Are we doing everything that we need to do? Are we asking, “why do we exist?” in ways that will keep us relevant for the business community, the community at large, and the stakeholders in the community — regulators, authorities, the general public?
It’s high time for us to educate our leaders within the organization so that they can be our champions. By being our champions, they’re going to serve their organizations better. But also they’re going to help the internal audit profession to be recognized outside as this critical pillar of good governance.
Go and be creative, you out there! Innovate, be a change agent. The world of the profession is in your hands — take good care of it.
Stay tuned for more Agents of Change episodes featuring conversations about innovation in internal audit with forward-thinking leaders from some of the world’s most prominent organizations.