A few years ago, I came across an article from The IIA that highlighted a crucial concept for Heads of Internal Audit: Understanding the governance style of your Audit Committee.
This insight opens up a fascinating discussion about the differences in corporate governance and the critical relationship between Audit Committees and Internal Audit functions.
The key question that emerges is subtle but strong: Are they more Push or Pull in their approach?
The Push Approach
Active Oversight: The audit committee sets clear expectations, deadlines, and deliverables. The Audit Committee maintains a firm hand on the tiller, ensuring that all stakeholders understand their roles and responsibilities. Deadlines aren’t suggestions; they’re commitments that drive accountability and results.
Direct Reporting: Management and auditors must provide structured, detailed reports. It establishes a clear chain of communication where information flows in prescribed channels, ensuring that critical insights and findings are properly captured and addressed.
Regulatory Compliance: Ensures strict adherence to rules, policies, and controls.
Push approach provides a potential framework for maintaining compliance and managing risk effectively.
The Pull Approach
Voluntary Sharing: Management is encouraged to proactively share insights and risks. This creates an environment where information flows naturally, unrestricted by rigid structures. It encourages management to bring forward concerns and opportunities they might otherwise keep to themselves.
Collaborative Dialogue: Open discussions help uncover hidden issues beyond formal reports. This approach recognizes that some of the most valuable insights emerge through conversation rather than formal documentation. It creates space for discussions that can reveal subtle but significant risks and opportunities.
Proactive Risk Management: The committee gathers additional context to better anticipate risks. By encouraging open dialogue, organizations can often identify and address potential issues before they become problems, creating a more proactive risk management environment.
Finding a Middle Ground
While both approaches have their merits, I advocate for a balanced or mixed approach – one that ensures firm oversight while promoting open communication and a collaborative space for the board, management, and internal audit.
This middle ground recognizes that effective governance isn’t about choosing between structure and flexibility – it’s about knowing when to apply each. It creates a dynamic environment where formal oversight and collaborative dialogue can coexist and complement each other.
In practice, this might mean maintaining strict reporting requirements while also creating informal channels for communication. It could involve setting clear deadlines while remaining open to emerging insights that might require adjusting those timelines.
The key is to maintain the structural integrity that the Push approach provides while harnessing the creative and collaborative benefits of the Pull methodology. This creates a governance skeleton that’s both tough and adaptable, capable of meeting current challenges while remaining prepared for future ones.