Up front internal auditing.

• Author: Shapoff, Stephen H.
• Position: Interview with Baxter International vice president of corporate audit Karen May - Includes related article on joint audit planning meetings - Cover Story - Interview

As internal auditors struggle to become part of the top management team, the internal-audit group at Baxter International steps up with some bold ideas.

If you ask Karen May how it feels to push the internal-audit function at Baxter International toward pioneering changes in its relationships with the business units, she laughs, "It's fun! The fun is the challenge of continuing to raise the bar, to rethink the role of internal audit here."

As Baxter's vice president of corporate audit since 1994, May - and her predecessors, she's quick to point out - have added some unique twists to the traditional auditing process at the global medical products and services company based in Deerfield, Ill. She's prodded her 20-person staff to become true business partners with the rest of the company, not to simply pay lip service to the idea.

May joined the $5-billion company from the audit group of a large public accounting firm, so she knows the terrain. Through several leadership changes within Baxter's internal-audit function, she rotated in and out of the group, ultimately to end up at its helm. With her team, she analyzed many organization structures, eventually abandoning the layered approach and opting for a team-based model. She tried new compensation schemes, then devised her own. She measured everything she could get her arms around, then settled for a hard look at customer satisfaction.

Here, May shares some of her strategy with Stephen H. Shapoff, executive vice president and CFO of Ivy Hill Corporation, a Time Warner Inc. company, and a member of Financial Executive's editorial advisory board, and Michael Hayes, vice president of internal audit for Time Warner worldwide.

STEVE SHAPOFF: Would you say Baxter has gone through revolutionary or evolutionary change in the internal-audit function?

KAREN MAY: About seven years ago, the company decided the internal-audit group wasn't playing the role within the company that it could. At that time, the department was solely compliance-focused. The environment was one of how many audit findings could you discover. But we weren't getting the benefit out of the audit group since it wasn't viewed as an integral part of the finance team. So we decided to become more of a business partner, more a part of the process, not the guy at the end of the line saying, "Yeah" or "Nay."

SHAPOFF: Did everyone in the internal-audit function accept the change in philosophy?

MAY: Because we don't look for career auditors when we're hiring, our internal auditors are interested in expanding their business skills, so we faced little resistance. If our group did straight compliance audits, we couldn't get talented people. Our goal is to recruit finance talent to Baxter.

Initially, some people did leave the company or the group, but we plan on a 40-percent turnover rate to the business units, so within two years or so, we had a whole new team of people anyway.

MIKE HAYES: When you meet with the audit committee, how do you reconcile the internal-audit group's fiduciary responsibility with your desire to expand the skill sets and become an internal resource?

MAY: Those two goals are complimentary. Being an internal resource and business partner allows us to get involved early and often. It ultimately strengthens the control environment.

The audit committee has been very supportive. And we really haven't cut back on our fiduciary audit work. Our audit coverage is similar, and we continue to support our external auditors. But now the audit group is involved up front in projects. If there's a problem, we don't always have to find it. The business units often call and say, "There's something wrong here. Can you help me?" If Baxter is developing a new system, an internal-audit team member often participates on the task force. When an internal auditor is an adviser to a project, the controls are baked into the process up front.

It's not a change in our approach. It's a change in what we do with what we find. In the past, the internal auditors would in effect score the projects and publicize the findings, without helping to fix problems. Now we take the information to the senior finance person in the unit, explain the problem and suggest we work together to come up with a solution. When we have to present the problem to senior management and the audit committee, we can jointly explain the issue, what caused it, the lessons we learned and the action plan to fix it. We become part of the solution.

But it takes trust and communication for the controllers to realize I or someone in my group will talk to them before any problem leaks back to corporate. We'll deal with it locally first. We don't communicate over someone's head until we've had a discussion with that person.

You know, these are very simple techniques.

HAYES: If you didn't reduce your traditional audit focus, did you have to add to your resources to provide some additional time for the special projects?

MAY: Our headcount is...