For Internal Audit at J.C. Penney, Finding Opportunities to Improve Efficiency and Enhance Processes Never Goes Out of Style
Company Headquarters — United States
Number of Countries Operates in— 1
Number of Employees in Company — 117,000+
Industry — Retail
Annual Revenues — US$12 billion
Number in IA Function — 30
Number of Years IA Function Has Been in Place — > 93
IA Director/CAE Reports to — Audit Committee and Chief Financial Officer
James Cash Penney opened his first store – a Golden Rule – in Kemmerer, Wyoming, in 1902. The Golden Rule dry goods chain was founded by Guy Johnson and Thomas Callahan, who made Penney, one of their star salesmen, their third partner. By 1907, Penney had bought out Callahan and Johnson, and by 1912, had incorporated the retail chain under the new name, J.C. Penney Company, with headquarters in Salt Lake City, Utah.
Today, J.C. Penney Co., Inc., is based in Plano, Texas. In 2002, it became the holding company of J.C. Penney Corp., Inc., (JCPenney), which operates more than 1,000 midrange department stores in the United States and Puerto Rico. JCPenney sells everything from apparel and shoes for men, women and children, to furniture and luggage. Its private-label brands, such as Arizona Jeans, account for approximately 50 percent of its revenue. Many JCPenney stores feature distinctive offerings such as Sephora inside JCPenney, Disney Store, beauty salons and custom decorating departments.
Like any company that’s been in business for over a century, JCPenney has seen its share of ups and downs. Once one of the top catalog operators in the United States, the retailer exited that business in favor of expanding JCPenney.com, one of the first online apparel and home furnishings websites. The company is now working to emerge from one of the most challenging chapters in its history following an unsuccessful makeover. Its new focus: omni-channel retailing. Ironically, as part of that move, JCPenney just introduced a home catalog, a smaller version of its famous “Big Book” catalog.
“Omni-channel is one of the areas of focus for the company,” says Benita Casey, senior vice presi- dent of internal audit for JCPenney. “Many people still want to walk into a department store to see, touch and try on the products. But many customers are also now researching products online via smartphones and tablets and personal computers before they go to the store to make a purchase or vice versa. So, we have to be sure we can connect with them through all channels and offer a seam- less customer experience.”
Giving “Worker Bees” More Exposure
Casey joined JCPenney in January 2014; she reports directly to the audit committee and administratively to the company’s chief financial officer (CFO). Previously, Casey served as vice president of corporate audit for Dr Pepper Snapple Group, where she built the soft drink company’s internal audit department from the ground up. At JCPenney, Casey oversees a team of 30 auditors, focused predominantly on core business processes, such as international sourcing, supply chain and omni-channel.
Casey has senior-level auditors mapped to certain functions so they can continue to build strong rela- tionships and inherent knowledge with business partners. The remaining team members are assigned as needed on key audit projects determined from a risk-based assessment. This allows junior auditors to get more exposure to different areas of the business and audit teams, furthering their development. This is by design: Since Casey joined JCPenney, she has been focused on bringing more balance to the function, in terms of the mix of experience on her team.
“Historically, auditors were aligned to a specific audit team that supported certain business functions,” she explains. “For example, there may have been a team that worked almost exclusively on human resources and procurement projects. While it was good for auditors to gain in-depth knowledge, this approach was also a bit limiting.”
Casey continues, “I now have some senior staff members with subject-matter expertise who serve as the go-to people for the business, while junior staff and specialists – the worker bees on my team – get more exposure cross-functionally. That way, staff-level auditors can gain expertise from senior leaders in areas across the business and not be exposed to only a few aspects of the company.”
Because Casey advocates a risk-based audit approach, she says her staffing strategy also helps to ensure internal audit can apply the right resources in the right places whenever they are needed. Long term, she says she wants the function to become a talent pool for all of JCPenney by transferring internal audit “superstars” into the business after two or three years. In the past, senior team members in internal audit typically stayed in the department on a long-term basis.
“The function was very top-heavy,” says Casey. “When I came on board, about 70 percent of the team was working at a manager level or above. Over the past year, we’ve achieved more of a 50/50 split. We are in a good balance whereby we have tenured expertise developing some of the newer talent.”
Another change Casey implemented in her first year at JCPenney was making audit reports avail- able to all key stakeholders. “Audit reports used to be given primarily to the management team that was being audited. There was no standard distribution list,” she explains. “Now, the reports are also sent to the executive team – the CEO, CFO, general counsel and controller – and the audit com- mittee, too. This process helps to provide transparency and accountability as leadership now has visibility into what opportunities exist.”
Casey says the business has had to adjust to this new approach, but the end result is more account- ability for, and ownership of, audit findings for both auditees and auditors. “We need to make sure that what we are recommending is being implemented,” she says. “Otherwise, we’re not being effective – and the risk of an internal control gap remains.”
To help business owners prioritize audit findings and remediation, Casey says JCPenney’s internal auditors take care to emphasize the most important items in their reports: “Before we include a rec- ommendation in an audit report, we challenge ourselves and ask: ‘Why is this important? What is the risk? What is the root cause?’”
According to Casey, the team also does a lot of planning up front to help make the audit process more efficient and engage business owners. “We really try to partner with the business to manage expectations, avoid surprises and address competing priorities,” says Casey.
Because JCPenney has a strong corporate culture, Casey says earning the trust of people in the business is critical. “One of the things that attracted me to JCPenney was the strong loyalty that people have to the company,” says Casey. “But you need to earn the respect of those who work here, and make them feel engaged and comfortable – which isn’t easy when you are in audit. So, I’ve been focused on building relationships and showing how audit can assist the business in reaching its goals.”
Another Balancing Act to Master
Over the past year, JCPenney has made changes in both the board and management team to help lay the foundation for new beginnings. Its internal audit function has changed a great deal during this time as well. Casey says she is now thinking of how to take internal audit to the next level, by making it more of a strategic partner for the business – although that will require another balancing act.
“Business process improvement is an area where internal audit can really add value as a strategic part- ner,” she says. “Auditors are great at telling people what’s not working well and identifying root causes for problems. But sometimes, the business needs project and process expertise in improving a process that may lead to internal audit assisting in the redesign. Internal audit has to be careful not to impair its independence and audit our own work.”
As JCPenney pursues its omni-channel strategy, Casey says there are many opportunities for internal audit to partner with the business as it rolls out new initiatives; identifying potential risks and putting control measures in place before implementation are two examples.
“Are we, as auditors, in a position to tell the business that a strategy isn’t going to work? No,” Casey says. “However, we can partner with them, and tell them where potential risks and control issues are that may impact the success of that strategy.”
Improving efficiency is also an ongoing priority for the internal audit function, according to Casey. She explains: “When I joined JCPenney, I asked each team member where they saw opportunities for improvement within the department. Some staff-level auditors noted that managers had different ways of doing things, which created confusion. So, I suggested we start with a blank slate and decide what we wanted our audit methodology to be. The team was empowered to develop that new methodology, and they did a fantastic job.”
Now that JCPenney’s internal audit team has a new reporting structure, audit reporting process and audit methodology, Casey says the team is adjusting to their new way of doing things and will be ready for the next era of positive change for the whole company.
“A lot of changes have occurred in the internal audit function and at JCPenney during my first year; however, I think the results so far are paying off,” says Casey. “I told our CFO and audit committee that we need to allow the changes to absorb and focus on letting everyone on my team know they are valued, their ideas are valued and that they belong.”
“In the midst of all this change, we knew we needed to step back and redesign the internal audit func- tion,” says Frimpong. “We are now regionally focused and regionally shaped. This gives us greater connection to the business, as well as more alignment with various cultures and languages.”
With this approach, the internal audit team can conduct risk assessments at a regional level, making the assessments more detailed and accurate. Although it takes time – about four months, on average – to collect, analyze and synthesize the data, the benefits are clear.
The regional approach ensures that internal audit is well known throughout the regions it serves. Frimpong says, “We have a seat at the table, and business leaders proactively contact us to become involved in new projects or initiatives. We cannot just lock ourselves in a room and come up with a plan,” he says. “We cannot just think we understand the business; we have to know that we do. We have to shape the audit plan to make sure we deliver impact and drive results. You simply cannot underestimate the power of engagement.”
Hiring for the Future
“To make sure we keep up with the needs and expectations of our K-C stakeholders, we carefully consider the profiles of the individuals we hire,” Frimpong says. “We want people who have the ability to deliver ‘critical-thinking’ – who think about risk in many different, specific ways. On the other hand, we also want ‘elastic thinking’ – those who can consider issues more broadly and connect to the big picture.”
Driving Cultural Change
“The internal audit team at K-C impacts cultural change by performing impactful audits that transform the way we look at risk management in the company. Our objective and focus is to conduct audits that affect the risk landscape and support a culture of accountability,” says Frimpong.
Training and education is another aspect of cultural renewal at K-C. The internal audit department’s Centers of Excellence, as well as the Internal Audit University, provide training and mentoring for inter- nal auditors to become subject-matter experts in a range of topics, from SOX to audit technology.
“Technology is a primary focus for us,” Frimpong says. “When it comes to big data, we are looking forward to a future when technology is a true enabler for internal audit. Our auditors are highly engaged in the evolution of the audit work at K-C. We rotate auditors regionally on a regular basis, which is an exciting way to build expertise and share knowledge and cultural insights across teams.”
“We want people who have the ability to deliver ‘critical-thinking’ – who think about risk in many different, specific ways. On the other hand, we also want ‘elastic thinking’ – those who can consider issues more broadly and connect to the big picture,” says Frimpong.