Internal Audit at Bayer AG: Enhancing the Role, Rewriting Reports, Developing Career Paths and Introducing Performance Management
Company Headquarters — Germany
Number of Countries Operates in — 75
Number of Employees in Company — 118,888+
Industry — Healthcare, Agriculture and High-Tech Polymer Materials
Annual Revenues — ¤42.2 billion (as of December 31, 2014)
Number in IA Function — 110
Number of Years IA Function Has Been in Place — > 80 years
IA Director/CAE Reports to — CEO
“We want to be able to identify and fix problems before they materialize, which is much more difficult than simply producing big audit reports.”
-Dr. Rainer Schwarz
Bayer was founded as a general partnership in 1863 by a dye salesman and a master dyer. The venture quickly distinguished itself from Germany’s many other 19th-century dye factories on the strength of its research and development (R&D) capabilities and international reach. Today, Bayer AG continues to stand out in many ways, including through its impressive longevity.
A global enterprise with core competencies in the fields of healthcare, agriculture and high-tech polymer materials, Bayer AG, headquartered in Leverkusen, Germany, operates as a strategic management holding company. The holding company defines the values, goals and strategies of the entire corporation, including its three primary businesses: Bayer HealthCare, Bayer CropScience and Bayer MaterialScience. In total, Bayer consists of nearly 300 consolidated companies in 75 countries. The internal audit function at Bayer is comprised of 110 auditors, 60 of whom work from the Leverkusen headquarters. Remaining team members are based in Brazil, China and the United States. Staff responsibilities are organized and assigned by business subgroups, regions and business functions.
After holding several positions within the company, Dr. Rainer Schwarz stepped into the head of the corporate audit role in July 2014 with the intention of bolstering the partnership between the function and its numerous stakeholders. “My mission is essentially twofold,” Schwarz says. “One side is traditional internal audit work. The other is forward-looking, doing preventive work.”
He continues, “We want to be able to identify and fix problems before they materialize, which is much more difficult than simply producing big audit reports. Therefore, we have to strengthen our partnerships throughout the organization to become trusted advisers – a role that we have not yet fulfilled. When that happens, we will be much better positioned to know what might go wrong before it actually happens.”
As audit reports are one of the function’s most essential activities, Schwarz is working to make them less bulky and much more relevant to the different audiences who read them. He is also focused on enacting other major changes, including rewriting the career paths of Bayer’s internal auditors, making auditing more data-driven, and introducing new ways to drive internal audit’s performance. “We are also conducting some special projects, and constantly responding to changing business needs,” says Schwarz.
In September 2014, for example, Bayer’s Board of Management announced plans to float Bayer MaterialScience on the stock exchange as a stand-alone, publicly listed company by mid-2016 at the latest. This strategic shift will transform Bayer into a pure life sciences company. This change requires a split of resources to enable efficient internal auditing at the new company. This requirement has forced the function to review its audit universe and to recalibrate how it devotes time to conducting traditional audit work, as well as an advisory to the business – in addition to its own transformation initiatives.
Writing to Three Audiences
Feedback is important to Schwarz, who says he wants to establish more of a “feedback culture” in the internal audit function. Schwarz holds off-site meetings of the full department on a regular basis. At these gatherings, he invites the top management members to speak on a variety of important and current topics. “I always ask the speakers to share with us what impresses them about our reports and what they would like to see changed or improved,” Schwarz says.
Board members have pointed to the length of the audit report as an improvement opportunity. This feedback has been valuable, Schwarz says, because many of his less experienced internal auditors have not yet worked closely with senior managers or board members, whose information diets rarely have room for 45-page analyses. But senior management and the board represent only one audience. While these executive readers prefer brief summaries – with an emphasis on what requires fixing and plenty of bullet points – other internal audit stakeholders have different information preferences.
To address these preferences, Schwarz says internal audit will take “a three-pronged approach when writing audit reports.” That means addressing the distinct expectations and preferences of different audiences in a single report. “We must have a highly condensed executive summary with the absolute right message for the board of management,” he explains. “For others, like the concerned division or function heads, we provide an additional five or 10 pages of deeper analysis of the same issue. Addressing the auditees, we also investigate, for example, our R&D organization or project teams responsible for large investments, which primarily consist of scientists and engineers. They ask for every detail, so we must be able to meet their requirements as well. Our reporting should allow for each and every interested party to easily access the precise level of detail they need.”
Blazing a Career Path Through Audit
One of the first initiatives Schwarz launched when he took over as head of internal audit involved the career progression of internal auditors. “I felt we needed a framework in place so internal auditors could have a better idea of how their careers would develop,” says Schwarz, whose framework sounds as if it could one day serve as a strong leadership development program for the enterprise.
“Corporate is an important entry position for graduates at Bayer,” he says. “We want to hire really good people from top universities in Europe and have some of them staying in internal audit for up to five years before they move into the business.” During these early years, freshly hired internal auditors are exposed to many different business units and geographic locations. “They absolutely have to get to know the company as well as they possibly can,” says Schwarz, who has amassed years of experience throughout Bayer, with management positions covering control, finance, accounting, IT and strategic planning in Germany and in many other locations around the world.
Along with an intensive introduction to the company through at least four different assignments, new auditors are challenged by activities that require heavy interaction with senior management. “From there, we want them to deepen their knowledge of a function, such as accounting or control,” Schwarz continues. “After that, we want to give them broader leadership experience, perhaps as an audit group manager abroad. Or, they might become, for example, a CFO of one of our smaller businesses.” At that point, the auditors are ready to take on larger leadership positions inside or outside the internal audit function. The rigorous career path Schwarz describes helps develop the business savvy, leadership experience and functional expertise that internal auditors need to operate as trusted advisers.
Preventing Problems With Data-Driven Auditing
Another way Schwarz is helping internal audit to be perceived within Bayer as a trusted adviser is by demonstrating greater auditing efficiency through the use of technology. “We’re currently in about 90 percent of our larger business units once a year,” Schwarz says. “We also want to get into our smaller units more frequently than every four or five years.” He adds that computer-assisted auditing tools and related audit analytics will play a key role in determining how many auditors will need to review processes and controls in those smaller units, and how often.
Bayer’s internal audit function is developing a form of continuous auditing that has been applied to 10 pilot projects to date. The technology is designed to churn through large supplies of financial transaction data to detect anomalies that might point to developing problems. “The technology keeps us in the loop,” Schwarz says. “We can quickly follow up when an issue warrants it,” he explains. “The technology and our mitigation actions are designed to prevent negative issues from arising.”
If the team applies this approach to more business units in the future, the findings will help determine which entities internal auditors visit in person, according to Schwarz. Units with more issues that qualify as higher risks to the company will, of course, receive more frequent visits. Schwarz says the units that have worked with the technology have so far reacted positively. “Because we share many issues with them before these issues become larger problems, they’re interested in the results.” Other functions are interested in the technology as well. Schwarz reports that Bayer’s procurement function has asked about adapting the application for its own review purposes. “It is homegrown technology with some limitations,” Schwarz says, “but the feedback so far has been very encouraging.”
Enhancing Performance Management
Schwarz is now in the process of editing how internal audit’s performance is measured. “Almost every day, my staff wonders why I want to measure everything,” Schwarz says with a laugh. While the claim has its merits, it is not entirely on the mark. Schwarz clarifies that he wants to measure the right things on the journey to becoming a world-class audit function that fulfills the role of a trusted adviser.
“Coming from corporate control, where measurement really is everything, I was surprised that there were almost no performance metrics in internal audit,” Schwarz says. The primary performance indicator, such as it was, only tracked whether the internal audit plan was executed in a qualitative way.
“I want us to become the type of trusted adviser our business people call before making major decisions,” Schwarz says, “so that we can guide them on how to deal with risk and control matters.”
Since taking on his current role, Schwarz has experimented with new key performance indicators (KPIs), including the length and number of audits each auditor conducts per year. “Considering the scope of our audit approach, we now know that an auditor performs seven to eight audits each year,” he says. “We have some team members doing 14 audits per year and others doing much less. We’ve just started looking into how we can more effectively measure our performance.”
This assessment may soon lead to a new internal audit KPI: number of requests for early help. “I want us to become the type of trusted adviser our business people call before making major decisions,” Schwarz says, “so that we can guide them on how to deal with risk and control matters.”