Drive Positive Impact

We’re living in an age defined by uncertainty. Geopolitical and economic turmoil, public health crises, technological disruption, and environmental change are among the many powerful forces upending established norms and shaping today’s global business landscape. And while forces like these have been at work for years, what’s different now is how quickly they’re unfolding and impacting organizations. Change has become a near-daily constant, and the pace is unlikely to slow. In fact, it’s probably only going to accelerate.

Internal audit can help management navigate this new world — the rapidly changing cost pressures, competition, regulatory developments, and other challenges. As a profession, we’ve evolved to keep pace with ever-increasing demands. We’re no longer just independent assurance providers, we’re problem solvers who can offer new perspectives and solutions. We’re uniquely equipped to advise on emerging risks while playing an integral role in identifying and capturing opportunities. After all, the Definition of Internal Auditing states we help an organization “accomplish its objectives.”  

We have so many opportunities to contribute to our organizations and make them better — to help bring about substantive, meaningful improvement. Now more than ever, the organizations we serve should rightfully expect us to foster positive change and add value. That is why I’ve chosen “Drive Positive Impact” as the theme for my term as The IIA’s 2022–2023 North American Board chair. Assurance is our cornerstone, but going beyond assurance is critical. Internal auditors can make a lasting, powerful impact by taking proactive steps in seven key areas.

1. Take Individual Initiative

It all starts with the individual auditor. We can make great strides collectively, but creating meaningful value requires the commitment and buy-in of each practitioner. Everyone in the audit function, from staff auditors to the CAE, needs to cultivate a mindset of delivering positive impact.

Practitioners should always be thinking about how they can add value: What have we done, or will we do, to improve or enhance the internal audit function and its clients? This is a powerful way of thinking, placing a sharp focus on what we can do to help and where we can make a difference. It’s also beneficial for an auditor’s career progression. If an opportunity for advancement occurs, what impactful accomplishments will you point to that would justify moving into a position of greater responsibility? That’s a question all auditors should ask themselves — and one every supervisor should expect a candidate for promotion to answer. 

No one should stand by and wait for a manager to ask about their impact or value — all practitioners should take the initiative and start thinking about it for themselves. When each team member begins approaching his or her work in this way, it builds exponentially toward a stronger, better audit function.

2. Keep an Eye out for Efficiencies

Another step auditors can take — one that requires minimal effort — is to stay attuned to opportunities for increased efficiency. Auditors look at processes all the time. It’s one of our core tasks, whether we’re examining internal controls over financial reporting or reviewing human resource processes. In addition to effectiveness, look for places within those processes where rejections have occurred — where a “no” is given at a yes-no decision point, requiring client rework and cost. We have an opportunity to add value whenever we look at process flows and see that rework was needed multiple times. Why is it happening? Is there a common, root cause? What could we recommend to minimize those rejections, or prevent them altogether?

What about manual processes? Rather than simply assessing the effectiveness of a process, we can collaborate with others to see if it can be automated. We can use our networks and knowledge to help assess automation cost benefit.

Any auditor can perform a process flow analysis for efficiency. It takes relatively little incremental time to complete and can become especially powerful after developing into a habit. Applying these analyses routinely over time can make a significant impact on organizational efficiency — especially when practiced by everyone on the audit team. 

3. Build Relationships

None of us can expect to make impactful contributions without first building rapport and establishing trust with our clients — and with each other. We need to emphasize collaboration, stressing how much more we can accomplish by working together. When clients see us deliver value and begin to realize we’re truly there to help, it fortifies the relationship. The partnership then becomes an upward spiral, continuously strengthening to the point where clients view us as a true organizational partner. We know we are having a positive impact when our clients — or their peers — turn to us for assistance.

Among the keys to fostering strong relationships are listening and empathy. Practitioners need to put themselves in their clients’ shoes and try to appreciate their priorities and challenges they face. Not long ago, I asked a former audit leader who now holds a business role what he would like to have done differently while he was in internal audit. “I wish I had been more empathetic,” he said. He emphasized the importance of listening more — trying to understand clients’ views of the world and the challenges they face. With that in mind, we should ask ourselves if our audit reports are balanced, and whether we give our clients credit where credit is due.

I once read an article on report writing about the importance of words to our customers. Saying “we found” and “we identified” in a report observation, the author noted, is like congratulating ourselves for finding a problem. While seemingly minor, these small phrases can have a big impact on our relationships. Using this type of language is unnecessary and easy to stop. I challenge auditors to look for it in their next report.

As a profession, I wonder if we empathize enough. If we fail to listen to our clients and understand their perspectives, we are not just neglecting those relationships — we’re damaging them. Without mutual understanding and relationship building, we risk being seen as a non-relevant organizational partner. Instead, we might be viewed as a mere nuisance that disrupts clients with unimportant requests. 

4. Share Audit Resources

One concrete way of showing clients we understand their challenges and want to help is by loaning them internal audit resources. Our clients will often find themselves in a bind, where certain demands cannot be met without assistance. It could be a big initiative they’ve undertaken that requires risk management expertise or a special project assigned by executive management that has left them shorthanded. These predicaments provide internal audit a great opportunity — if it can spare the resources — to assign one or two staff auditors to that organizational unit for a couple of weeks at the audit function’s expense.

While contributing to the project, the assigned auditors will learn more about that area of the organization and gain firsthand experience with a key organizational initiative. In this sense, it can serve as a valuable training experience. It also enables internal audit to make an immediate, direct contribution to the organization — without needing to plan or conduct an audit. The audit function walks away with better informed practitioners and credit for assisting in a pinch, and the organizational unit accomplishes its objectives without the need to hire extra resources: It’s a win-win. I imagine there are opportunities of this type in almost every organization. 

We do need to be mindful of maintaining independence, but this can be effectively managed most of the time. However, automatically rejecting assistance opportunities behind the veil of independence can be a missed opportunity to add value.

5. Partner With the Second Line

As stated in The IIA’s Three Lines Model, internal audit provides an independent, objective voice on governance, risk management, and control processes. But that doesn’t mean we can’t make a difference outside our established third-line role. Why not expand the scope of our governance contributions?

For example, the internal audit function has common objectives with the second line, and our expertise can be of immense help to the functions within it. Both internal audit and our second-line partners want to help ensure risks are managed, controls are operating as intended, and rules and regulations are complied with. So, what are we doing to help those functions — such as risk management and compliance — become more effective and efficient? If we can enhance their abilities, we contribute to improvements in the organization’s overall GRC efforts.That type of activity certainly falls within our mandate. In fact, it is our mandate. So instead of conducting an audit, we could perform a nonaudit project geared toward boosting second-line capabilities — improving their dashboards, strengthening work programs, expanding reporting capabilities, and so on. We could provide training on best practices. Perhaps establish or facilitate a periodic council where we all informally share what we know. Over time, a better, more efficient second line could reduce the need for audits, enabling internal audit to focus more on consulting and other value-added work.

6. Spread the Word

Of course, the extent to which we make a difference for our clients can be limited if our efforts are not recognized. When our work has a positive impact, it’s important to make sure those contributions are visible broadly within the organization. We could be making a world of difference and adding enormous value, but if few people know about it, the benefit to the audit function can be minimal. Marketing internal audit — sharing our success stories and contributions throughout the organization — is essential.

The more people know about the good work internal auditors do, the more opportunity we’ll have to contribute and make an even greater impact. Plus, with increased recognition of internal audit’s achievements — and the challenging projects we assist with — a secondary benefit may well emerge around staff recruiting. People will want to join the team because they’ll see the exciting initiatives we’re helping with and realize internal audit is a place where they can learn and make a difference. 

7. Share Information

As valuable as internal marketing can be, we shouldn’t share our successes only within the organization — we need to collaborate across the profession by telling other practitioners about our accomplishments. Internal audit is somewhat unique in that what we do is not competitive by nature. In other words, there’s no need for us to hoard our trade secrets.

We all have something to teach. Even the largest internal audit functions can learn from what the smallest ones are doing, and vice versa. We need to recognize that each of us is doing something different from our peers, and we shouldn’t be reticent about sharing that.

The IIA has a multitude of resources to facilitate information sharing. The Institute’s conferences, webinars, local chapter and affiliate events, and online publications provide opportunities for practitioners to tell others what they know, learn from their peers, and network. Each one of us should be seeking out and talking to other internal auditors — whether they’re in our area, another country, or another industry — to discuss our own practices and learn what others are doing. Through a free-flowing exchange of ideas, we can all become better, more impactful practitioners.

Strength in Numbers

If we focus on each of these seven areas, we can increase the overall value we deliver both individually and as a profession. Internal auditors have so much to offer, and we’ve only scratched the surface in terms of the difference we can make. If we work collaboratively and tap our collective strengths, we can make great strides in helping organizations meet today’s increasingly complex challenges. Together, we can drive positive impact for ourselves, our teams, and our organizations.