​Internal Auditors: Don't Sink Ships. Save Them

​Too often I hear bad jokes and other comments describing the negative perception of internal audit within organizations. "Drilling holes in sinking ships" comes to mind. The problem, though, is that it is most often internal auditors telling these type of jokes or making negative comments about "finding things that are wrong or broken."
If that's what we're saying about ourselves, it's not surprising to meet people skeptical of internal audit's intent. And, it's this perception of intent that is at the core of whether internal audit is seen as a business expense or a value enhancer.

To change the stereotype, we need to change how we talk about ourselves. We're not auditing to find problems (although we might); we're there to make the organization stronger, more efficient, and more resilient. We're not auditing to report how bad something is; we're there to enable management to be the best it can be and make sure managers have support from senior management and the board to do what needs to be done. We're not auditing to take up management's valuable time and distract managers from their work; we're there to bring a laser focus to help them leverage their time and resources, and arm them with knowledge and insights to get more done.

All of this exists in the mindset of each individual internal auditor. This mindset drives the words we use, the relationships we cultivate, and ultimately the image we create around what we do. How we think about ourselves as professionals carries through our audits and our work relationships. Here are six tips to help you demonstrate the positive force of internal audit:

Be clear about what internal audit is (and what it isn't). Start by defining internal auditing and the mission of your audit function. The IIA defines internal auditing as "an independent, objective assurance and consulting activity designed to add value and improve an organization's operations." This is an opportunity to start off on a positive foot by saying, "We're not here to find problems and embarrass you. We're here to help you meet your objectives as effectively and efficiently as possible."

Align the work you do to the organization's objectives and the objectives of the entity you are auditing. Clearly demonstrate your connections to objectives, which will help stakeholders understand the support internal audit can provide. If you can't easily make these linkages or explain them, rethink moving forward with an audit.
In one organization I worked for, the leadership team identified five key, high-level objectives. By adding five new columns with each objective to my audit plan and adding checkmarks for which objectives each audit supported, it generated a more positive reaction and the board could more readily visualize internal audit's fit within the organization. It wasn't perfect, but it was a solid step in the right direction.

Explain to your clients why you are auditing their processes, how you will execute the audit, and what they will gain. Clear expectations set upfront will simplify the process, ease anxiety, and encourage collaboration.

Understand the attitude you are walking into, as well as the expectations. What outputs and outcomes are imagined? How hard do you have to work to change perceptions? Take the time to identify key influencers and develop strategies to get them on board.

Collaborate with management to better understand the risk and control environment you are auditing. Discover what ideas managers have that could improve your processes and, in doing so, recognize how much they can contribute to a successful audit.

Stop apologizing for what you do. If you are going into an audit with a mindset focused on making the organization better and effecting positive change, then you have nothing to apologize for. In fact, this attitude can be contagious and you might just find management getting excited about the audit.

Alternatively, if you're going into the audit with a mindset focused on finding out what is wrong and putting it on display, you should be apologizing. That's not why internal auditexists. I discussed this one time when speaking at an IIA chapter event. A chief audit executive in the audience spoke up saying, "Company policy requires management to submit to audit and commit to addressing our recommendations. I'm there to find problems and make sure they are fixed." In response I simply said, "And I bet you have a really long list of open audit recommendations and are constantly trying to convince management to close them out." He slumped silently back into his chair.

My comment wasn't meant to shut him down. It was meant to make him realize that attitude matters and will affect whether or not your audit will ultimately have a positive impact on the organization.

The only people who can change the perception of internal audit are internal auditors. What we do is incredibly important. We are at the core of good governance. We provide comfort to boards, investors, and the public that organizations have an independent, objective voice on the inside supporting the achievement of important objectives. As professionals and as a profession, we do great things. It's time we all say it.