Now, a slightly trickier question. If I were to ask your customers what kind of service they receive — again, a one to 10 scale — how do you think they would rate your audit department? Not just your favorite customers — not just the ones who are convinced you are the greatest thing since the introduction of the sliced-bread department because of your value-added services, impactful audits, identified frauds, donuts, or the occasional lunch — but every single actual and potential customer of internal audit’s services.
If you pause and think about this, there’s a good chance the estimate for your customer’s rating is lower than the number you awarded yourself.
Methinks I doth perceive a disconnect.
This should not be a surprise. There are a lot of numbers (with the appropriate amount of underlying research) that back up such a disconnect. For example, in a report issued by The IIA’s Internal Audit Foundation titled Insight: Delivering Value to Stakeholders, (Warning: you may need to be a member to access some of the reports I'm referencing) internal audit leaders and executives within their organizations were asked if internal audit provided insight on the effectiveness and efficiency of governance, risk management, and internal control processes. 81% of internal audit leaders reported that their department provided such insight, with 66% indicating they always or frequently provided such insight.
All well and good. But now let’s hear the story from the customer’s perspective. For example, 56% of executives agreed that their internal audit department provided insights, with only 38% saying this always or frequently occurred.
81% versus 56%; 66% versus 38%. These are some serious gaps.
Of course, it should be pointed out that this report is getting a little long in the tooth. It was published back in 2011. However, I have yet to see anything — any report, any research, any word-of-mouth, any sly whispers from Deep Throat in the cavernous darkness of the parking garage — to indicate things have gotten any better. In fact, take a look at prior copies of Ihe IIA’s annual Pulse of Internal Audit report. While the disconnect is not specifically noted, you can look closely and realize that the identified issues have an underlying theme — the failure of internal audit to effectively reach out to its customers/clients/stakeholders.
And in my inbox today, a new study from Galvanize (formerly known as ACL) titled State of the GRC Profession. (Warning: You'll have to provide information to access this report.) This survey included such functions as IT, compliance, and risk, but just over 50% of respondents were internal auditors. A couple of the sobering numbers contained therein:
First, respondents indicated that only 60% of their recommendations were implemented. When recommendations are not implemented, it is a strong indication that the work being done — and the results and the resulting recommendations — is not in alignment with the client’s/customer’s needs. It speaks to a disconnect and poor communications.
Next, only 37% indicated they were involved in strategic planning from the beginning of the process, with the remainder saying they were involved only after the plan was complete (35%) or not at all (28%). Being brought into a process after the fact (if at all), particularly a process as important as strategic planning, is prima facie evidence that the clients/customers feel the internal audit department is completely out of touch with what those clients/customers feel is important to them. The 63% of respondents in this survey represent departments where the disconnect has grown to such an extent that the opinions, knowledge, and expertise they have to share is seen as valueless.
Yes, I realize that these results include departments other than internal audit. But, again, over 50% were from internal audit, and there is every reason to expect that internal audit is the primary driver for any of these results.
Here’s the good news in all this. We are not alone.
Remember that 80% I spouted in the beginning of this post? It comes from a Tom Peters’ quote based on the book What’s the Secret to Providing World-class Customer Service by John DiJulius. It is what Peters calls the 8/80 chasm. 80% of companies think the service they give is “superior;” 8% of customers think the service they receive is “superior.”
Let’s throw in one more stat from the Galvanize report to show that Peters, et al. are, indeed, talking about internal audit. Respondents were asked, “How valued you feel your team is by your organization.” Almost 60% rated themselves a 7 or above. This in spite of not being a part of strategic development and not even getting more than 60% of their recommendations accepted.
Yes, almost everyone (in all professions, departments, companies) overestimates the customer service they are providing. And internal audit is not immune. But that does not absolve us. In fact, if we want to be more than an executive’s afterthought, we have to actively change those numbers — get out there and communicate with our clients/customers, learn their needs, and then deliver on them.
The most recent Pulse of Internal Audit concludes its introduction with this statement:
CAEs must seek out any opportunity to educate themselves about board and executive management views on risk to find proper alignment. This starts with continuous conversations between CAEs and their internal audit function’s key stakeholders. Communication is vital to maintaining alignment. It also includes leveraging survey data and other resources that provide insight into the bigger picture from board members and executive management and what is influencing their views. There is value to gauging the perspectives of other boards and executive management in other organizations. However, every stakeholder is different; therefore, CAEs must be in tune with the specific perspectives on risk of their board and executive management.
And, while this message was directed at CAEs, it is just as true for every auditor within the department.
Find out what stakeholders at every level need. And then deliver it.
That is the only way we will ever close the gap that has existed for far too many years.
