Blogs Emilio Lui, CIA Aug 17, 2021
The first thing that came to me was mindset. The way we think about an engagement — even before gathering information — is one of the most important, if not the most important, aspects of being a professional practitioner.
The way we think about an engagement — even before gathering information — is one of the most important, if not the most important, aspects of being a professional practitioner.
Getting rid of the "policing" mentality is challenging, especially for new internal auditors who believe that it is their responsibility to "find something wrong." To all my internal audit colleagues, that is not your responsibility. We should aim to serve, to deliver value, and over deliver on our value proposition.
By evolving how internal auditors think about our organization's processes, controls, and risks, we can set a strong foundation of success for any engagement that we perform. Over the years, these are a few of the things that have reminded me to stay true to our mission of adding value.
Internal auditors must think of ourselves as practitioners, as professionals, and as advisors delivering insight. Practitioners believe in delivering value to their clients, to their customers. Practitioners don't nitpick on a single issue; we place that issue into the context of the larger process.
The "policing" type of auditing only leads practitioners to try to find something that is wrong. This ultimately affects the way how auditors report those exceptions, and it doesn't lead us to determine the root cause. The "policing" mentality influences us to believe that the exceptions are the root cause, when they're really not.
It sounds a lot better to ask yourself, "What value am I going to deliver today?" as opposed to "What wrong can I find today?" Write it down on a Post-it Note, stick it on your desk, make it your mantra, and make it part of your daily routine.
Internal auditors should always practice more of being and seeing ourselves as trusted advisors. To achieve that level, we must collaborate more with our stakeholders and keep them informed along the way. We can't be quiet, and only communicate when it's audit time or when it's reporting time. We must be visible; only then will they see us as part of the team and not the opposition.
We have to put ourselves in the shoes of our stakeholders and see processes from their perspective. We need to continue striving for the day when our phones will ring off the hook because a manager needs our insight, for example, on a change in a process or a risk the business unit is experiencing.
Biases are what hurt internal auditors the most. When auditors have preconceived notions about a process, an experience with a manager, or a policy and procedure manual that's not written correctly, we begin to judge, even before the engagement starts.
Always be objective, while maintaining "professional skepticism." Any ounce of bias in our work will affect the results and will further paint us as the critic, as opposed to a teammate. There are great resources out there about truth, confirmation, and halo biases.
The internal audit profession is dynamic. If we don't evolve our mindset, then achieving our value proposition will be difficult.
The enjoyment of internal auditing is being analytical, asking questions, understanding the business, and demonstrating our enthusiasm to partner with our stakeholders. Serving and adding value brings satisfaction; helping others should be the ultimate goal. Starting with this as our foundation can help us build a strong and energetic activity, and it can create enjoyment out of what we do. That is how we should measure our success.