Blogs Narelle Sheppard Dec 01, 2021
I have found this to be true, and building and maintaining relationships has always been a critical element of my work as an internal auditor.
Having a stakeholder relationship management program is a good start. This provides a structured approach to identifying key stakeholders and documenting how the internal audit team will communicate with them. Stakeholders can be prioritized according to their level of influence, with internal audit team members assigned to the task of developing and maintaining relationships with specific stakeholders.
Apart from a formal relationship management program, internal audit team members can be encouraged to build and maintain relationships in other ways, such as participating with internal committees and in-house events and volunteering to help with social activities. It all helps make internal audit approachable and supports the old (but true) cliché that "we're here to help."
As a CAE, I found that business unit managers were always asking me to share "lessons learned" with them. I participated in key committees to share internal audit insights and offered to present at branch meetings. My team also monitored reports on other, similar organizations issued by external auditors and prepared and issued summaries of these reports to relevant stakeholders within the organization.
As a team, we delivered presentations on internal audit to business line areas so they could get to know us, increase their understanding of our role and how we could help, and hear about best practices and lessons learned. We found that these outreach activities resulted in a surge of requests for our advisory services, which was a great outcome.
Managing relationships with other assurance providers is also important. IIA Standard 2050 –– Coordination and Reliance requires the CAE to coordinate activities and consider relying on the work of other internal assurance and consulting service providers to ensure proper coverage and minimize duplication of efforts.
One way of coordinating assurance is to establish and facilitate a community of practice for the organization's assurors, such as the fraud, risk, work health and safety, and security teams to share work plans and results. The internal audit function's audit plan should be shared with external auditors as well, so that they have the option of relying on internal audit's work rather than re-performing procedures on their own.
Internal Audit Awareness Month each May presents an ideal opportunity for internal audit to lift its profile and showcase its services to the broader organization. A campaign can be developed and the whole team involved in coordinating outreach activities. Marketing collateral can be developed to support these activities and used throughout the following year.
If there is a dedicated internal audit webpage available on the internal network, this can be used to promote internal audit and how it can help, as well as share best practices and lessons learned. In some organizations, the audit plan can be published.
Managing relationships at the individual engagement level can be more challenging, as this is where the performance of business units is assessed. For each engagement, client communication preferences should be established during the planning process and documented in the engagement plan. Communication may consist of weekly or fortnightly updates face-to-face, by phone, or by email.
A key challenge for internal audit is achieving the right balance between maintaining constructive relationships with management while providing robust, timely assurance to the board or audit committee, who are key internal audit stakeholders.
We are all familiar with what can be a lengthy process in negotiating a report through to completion, the pressure to get reports finalized with management comments in time for tabling with the relevant committee, and these committees asking why internal audit reports that were due to be tabled did not make it.
Maintaining strong relationships and ongoing communication can help manage this tension. My experience has been that communicating engagement observations to stakeholders in real time, particularly adverse observations, allows them time to challenge the observations, consider their responses, and often implement improvements before a report is even drafted.
This approach achieves a "no surprises" mandate, builds trust, and helps engender a sense of internal audit working with management to achieve the best outcome for the organization. It also helps ensure a robust report, and goes a long way toward streamlining the reporting process.
Including positive observations in reports also helps. IIA Standard 2410.A2 encourages us to acknowledge satisfactory performance in engagement communications, and including positive observations in a report not only provides a more balanced report, but can avoid management feeling as though internal audit has only focused on what they've got wrong.
And don't we all need to feel like we are doing a good job?