Blogs Mustafa Yusuf-Adebola, CIA, CPA, CFE, CGA Mar 01, 2022
Deck: The terms 'audit' and 'auditor' can be a bit generic, leading some audit clients to misunderstand what it is internal auditors do or how it's different from external audit. Meet the Expectation Gap.
"Who are you?"
"We are the auditors. We are here to review the —"
"—aren't you the internal auditors?"
"We are the resident auditors; we are here to review the bank reconciliation process for the year."
"We already have auditors from the Big Four around here; they just did that last week. Why do we have to do this again? I don't understand why we have to repeat the same process to different people; don't you share information amongst yourselves?"
Is the scenario above a familiar one? Have your audit clients asked who you are and why you are doing what you are doing? One of the concepts that I was taught in school that I fondly recall is the "Expectation Gap." This is the gap between the public's expectation of the auditor's work and what the auditor was contracted to do. In my career, I have seen this scenario play out in different ways, and it often makes me wonder what audit clients understand about the various audits they go through.
Depending on the size of the organization, the 'auditor' is a generic name for people doing all kinds of activities. This genericism has sometimes affected the role of the internal auditor within an organization and increased the expectation gap. How can internal auditors close this gap?
Stakeholders are those who are affected by an organization's decisions or actions. From top management (including the board of directors) to operational workers, their expectations differ. While top management is strategic in their approach to how auditors provide assurance that the organization's objectives are being met, the method of executing audits can sometimes appear like an inquisition to operational staff. This makes it difficult to appreciate the role of auditors as business partners in the value chain.
Under IIA Standard 2010 - Planning, 2010.A2 states that:
The chief audit executive must identify and consider the expectations of senior management, the board, and other stakeholders for internal audit opinions and other conclusions.
This allows the internal auditor to understand the mindset of the stakeholders and audit clients, engage with them appropriately, and address certain misconceptions before fieldwork begins. It also enables effective communication before the audit begins.
Do your audit clients know that you are not external auditors? The term 'auditor' is used for both internal and external auditors — this can sometimes be confusing, especially when the internal auditors are reviewing the same process that the external auditors conducting statutory audit may have touched on recently. To the process owners, this could be akin to beating a dead horse. Not many audit clients know that the work approach of both auditors, while seemingly similar, are intrinsically dissimilar. Also, the output of external auditors could lead to internal auditing. Thus, it is important that during onboarding, while independence is maintained, introduction of engagements is done in a way that does not confuse audit clients or make them feel they are doubly audited (during follow-up engagements).
Expectation gaps sometimes occur when the outcome of audit is shared as a punitive action. Because internal audit provides assurance that organizational objectives are being achieved, it is likely that process gaps and opportunities for improvement will be discovered during audit. The discovery of process gaps can be used as a performance yardstick for process owners and could lead to staff focusing on details and documentation rather than process improvement. Process owners could become scared of making mistakes, which then leads to cover-ups, and consequently ingenuity is lost. The top-down approach where top management has made decisions (usually based on strategic and regulatory compliance lenses) and cascaded this to middle-level management can have an effect on how auditors are perceived.
When communicating results, it is important to understand the historical actions that have been taken as a result of the audit. While internal audit cannot make management decisions, audit efficiency can be improved where results are communicated to recipients in a way that encourages audit clients to take feedback and corrective actions.
How often do you conduct satisfaction surveys after internal audit? This is an avenue to address the expectations gap after the just-concluded audit and before the next. The point of a satisfaction survey is not to kowtow to the desires of audit clients and lose independence and objectivity, but to improve on internal auditing as a function. These surveys can form the basis of periodic organizational workshops, training, and induction programs.
Where possible, in conjunction with human resources, internal audit experiences can form part of exit interviews, especially where the departments or personnel were key contacts during their time.
Lastly, internal audit can participate in company functions such as webinars, lunch-n-learns, trainings, and workshops to address or reinforce the purpose of internal audit. For mature organizations, the culture may require less interactions, but for young organizations that are still getting accustomed to the culture of internal auditing, an annual workshop can help educate staff about the role of internal audit.