Building a Better Auditor: Four Things Freshman Internal Auditors Should Know

Well, I have. You are not alone. These feelings can make you feel unappreciated and unwanted, potentially eroding your confidence and mental wellness.

With more than ten years of experience in the industry and different organizations, I have learned and continue to learn that the perceived and demonstrated value of an internal audit function boils down to a handful of factors:

• The level of regulation in the organization's industry.
• The maturity of the risk and control environment and the maturity of the internal audit function.
• The agility of the business and the internal audit function.
• The level of innovation desired.
• The soft skills and leadership abilities that the internal auditors or leaders possesses.

Freshman internal auditors may not be able to control the other factors, but they can certainly work on their own soft skills and leadership. So many experts have written about soft skills and leadership, and this is where I find my answers to the many challenges I faced as a freshman internal auditor and a developing leader. These skills transcend their overt meanings to include effective communication and embracing diversity of thought. Below are a few examples of my lived experiences:

Understand what type of internal audit function your organization wants. One of the biggest misconceptions I had early in my career was to assume that all board members and business leaders wanted to hear about an independent assessment of compliance with laws, regulations, policies, procedures, standards, contract terms, internal control frameworks, and performance measures. I was wrong. While other leaders did care, most wanted the internal audit function to drive change, educate the business, be part of value creation, benchmark the industry, and promote innovation. I would encourage you to engage your board and the business in genuine thought-seeking and candid conversations about what type of internal audit function they are looking for. The answers to this question are usually undocumented. The business often needs a compliance-type internal audit or a strategic-consulting internal audit, but other organizations lie in between. The needs may also change depending on the size and maturity of the organization. Failure to understand the type of internal audit function your organization needs may result in misaligned focus areas and, consequently, difficulties in agreeing on the recommendations and the value of your function.
 
Stay aware. Some of the business leaders I have interacted with valued my ability to be the first source of intel. Knowing that my organization valued this foresight advisory, I used to research and keep abreast of emerging legislation, industry, and internal audit trends and pivot the audit practices as needed. I often benchmark the internal audit recommendations that I make. Therefore, go beyond your organization, and build and utilize outside networks to benchmark your solutions.
 
Double down on impact and be an active part of the business. We need to demonstrate that we care about audit clients' success and go beyond the "enforcement" role by showing that we are contributors and strategic advisors. Here are a few things that have worked well for me:

We showed the business that we were indeed all in it together. We used guest auditors — staff "loaned" to the internal audit function to understand the risks and controls, audit testing, and how we do things. Auditors also did rotations with other business functions to learn, sketch solutions, and educate the business on how to use the solutions. In the end, we built relationships of trust and developed "generalist-specialist" internal auditors who understood the business strategy well. This improved our ability to make value-adding recommendations that balanced risk with creativity, helped the business implement agreed-upon audit actions, and reduced recurring audit issues. 

We made a deliberate effort to connect with and learn the language of the business. Business leaders appreciated hearing internal auditors suggest tactics to achieve business goals instead of flagging risks. We facilitated scenario planning, and in doing so, we helped the business have a well-rounded strategic and annual planning process. Leaders now feel that they are risk-aware, and they anticipate risks better. Considering strategy risk is now one of the proof points before making strategic decisions or budget allocations. To achieve these outcomes, you must be able and willing to learn about your organization and understand new contexts faster. You must have an inquiring mind and be able to listen actively.
 
Show empathy. Audit clients love personable and empathetic auditors. How often do we embrace a diversity of thought? There are only a few areas in our audits that are non-negotiable: fraudulent acts, legal/regulatory violations, and threats to life. Other than these, be intentional about engaging the business in the issues you find as you audit. It is not always about policy or best practices. How do we genuinely engage process owners to understand why they did something against the expected standard and get to the root cause? Are we genuinely going above and beyond the "what" and engaging the business in the "why" and the solutions?

I love to reference the positive things first, e.g., what are a few things the organization is doing well that make it succeed? Don't whisper success and scream failure. Align our risk assessment to be as close as possible to the business owner's views by co-grading risks and findings. What do business owners care about? Your ability to relate to others and their position or viewpoint is critical in internal auditing. You must influence and persuade the business to get them to listen to your ideas.

Remember, your success as an internal auditor is embedded in your deployed strategy. No single approach is the best. The method depends on your organization, the business needs, and the personalities. You must connect with the business, be a learning auditor, show empathy, embrace a diverse mindset, and be an effective communicator.