Building a Better Auditor: Getting More Out of Every Conversation

Many organizations still focus on auditing by program. Brainstorming meetings are the norm, but do they include people outside of the audit team? As auditors, we should get beyond the team mentality and live in the world of the client or process we are auditing. Let's take advantage of all those years of experience in the business our clients and process owners have. We still need to verify their statements, but what they see and feel about their process is extremely relevant to our work. 

In my career, I have seen exceptional value come from extending the conversation, flipping the script, and bucking the trend. It is amazing what new information can be gleaned from opening your eyes and ears to other avenues of data. Ask your process owner what keeps them up at night. Or, if they had additional resources or time, what would they spend it on? Maybe they'll say they would love to have some additional detective controls or that they are worried they don't have proper segregation of duties due to a headcount limitation. The goal here isn't to be a "gotcha auditor" — it is to understand the real-world environment your process owner is operating in.

If you work such techniques into your audit, you will likely find that your relationship with the client has improved, and they are more communicative. They will see you as a true partner who is there with the same company name on the ID badge.

Sometimes the process owner or audit client is the best source of knowledge on what data is relevant, where it is stored, and how to get it. I've gone so far as to ask, "If I wanted to look for transactions that had (insert failure), what would be the best way to go about doing that?" You may find yourself in front of a client who thinks, "I've never thought about that risk before, but this is how I'd check it." This thought process has allowed me to test more deeply and also connect the dots on transaction chains that may not create an exception individually, but as a whole process flow, present risk to the organization.

The same strategy can add value when it comes time to mitigating those exceptions. Who knows a process better than the owner who executes it every day? If you find an exception that does not have a clear-cut solution, work with your client. Don't prescribe actions; instead, influence by objective. Again, level with your client and explain the risk. Ask, "What is the best way to address the risk to the business — given your deep knowledge of the systems, processes, and tools available to the team?"

When you find yourself adding value to your audit client and bringing additional assurance that they didn't expect, you'll also find yourself becoming a trusted advisor who is closer to the business. You will even find those same process owners coming to you after the audits have concluded for ad-hoc questions, insights, or requests. This type of relationship elevates your entire department within the company and will not go unnoticed.

When you build these types of partnerships and have this level of influence on your processes, you will demonstrate your value and move up the ladder within your organization. You'll be a shining star when it comes to adding insight and providing value to your clients — all because you simply trusted (but of course, verified) your client's or process owner's good intentions. You made them a partner of internal audit, and you allowed them to participate in the assurance process.