Building a Better Auditor: Spread Auditing Awareness

We often speak about how recommendations made by internal audit are not always implemented. As time goes on, another audit of the same business unit reveals those issues continuing, with no corrective action taken. And, of course, the risk level has now escalated.

The question remains: Why? I believe that one answer leans on awareness. Sometimes we must take the blame or responsibility for not informing our colleagues about the basic components of audit — what we do and why, what is expected of us, and what is expected of them. I have walked around far too many times in organizations, and peers are not aware of an audit charter. Colleagues from other units need to know that we have a mandate, just like they do. We must be respectful and courteous of their mandate, and so should they be of ours.

We may even have very cooperative and meaningful opening conferences with client management, yet still we find ourselves asking, waiting, calling, emailing and reporting clients for not providing us with timely information needed for our reviews. Have we made management aware of this critical aspect of our work? Does management know about the value we add when it comes to unearthing a high-risk situation and the provision of corrective action?

Our audit is about making a difference, where a difference is required. It’s about adding value where value is required. It’s about making people aware where awareness is required. It’s also about leaving a business unit different than how we found it at the beginning of the audit and seeing improvements through to their completion.

Awareness also involves relaying risk information. For instance, how risky are our findings? How was this communicated, and what were the responses of management at that time? Agility in our process dictates that we no longer wait until the audit is completed to inform management of these issues through meaningful conversation. Spreading the awareness to have issues corrected, thereby reducing the risks, is key.

When internal audit creates the awareness of the negative effects of risks and how collaborative corrective action can add value to restore operational efficiency (and in the shortest possible time), then there is a greater chance of recommendations being implemented. Effective communication wins.

The call to action is clear. Auditors must actively spread awareness, engage with management throughout the process, and ensure risks are addressed swiftly to enhance business operations. May we do our part!