Moving Into an Advisory Role

How can internal auditors become strategic advisors when some of us have not advised at all?

The first step is to understand what providing advisory services actually means. You may find the full version of its definition in the Global Internal Audit Standards. In simple terms, it is when you are invited by the management to provide your valuable expertise to the organization’s stakeholders. If assurance is us forcing our way in post-factum, advisory is purely proactive and invitation-only. Think of it through the lens of the old Dracula folklore: You must be permitted to cross the threshold. But while inviting a vampire inside ends in disaster, inviting an internal auditor to advise brings nothing but value. We aren't there to drain the resources; we are there to help to protect them.

And having understood this, we must not portray the results of our assurance services — in other words, our assurance recommendations — as advisory. This is a just conflation of ideas. You can't be accepted as an advisor if you're forcing advice on people who never asked for it.

Let’s answer this simple question: Are we really welcome when we come to provide assurance? Well, we have several perspectives here:

• For the board — mostly yes.
• For the senior management — again mostly yes, but it depends.
• For the audit clients we review — it is hard to believe that we are welcome.

Even when we exercise due professional care, objectivity, and sympathy for the process owners, we are almost always gate-crashers. Who likes having their mistakes put under a microscope, even if it’s done for their own improvement? Let’s face it, nobody likes to be audited!

But the reality is that auditors spend most of their time talking about assurance: Data analytics, root causes, follow-up, third line, independence, and so forth — they are all about assurance. OK, some of these concepts can and should be used for advisory as well. However, we perfect our craft mainly for assurance purposes. Most internal auditors are largely focused of traditional auditing.

That is why we need a fundamental mental shift. We must move away from the assurance status quo and finally learn to love advisory. And to do so, we should get intimately acquainted with this concept.

Why does advisory matter?

• According to The IIA’s Internal Audit: Vision 2035 report, changing the balance between assurance and advisory services can help overcome the obstacles that may impact internal auditing in the near future. It is expected that the amount of time spent on assurance will decline from 76% to 59%, increasing time spent advisory services from 21% to 41%.
• Within the Global Internal Audit Standards, the Purpose Statement includes the expectation that internal audit will provide foresight to the board and management. And the best tool for providing foresight is advisory services.

Ways to Deliver Foresight

Here are some examples of advisory services listed in the Glossary of the Standards:

• Advising on the design and implementation of new policies, processes, systems, and products.
• Providing forensic services.
• Providing training.
• Facilitating discussions about risks and controls.

As we may see from the list above, the most relevant ones for providing foresight are advising on the design and implementation of new policies, processes, systems, and products and facilitating discussions about risk and controls. Here are some ways to start:

• Have discussions with the board and senior management to obtain their support to start or expand your advisory services.
• Meet with other stakeholders to explain your objectives of becoming a strategic advisor and offer your respective services.
• Position yourself to be invited to participate on new product/process design and implementation teams. This can be achieved by conducting high-quality assurance activities. When you do your best to improve the processes rather than report on findings, relevant stakeholders will inevitably acknowledge your pure intentions.

In short, to position yourself as a strategic advisor, demonstrate your willingness to make things better, discuss with stakeholders the benefits of your foresight to the organization, and start providing it. 

Realize the risk of becoming irrelevant if we take the current situation for granted. Learn to love advisory.