Demystifying Internal Auditing

To better understand the reasons for internal auditing’s obscurity, I decided to apply the 5 Cs (criteria, condition, cause, consequence, and corrective action) to this situation.

Criteria: (evaluation criteria)

I want to evaluate the statement: Non-auditors (audit customers, students, family and friends) understand the purpose of internal auditing, understand what internal auditors do, and understand the value of a career in internal audit.

Condition: (the existing state)

For the last 28 years, I’ve run an informal, ongoing poll about internal auditing with audit customers, students, and family and friends. The results have been consistent. A majority of audit customers, most students, and virtually all of my family and friends, do not understand the purpose of internal auditing, do not understand what internal auditors do, and do not understand the value of a career in internal auditing. While there are pockets of people who do understand, the majority of people fall in the “do not understand” category.

Cause: (root cause or reason the condition exists)

While I have spent much time and effort educating non-auditors (audit customers, students, family, and friends) over the years, why do most still not have a good understanding of internal auditing?

Cause #1: Internal audit functions are focused on audit results, not marketing or educating. While auditors work to educate audit customers during each project, one audit at a time will not demystify internal audit on a broader scale. Generally, audit departments are measured on quantitative metrics such as an audit plan completion metric. Auditors are so focused on executing the audit plan that there is no time left for marketing or explaining the profession to a larger audience.

Cause #2: Internal auditing is often a university blind spot. Our profession’s recruiting often starts and ends in the accounting department; thus, those students are the only ones who hear about internal auditing. Meanwhile, students studying finance, data analytics, marketing, cybersecurity, and supply chain management (to name a few) have directly relevant skills for the internal audit profession. Most of these students, however, leave college unaware of a career that is well-suited to their skills.

Cause #3: Internal auditing is lost in translation. Internal auditors are not the best when it comes to marketing. Most information about internal auditing sounds like it's written by auditors, for auditors. Using phrases such as “an independent, objective assurance and advisory service” may not be enlightening to people who are trying to understand the profession. Without a clear connection to what we do, people default to what they know: tax returns and financial statements.

Consequence: (the impact)

Consequence #1: Lack of engagement. When audit customers don’t understand internal audit’s purpose or what we do, they often are not as cooperative, transparent, responsive, and timely during an audit as they could be. If they don’t see us as trusted advisors, the audit may not be as effective, key risks may not be identified, and relevant data may not be obtained. The result isn’t just a more difficult audit, but also a less effective one. In addition, if they don’t share relevant information or don't solicit our advice or insights, we lose the opportunity to be the proactive, value-adding partners we strive to be.

Consequence #2: The empty pipeline. When students don’t understand internal auditing, it impacts the future of the profession. Every great student who takes a job elsewhere because they have never heard of internal auditing is a loss for the profession. This is not just about the ability to fill an entry-level position; it’s about ensuring the profession has a pipeline of future auditors with the skills and talent to be successful in a rapidly changing world.

Consequence #3: Peace and quiet. What’s the consequence with family and friends? Not much. If their eyes glaze over when you try to explain the nuances of internal audit, they will be quite happy if you shift the conversation to sports or the weather.

Corrective action: (what internal audit can do)

Action #1: Redefine the relationship. Every interaction with an audit customer is an opportunity to educate and build trust. First, equip audit customers from day one. Don’t just hold a kick-off meeting; turn it into an orientation. Provide a simple overview of our role, process, deliverables, and timeline. Stress the collaborative nature of internal audit and follow that up by requesting their input.

Second, build bridges before an audit begins. Reach out to people in the business for a brief connection and to set the stage for future collaboration. Use this time to share your career story, to explain the role of internal audit and the audit process, and to ask about their responsibilities and priorities. Even just 10 minutes can make a significant difference.

Action #2: Be the face of the profession. The internal audit profession cannot expect universities to market the profession to students. We need to go to them. Reach out to your alma mater or local university. Offer to speak to an accounting class — or any business class — for 15 to 30 minutes, in-person or virtually. Presenting an introduction to internal auditing is good, but telling your internal audit story is even better. Talk about what you’ve learned, who you’ve met, or where you’ve traveled. Talk about the skills the students are learning and how it connects to a career path they never knew existed.

Action #3: Sometimes no action is the best action. And what about family and friends? The corrective action here is simple: Let it go. Unless you are determined to educate them against their will, accept that they will likely remain blissfully ignorant. Put your energy into the audiences you can influence, and your family and friends will thank you for it.

Demystifying internal auditing is up to us and taking it one audit at a time is not enough. It will take proactive meetings, education, and outreach. It will take creativity and new ideas. It will take all of us. What action can you take?