Internal auditors have become increasingly important under the Sarbanes-Oxley Act (SOX). Auditors provide independent assurance that an organization’s risk management, governance, and internal control processes are effective. They can give oversight beyond the financial implications, looking at the organization’s operations, including reputation, employee treatment, and environmental impact. When working in an open and collaborative environment, auditors can identify problem areas and provide strategic insights to propel the organization forward.
In many organizations, however, that open collaboration doesn’t happen. There’s a disconnect between the internal audit function and the rest of the business. In that case, auditors don’t have visibility within the organization and are often left out of critical strategic decisions. They can’t always get access to the data they need to generate reports and strategic recommendations. They’re left flying blind, and the rest of the organization may see them as an irritation rather than a strategic partner.
Five best practices for auditors to close the gap:
1. Build Alignment With Stakeholders Across the Business
Almost half of the poll respondents said that the most significant barrier to building alignment between internal audit and business functions was a lack of ongoing communication (45%), followed by a mistrust of internal audit by business functions (22%) and a lack of clear lines of process ownership (21%).
In many organizations, roles and responsibilities aren’t articulated, and divisions don’t collaborate enough to understand priorities, leading to miscommunication and duplication of labour across departments.
But some auditors have come up with creative ways to address these issues, including, if need be, hosting social events such as pizza parties to get everyone into the same room at the same time.
During this informal gathering, they can discuss their roles in the audit process and begin openly communicating about working together to solve problems. The pizza party can be so successful that it could be a quarterly event to focus on issues impacting day-to-day operations. This simple party could see increased cohesion among staff, and audits may begin to run faster and more smoothly.
While a pizza party isn’t always feasible, especially with dispersed teams, look for opportunities to bring together different functions in a casual roundtable setting. Host an online workshop and invite a guest speaker to discuss a current regulatory issue your team members will be interested in. On an ongoing basis, consider using your intranet or a knowledge-sharing tool to ask and answer questions across departments and to facilitate ongoing discussion. By building a culture of collaboration across all process teams, you can easily share insights and improve the audit process for everyone involved.
2. Evolve the Three Lines of Defense (3LoD) Model Through New Audit Tools
In today’s highly regulatory environment, auditors should be on the front line from the beginning, working with the risk management and compliance teams to build a strategy for assessing and managing business risk. However, it’s often a challenge for auditors to have their voices heard.
The solution comes down to creativity. In one case study, credit risk review officer Scott wanted to prove his division’s value to the organization and get other teams to understand the auditing process better. To do so, he convinced leadership to have all new loan officers spend their first 30 days working on credit risk review. This helped them see what the audit team did and how they did it and gave them a new perspective on the business function. He also spearheaded educational content, including quarterly workshops and a bimonthly newsletter. The newsletter was so popular that the commercial lending team took ownership, providing new respect and recognition to the credit risk review function.
Auditors can look for new opportunities to present their information through newsletters, workshops, videos, graphic presentations, or even interactive websites. Giving business functions many ways to take in content can make the audit team more relevant and compelling to the organization.
3. Deepen Analytics to Get More Timely Insights Into Risk
In-depth analytics are critical for auditors. They can help us better understand processes and data flow, create better audit programs, and enhance the internal audit’s value proposition to the organization. But business functions are often reluctant to share their data with the audit team.
However, by making an effort to be of value to business functions, auditors can expand their access to data. Dan cites the example of Stephanie, a senior auditor with exceptional Excel and PowerPoint skills. When a business function manager had to give a presentation to the board but didn’t know how to drill down into the data to get the information she needed or how to present it effectively, Stephanie offered to help her, working after hours to collaborate on the presentation.
On the presentation day, the manager called Stephanie into the board meeting to recognize her contributions and thank her for her work. From that point, Stephanie could ensure access to the data she needed for her work on the auditing team.
To gain access to data from other business functions, look at how you can use your skills to help them and build trust between teams. The better collaboration will help you get access to the information you need to make both teams successful.
4. Communicate More Effectively With the C-Suite
Many auditors find that the C-suite doesn’t recognize the value of the internal audit team. They tend to think auditors are just there to check controls and want the audit team to keep doing things the way they’ve always done them. In many cases, the team hasn’t communicated how they add value or has struggled to find ways to add value. All of this results in low engagement between leadership and the audit teams.
How do we get around this? Focus on better education about what you do and open the lines of communication. Dan knows one auditor who began sending the C-suite a regular audit “snap”: a one-pager that included the status of the audit plan, a success story where a business function had implemented the audit’s suggestions with positive results, and an opinion piece on policy, risk, and controls. The auditor began to receive regular feedback from the board and senior management and invitations to board meetings and sessions where her feedback was solicited. By providing thought leadership in your field, you can prove your value and become part of the conversation with your C-suite.
5. Become a Strategic Partner by Offering Data-Driven Information
Finally, one of the best ways that you can enhance an internal audit’s brand is by serving as a strategic consulting partner to lines of business. Doing so can help you highlight your team’s skills, demonstrate the audit’s work in a more collaborative light, give business units a reason to reach out to audit, and provide more ways for audit to add value. For instance, as COVID-19 began and businesses were forced to reshape their operations radically, some audit teams could take on additional responsibilities in risk assessment, offering strategic recommendations around introducing new protocols. Ensure that your audit team can do what’s needed to help, even if it falls outside traditional job descriptions. Audit teams can also support business units with ongoing advisory and consulting services. They use their skill sets as auditors to help business teams with strategic support instead of focusing only on compliance. For example, one audit team began a consulting practice focusing on data risk management, providing the business unit with recommendations and an action plan. The management team was so happy with this approach that it asked the audit team to consult in other areas; using their in-house expertise saved R500,000 in outside consulting fees. The audit function often suffers from a lack of communication with other lines of business. Still, the audit can generate new respect and authority through a concerted effort to foster cross-team collaboration and showcase their value to the rest of the organization, as in the above-mentioned examples. By ensuring that the audit team’s voice is heard throughout the process, you can conduct better risk analyses and audits, improving the organization’s overall performance. To improve their collaboration and communication, auditors can implement best practices that position them as strategic partners. The audit team can enhance their contributions and boost organizational performance by aligning their processes, updating their audit tools, using advanced analytics, communicating effectively, and providing data-driven insights. These efforts will also help the team gain recognition for their valuable work.
