The first article in this series explored the first characteristic – business alignment. In this next installment, we explore characteristic #2 - internal audit stakeholder relationship management through the examination of three areas: operating as risk and control experts, deploying sophisticated stakeholder management skills, and focusing on the business customer:
- Internal audit risk and control experts
- Seamless internal audit stakeholder relationship management
- Customer outcomes
Internal audit risk and control experts
High performance internal audit teams do not simply point out control failures and track management action toward rectifying these issues, they proactively advocate for effective internal controls, educate the business on what this means, and identify how they can go about achieving this. This creates a greater chance of real sustainable improvement throughout the organization’s control environment.
Significant enhanced value can be delivered through the audit function taking the lead on educating and training everyone across the organization on what internal controls are, how they work, and where they can go wrong. In short, moving from commenting from the sidelines to being on the pitch actively supporting the development of the skills and knowledge the business needs to deliver sustainable improvement.
An example will help illustrate this. One organization needed to make a step change in the risk and control culture in the business following several control failures. To achieve this, they identified a need to change management’s understanding of what great controls look like and how they can enhance business performance. They ran a series of senior leadership workshops, using simple games to illustrate aspects of good and bad controls to help managers understand the characteristics of effective control. The workshop was called ‘Better Business Decisions’ and it was a huge success. It brought together more than 250 members of the leadership team over six months in a collective cause to understand and improve the risk and control culture in the group.
Another internal audit function set itself a strategic outcome to ‘Leverage its reputation as experts in internal control to advocate and educate the business on effective control and its positive impact on business performance.’ To achieve this, it developed a rolling programme of team visits, using centrally developed material, to train colleagues across all levels on controls, including using case studies of problems from across the group.
One final example involved an internal audit function that worked with their Human Resources team to develop an e-learning program that was accessible by all staff whenever it was needed. It discussed controls through engaging case studies and included a test at the end of the program to help ensure the knowledge had been understood and taken on board.
Could you build an ‘advocacy of controls program’ in your organization?
Seamless internal audit stakeholder relationship management
It is worth noting that improvements in control are not only achieved by training and advocacy. Influencing the business over prolonged periods requires internal audit to deploy a sophisticated approach to stakeholder management. I have termed this ‘seamless internal audit stakeholder relationship management’ – all in internal audit working together to the benefit of the stakeholder. In this area, I see high performance functions do the following 4 things brilliantly:
- They deliver a stream of value. Not just in their audit work but in a range of other areas such as identifying business efficiency and improvement opportunities, sharing innovations developed in audit in areas such as data analytics, and proactively looking to use their work to influence the wider organizational culture. A constant stream of value is the best way to build trust and credibility with stakeholders.
- They are transparent about their work. This is all about being truly open about what you are looking at, why you are looking at it, and how you are going to look at it - pulling back the curtain of mystery surrounding internal audit work. This lends itself to initiatives such as running guest auditor programs where business leaders are invited to join an audit and learn about the work and see, firsthand, the value it brings. It also lends itself to taking an agile approach to audit work, where business stakeholders are much more closely involved with the audit process. Initiatives like these build trust and foster a more open and collaborative environment.
- They collaborate with stakeholders. Not just in educating and advocating for greater controls as already discussed, but in other areas such as sharing and working together on data analytics utilities for the entire organization or identifying business efficiency opportunities through dialogue whilst on fieldwork. A point on independence, as this is often raised by internal auditors when the topic is collaborating with the business. High performance internal audit teams are not distracted by this debate. Collaboration with their business colleagues is part of who they are, and they have simple controls in place to manage their independence and ensure they remain objective in all they do.
- They communicate in a sophisticated manner. Effective internal audit communication skills are key to working well with stakeholders. Communication starts by actively listening to stakeholders and seeking to understand their needs and perspectives. High performance requires taking the time necessary to understand the communication preferences of stakeholders and engaging in dialogue that hits their issues and concerns. The relationship approach should be unique for every stakeholder depending on their preferences and working styles. One internal audit function summed up their intent in this area in a single statement. They were focusing “… on the things that matter to our stakeholders, when they matter, and leveraging our cross-organization perspective”.
