High performance internal audit teams: Internal audit stakeholder relationship management

The first article in this series explored the first characteristic – business alignment. In this next installment, we explore characteristic #2 - internal audit stakeholder relationship management through the examination of three areas: operating as risk and control experts, deploying sophisticated stakeholder management skills, and focusing on the business customer:

1. Internal audit risk and control experts
2. Seamless internal audit stakeholder relationship management
3. Customer outcomes

Internal audit risk and control experts

High performance internal audit teams do not simply point out control failures and track management action toward rectifying these issues, they proactively advocate for effective internal controls, educate the business on what this means, and identify how they can go about achieving this. This creates a greater chance of real sustainable improvement throughout the organization’s control environment.

Significant enhanced value can be delivered through the audit function taking the lead on educating and training everyone across the organization on what internal controls are, how they work, and where they can go wrong. In short, moving from commenting from the sidelines to being on the pitch actively supporting the development of the skills and knowledge the business needs to deliver sustainable improvement. 

An example will help illustrate this. One organization needed to make a step change in the risk and control culture in the business following several control failures. To achieve this, they identified a need to change management’s understanding of what great controls look like and how they can enhance business performance. They ran a series of senior leadership workshops, using simple games to illustrate aspects of good and bad controls to help managers understand the characteristics of effective control. The workshop was called ‘Better Business Decisions’ and it was a huge success. It brought together more than 250 members of the leadership team over six months in a collective cause to understand and improve the risk and control culture in the group.   

Another internal audit function set itself a strategic outcome to ‘Leverage its reputation as experts in internal control to advocate and educate the business on effective control and its positive impact on business performance.’ To achieve this, it developed a rolling programme of team visits, using centrally developed material, to train colleagues across all levels on controls, including using case studies of problems from across the group.

One final example involved an internal audit function that worked with their Human Resources team to develop an e-learning program that was accessible by all staff whenever it was needed. It discussed controls through engaging case studies and included a test at the end of the program to help ensure the knowledge had been understood and taken on board.  

Could you build an ‘advocacy of controls program’ in your organization?

Seamless internal audit stakeholder relationship management

It is worth noting that improvements in control are not only achieved by training and advocacy. Influencing the business over prolonged periods requires internal audit to deploy a sophisticated approach to stakeholder management. I have termed this ‘seamless internal audit stakeholder relationship management’ – all in internal audit working together to the benefit of the stakeholder. In this area, I see high performance functions do the following 4 things brilliantly:

1. They deliver a stream of value. Not just in their audit work but in a range of other areas such as identifying business efficiency and improvement opportunities, sharing innovations developed in audit in areas such as data analytics, and proactively looking to use their work to influence the wider organizational culture. A constant stream of value is the best way to build trust and credibility with stakeholders. 
2. They are transparent about their work. This is all about being truly open about what you are looking at, why you are looking at it, and how you are going to look at it - pulling back the curtain of mystery surrounding internal audit work. This lends itself to initiatives such as running guest auditor programs where business leaders are invited to join an audit and learn about the work and see, firsthand, the value it brings. It also lends itself to taking an agile approach to audit work, where business stakeholders are much more closely involved with the audit process. Initiatives like these build trust and foster a more open and collaborative environment.
3. They collaborate with stakeholders. Not just in educating and advocating for greater controls as already discussed, but in other areas such as sharing and working together on data analytics utilities for the entire organization or identifying business efficiency opportunities through dialogue whilst on fieldwork. A point on independence, as this is often raised by internal auditors when the topic is collaborating with the business. High performance internal audit teams are not distracted by this debate. Collaboration with their business colleagues is part of who they are, and they have simple controls in place to manage their independence and ensure they remain objective in all they do. 
4. They communicate in a sophisticated manner. Effective internal audit communication skills are key to working well with stakeholders. Communication starts by actively listening to stakeholders and seeking to understand their needs and perspectives. High performance requires taking the time necessary to understand the communication preferences of stakeholders and engaging in dialogue that hits their issues and concerns. The relationship approach should be unique for every stakeholder depending on their preferences and working styles. One internal audit function summed up their intent in this area in a single statement. They were focusing “… on the things that matter to our stakeholders, when they matter, and leveraging our cross-organization perspective”.

Customer outcomes

The final component in our relationship management theme is around connection and understanding of the organization’s customers. This was summed up by the strategic goal of one risk function who set out to “build a culture of customer first in all analysis and business interactions“.

They believed that having a better understanding and connection with the customer would increase the effectiveness of internal auditors in several ways:

1. It improves the continual risk assessment and quality of findings. Understanding the needs and expectations of the customer helps internal auditors identify potential areas of risk that could impact customer delivery.
2. Having a customer connection and empathy helps build internal stakeholder relationships. When stakeholders see how you are customer focused, they are more likely to work constructively with you.
3. It leads to higher engagement and satisfaction in the audit team. A close connection with the customer helps increase employee engagement and the associated benefits that come from this higher engagement with regards to productivity and performance.

Internal audit teams are always looking for opportunities to get closer to the customer. Activities I have seen that work particularly well in audit teams include:

1. Actively engaging with front line customer facing colleagues who have regular and direct interactions with customers. Internal auditors who actively engage with front-line employees deepen their understanding of the customer and gain the trust of these employees to share their insights on customer-related control issues. So, get back to the floor regularly to really experience what it is like on the front line of your business. Your business may already have a scheme that helps facilitate this. If so, I recommend you make it a requirement that everyone in the function gets ‘back to the floor’ at least once each year.
2. Participating in customer focus groups. Yes, we are customers too. So why not get involved in your organization’s customer focus groups when they are conducted? If you cannot actively participate, it is still a great idea to observe these to hear directly from the customer.
3. Monitoring customer feedback channels. This includes social media, online reviews, and customer service interactions, all of which provide a wealth of information about the customer experience. One organization established an ‘app’ for all employees to make use of. It included customer letters, phone calls, and web chats and made them available to the employees to get a stronger sense of their customers’ feedback at any time.

Bring the customer into every interaction. In one organization, every team meeting included a discussion about what a customer would say if they heard their debate and what impact it might have on their experience. They also required each senior leadership team meeting to begin with a customer story — both good and bad. These stories were brought to the meeting by each of the directors from their part of the business and were eventually shared at regular town hall meetings.

One final thought here: Why not bring customers into the internal audit function to meet the team and talk about their experience with the organization and the value it has brought to them? Although I have never seen this conducted in internal audit, I have in other parts of the organization.

In the first two articles in this series, we have explored the first two characteristics of high performance internal audit teams – business alignment and internal audit stakeholder relationship management. In the coming articles, we explore the need for empowering leadership and accountability in our operations. It would be great if you stuck with us until the end!