Why do some internal auditors effectively prepare workpapers and write audit reports with ease, yet stumble when it comes to most other forms of communication?
Internal Audit Effectiveness Starts with Being Clear and Concise
Whether speaking with teammates, meeting with audit customers, or presenting to the Chief Audit Executive (CAE) or audit committee, an internal auditor will find her job extremely difficult if she cannot be clear and concise when trying to make a point.
What’s a Critical Skill an Internal Auditor Needs to be Effective and Successful?
Communication skills are critical to an internal auditor’s success. According to the Institute of Internal Auditors’ (IIA) 2011 CBOK study Core Competencies of Today’s Internal Auditor, of 11 competencies surveyed, communication skills ranked first and second for internal audit staff and managers. In addition, the IIA’s 2015 CBOK Study Ten Imperatives for Internal Audit showed over 50% of CAEs stated that communication skills are a top attribute they seek in new team members.
In a utopian world with an unlimited budget and no deadlines, a CAE would provide her internal auditors with three months of communication training. Obviously, this is unrealistic for today’s demanding environment. However, there are four communication tips and tricks that CAEs can teach their team members that dramatically increase an internal auditor’s effectiveness.
1. Stop Relying on Email
Email should be used to delegate routine tasks and keep people informed of ongoing activity. When email is used to teach or obtain a commitment for action, confusion and indifference normally follow.
For example, internal audit seniors can be more effective when teaching staff new audit procedures, instead of emailing instructions to them. Sending instructions by email can take twice as much time than having an in person meeting. And even when instructions are explicitly clear, they may not be clear to someone with less experience. The staff may struggle to understand what exactly needs to be done, or worse, waste their time doing something that doesn’t need to be done.
For me, the “material weakness” of all communication breakdowns commonly occurs during fieldwork when additional documentation requests are emailed. The email is then followed by three to four days of radio silence. When asked about the hold up, the internal auditor’s response includes: “But I sent an email asking for the documentation. I’m waiting for her to get back to me.”
A face to face meeting, or at least a phone conversation, requires the other party to commit to an action. In this case, the internal auditor can verify that the audit customer will send the requested documentation at a specific time, inform them that they are not the right person to pull the document, or in the best case scenario, remind them that they’ve already sent the documents.
2. Anticipate Your Stakeholder’s Needs
Internal audit seniors and managers have many stakeholders, including staff, their managers, their CAE, and the audit customer. If the audit manager takes a moment to analyze what most of their stakeholders want, a common theme should arise. It’s more information.
An internal audit kick-off meeting is a perfect example of a stakeholder in a position to want additional information. A kick-off meeting is usually held at the beginning of an audit fieldwork where the audit team introduces themselves to the department involved in the audit, and provides information about the audit’s scope and objectives, the audit team, and a summary of the remaining parts of the audit (e.g. status updates, the exit meeting, and when the draft audit report are due).
An audit manager anticipating the needs of the department being audited may include additional details about audit. These details may include why the department is being audited, what is the role of the internal audit process, what happens when potential issues are identified, who the audience of the audit report is, and what happens if the customer disagrees with the audit team’s opinion.
The internal auditor that considers what information a stakeholder may want before meeting with them will be more effective with their time, help their stakeholders be more efficient with their time, and separate themselves from their peers.
(And yes, extra credit points will be awarded to those who knew that anticipating your stakeholder’s needs is the first of Ten Imperatives for Internal Audit).
3. Keep Meetings Short and on Topic
The purpose of a meeting is not to brainstorm, and inform attendees everything you’ve learned or accomplished on your most recent project. Meetings should provide a status update on a project, or obtain commitment or consensus on a key task. If you want your customer to be involved, do not waste their time by sharing irrelevant and un-actionable information during audit meetings.
At the end of audit fieldwork, most audit teams will hold an exit meeting with their customers to obtain a final consensus on any control issues identified, and a commitment to the agreed upon action plan. Of all of the meetings held during the course of an internal audit, the exit meeting is most likely one that is well attended and attended by senior management.
So, what normally happens at these meetings? The meetings start with the lead auditor rehashing the entire scope of the meeting, all of the meetings held, and thanking the customers for their work. If difficult items are needed to be discussed, they are prefaced with everything that went well during the audit. While none of these talking points are necessarily wrong, what is troublesome is that 20 minutes of the meeting has been used to get to the points of the meeting.
How can this be fixed? To start, create a meeting agenda and stick to it. Put the most important tasks, in this case, agreement on identified issues and management’s action plans, at the top of the agenda. To increase the likelihood senior management agrees to the proposed action plans, successful internal audit departments train their audit managers to verify individual issues individually with the process owner(s) before the meeting.
For items that still need to be vetted, it is okay to share these with senior management, but state that additional information needs to be obtained and analyzed before the full issue is presented to them. While some of these steps may take more time to complete the overall audit, the senior managers should appreciate your willingness to help them make decisions, opposed to creating solutions.
4. Don’t Rely on Technical Jargon
“Risk appetite,” “significant deficiency,” “key control,” “high-risk,” and “DRL” are all terms most internal auditors are well-versed in, however, these terms may mean something completely different, or nothing at all, to our customers and stakeholders. Internal Auditors and CAEs who rely on technical jargon and acronyms to get their point across run the risk of confusing their audience, and decreasing the odds of getting buy-in into whatever it is they are trying to accomplish.
A common feature of most internal audit risk assessments is interviews with senior managers. And a common feature of these interviews is for the CAE to ask the senior managers what they consider high-risk. While this practice may identify pertinent organizational risks, it may also identify areas that are only important to the interviewee, and not the entire organization.
The CAE’s risk conversations may also be incorrectly interpreted based on the interviewee’s understanding of risk. For example, a high-risk item to a Chief Compliance Officer may be perceived to be of little or no risk to an Engineering Vice President.
The CAE who takes the time to explain what “high-risk” means will spend less of their audiences’ time to get the answers they are looking for. A lot of CAEs do this by classifying high, medium, and low risks based on negative financial impacts, impacts to business continuity, or hits to the company’s brand.
Furthermore, with an increased understanding, the interviewee may be able to provide more information than what the CAE was looking for, thereby, saving them time spent on future projects. Seasoned CAEs will agree that their best allies are usually the senior managers who better understand what it is Internal Audit is attempting to accomplish.
And in this instance, the CAE who proposes an audit plan based on senior management’s common understand of risk will be more likely to be seen as understanding the organization, and its key risks.
To Enable Positive Change
The intelligent auditor knows that to increase their effectiveness, their communication skills must mature. And if the internal auditor continues to focus on being less ambiguous, more concise, and anticipating their customer’s needs, it will increase the chances of management asking internal audit for more help. In turn, these new projects provide internal audit identify more opportunities to enable positive change in their organization.
**This post is originally from the CAE Leadership Forum written by Tom OReilly
Tom O’Reilly is the Field Chief Audit Executive and Connected Risk Advisor at AuditBoard. In his role, Tom meets, collaborates, and shares internal audit and connected risk strategies and tactics with the AuditBoard community and customers to help improve the practice of internal audit and how second and third line functions work together. Connect with Tom on LinkedIn.
