Time and again and, in all probability, when the performance of a Chief Internal Auditor or a Chief Audit Executive (CAE) is being assessed, Audit Committee (AC) and Management wish to understand the value addition made by Internal Audit (IA).
It is not easy for the CAE to respond to this requirement, mainly because his internal customers almost always believe that ‘All’s Well’; that there is no need to have IA, or better still, IA is a necessary transgression in their life! Hence, for those who are being audited, the best way to deal with internal auditors is to get them complete their assignment expeditiously and negotiate hard for the audit scoring and get back to ‘business as usual’ (pun intended).
I believe that IA itself is value accretive if deployed correctly by all stakeholders and hence, a new journey to discover ‘value adds’ may not be needed.
Having said that, let me deal with this subject at two levels.
First, internal auditors need to maintain complete trail on how their audits have resulted in remedial action, process changes and compliance corrections. A simple but organized and crisp summary presented annually and proactively to the AC will surely sensitize the AC (and hence, the Board) on value addition brought about by IA. My recommendation is to focus on process improvements, control awareness and compliance corrections (I am sure that internal auditors of every company will have something meaty enough to present annually). Further, my sincere unsolicited advice is – do not attempt to put a number to the value addition – this poses multiple problems because auditees feel reluctant to acknowledge the IA share in the pie of gains. Whilst an attempt to quantify monetary value may be counter-productive, presenting qualitative contribution in a persuasive manner may help CAE to get the AC and Management appreciate IA’s contribution over time.
Let me also share my thoughts on another related topic of fraud detection. Whereas detection of an irregularity or fraud may be sensational, prevention is subtle, and its impact may not be easy to quantify. But we all know well – Prevention is better than Cure and AC and Management need to acknowledge this!
I recommend that the dialogue with stakeholders on value addition should be timed typically in March/April or at least a month ahead of accounts approval meeting. This will ensure nearly complete information for the year and also help the AC when approving the next year’s annual internal audit plan. It is essential to manage your stakeholders well and keep them abreast of internal audit activities so that they are on board when the value addition is presented to the AC.
At the second level, as an independent director and member of AC of a few companies, I feel that Management and AC should also think about deployment of internal audit as internal consultants – IA can be leveraged as independent yet in-house consultants by identifying areas where intervention by external consultant is being contemplated. I know of one Chairman of AC who gets internal audit validate the assumptions for business plan before the Board meets for strategy discussions and plan approval. Having access to information across the organization and with an ear to the ground, a motivated IA team can be an asset to the AC and the Management.
I will also offer some tips to internal auditors on how to help themselves in getting value addition recognized. Be agile and observant, be clued into external events that can impact the organization and network within the profession, especially within the industry, so that your team becomes repository of knowledge and good practices. By doing so, the IA team will evolve into a team of internal consultants. In fact, IA has visibility over the entire organization and is well placed to be an evangelist to spread good practices within the organization.
Please also note some pitfalls to avoid – the ‘I got you attitude’, ‘it all goes to files after all’, ‘I am the only ‘kosher’ employee in the organization’ etc. Most important, get your communication right – be firm without being aggressive, be heard without shouting, be perceived by your actions…!
At an individual level, every internal auditor would do well to reflect and assess the impact his or her work has brought about within the company. Not to forget how each assignment has also been a value-add in terms of learning. A digital diary to record daily work and key learnings in an organized manner would facilitate this.
A parting advice – please solicit and welcome feedback from all your stakeholders, including auditees. Analyze this with your team in an open house meeting to distil the same and blend it with your next execution plan.
I hope my thoughts will help CAEs to reflect and bring the target of value addition in its true spirit on their dashboard.
The Blog solely reflects the personal views and opinions of the author(s).
