The time I spent working in internal audit left an indelible mark on my career. During the 10 years I spent in the profession, I developed a new audit department, helped it grow from a small centralized function to a global activity, traveled to many places, and had the opportunity to meet people from around the world.
Unfortunately, I never realized then how narrow internal audit’s view of the organization can be or the extent to which information is often filtered before an audit team gets to examine it. Had I only attended meetings that I wasn’t invited to, spent more time talking to the individuals actually doing the work, or invested additional resources looking beyond the financial statements, I would have added a lot more value.
Meetings often hold the key to organizational decision-making. Most companies today use Outlook or a similar tool for conference-room booking, where each meeting’s focus is identified on a master schedule. I am not suggesting internal auditors sit in on annual reviews, but they can easily locate meetings about processes, or about important new initiatives, and insert themselves. Sometimes the individuals leading those meetings don’t have the full picture like internal auditors do.
Obtaining the right information frequently hinges on talking to the right people. In many instances, auditors spend much of their time discussing controls and procedures with management — often comprising seasoned veterans and, in some cases, former auditors. They know the questions internal audit will ask, and they know the answers auditors want to hear. For this reason, internal auditors should also talk to the employees performing the day-to-day tasks. These individuals have direct insight on how processes are working and what could make them more efficient. Auditors should speak to the employees one-on-one, form relationships with them, and let them know that internal audit wants to make their job more efficient for the good of the organization as a whole.
Lastly, auditors should spend more time on activities that don’t involve the organization’s financial statements. Identifying potential concerns beyond the financial statements is often where practitioners add value that can keep the organization from running afoul of regulators. Especially as organizations grow and expand into new countries or jurisdictions, significant risks can be overlooked, as laws may differ among countries or states. Auditors should take the time to research complexities that similar organizations are facing — simple online searches often reveal valuable information.
Opportunities to add value exist everywhere in organizations, but in many cases internal auditors are too busy trying to complete the present tasks at hand, clear review notes, or write management reports. They need to make time to find those opportunities. Auditors don’t need to leave the profession and come to these realizations via hindsight — they can start making changes, and adding value, right now.