As new risks and compliance requirements emerge, management and the board have never needed more assurance about the way they're managing risk than they do now. And while internal audit has a vital role to play in providing that assurance, management and key stakeholders are often unaware of the breadth of knowledge, skills, and experience audit practitioners have, placing the function at risk of underutilization. If internal audit is to thrive, it needs to step up and improve its profile and sell itself to the board and management. In part that means chief audit executives (CAEs) need to develop their marketing skills, but it also entails developing a reputation for solid performance and reliability.
Laying the Groundwork
The first step, says Seth Peterson, internal audit manager at The First National Bank in Sioux Falls, is to make sure that internal audit can deliver what it says it is going to deliver. This, he says, is the groundwork needed to market the function. "If you are trying to build up trust within the organization, don't make promises you can't keep about work you can't do with resources, skills, expertise, or experience that you don't have — you set yourself up for failure and damage your credibility," he says.
Peterson, a past Internal Auditor Emerging Leaders honoree, notes that if the function wants to raise its profile, it is important that internal audit understands the needs of the organization, and aligns its focus to ensure that it is providing assurance on the key risks underpinning the business strategy and objectives. "If you can't align your audit coverage with the key risks facing the strategic objectives of the business, you will have a difficult time showcasing your value to management," he says.
He adds that demonstrating internal audit's proven track record is also useful when building relationships with management. "It's great if you can show that internal audit has been successful not only in providing objective assurance, but in providing efficiency recommendations, saving the business unit time or money, and aligning with strategic objectives."
Liz Sandwith, chief professional practices adviser at the U.K.'s Chartered Institute of Internal Auditors and a former head of audit, says that chief audit executives need to ensure internal audit delivers the level of assurance it is meant to on the audit plan before it tries to get involved in other areas. "Pitching for or responding to requests for additional work is only going to be successful if internal audit is already recognized as a function that is a center of excellence that produces quality work," she says. "If it isn't, then chief audit executives are going to have an uphill struggle trying to convince key stakeholders like the CFO that they should be involved in other projects."
Sandwith also says that before asking to be involved in other projects, internal audit needs to do its research. "Turning up and asking the CFO 'Is there anything we can help with?' is pointless, disrespectful, frustrating, and time wasting for a key internal audit stakeholder," she explains. "You need to do your homework and assess what the key risks might be for the organization if it pursues particular strategies or courses of action. You need to present key stakeholders with details about what role internal audit could play in the life cycle of existing or planned projects, and what the potential impact could be of its involvement — increased assurance, more robust control, improved efficiencies and procedures, better value for money, improved flow of management information, and so on. If you don't know fully what the organization is trying to achieve, how can you help?"
One of the mistakes that CAEs make when trying to raise the profile of the function (and themselves) is that they can become arrogant, Sandwith says. "Don't ever think that you know the business better than management simply because internal audit reviews the organization's key risks," she advises. "Internal audit's job is to help management make better-informed decisions — not to tell them what to do. You won't get very far trying to influence management if you think you are better than them."
Networking and Offering Solutions
Marbelio Villatoro, internal audit manager at aerospace and defense contractor Raytheon Co., says that soft skills are essential when trying to market internal audit. "Chief audit executives need to network within the organization if they want to raise the profile of the function and tell people about the contribution that internal audit can make," he says. "They need to make themselves visible and amenable, and it means spending time visiting and talking to other departmental heads about what they are doing and suggesting ways — however minor — that internal audit could help out."
Villatoro, also recognized as an Internal Auditor Emerging Leader, says that internal audit needs to understand its limits, realizing the scope of activities it can perform and expertise it possesses. Nonetheless, he points out, internal auditors can still be part of the solution. "If internal audit can't help, for example, perhaps we can recommend people that can — either within or outside the business," he says. "If the organization needs to use a third-party consultant, perhaps we can make recommendations about the scope of the engagement and its budget, or how to get the most out of their expertise. Being proactive and always offering solutions is a key way for internal audit to make a great impression within the business."
Good communication skills are also important. Dominique Vincenti, vice president of Internal Audit at Nordstrom in Seattle, says that CAEs need to effectively communicate what internal audit's role and skills are throughout the organization.
"People need to understand what internal audit does and the skills it has to offer, so it is the job of chief audit executives to communicate with them to make sure they understand the breadth of skills, experience, and expertise that the internal audit department has, as well as the success rate it has achieved," Vincenti says. "It is also very important that internal audit quantifies its success, and that it spells out the value that its involvement has resulted in."
Vincenti says that a simple way of improving marketing skills is to go and ask the organization's head of marketing for tips. "Talk to the marketing department — they are the professionals," she advises. "People are often more willing than not to share advice and their expertise if they think you are genuinely interested in getting their help, so go and pay the head of marketing a visit."