"You need to know how to better communicate with the audit committee!"
That was what the audit partner told me after I attended my first audit committee meeting. At the time, I was a new manager at a large CPA firm. Two days prior, my supervisor had asked me to present at the meeting because another auditor had become ill.
I knew the current status of the audit, and my part of the discussion — just 10 minutes on the overall agenda — was limited to technology risks. Even though I received no briefing, no background information, and no advice, I thought, "What could go wrong?" Well, something did. Not surprisingly, things did not go as I expected.
During the meeting, several members fired questions at me before I could even finish my presentation. I responded poorly to one of them, and it got worse from there. I became nervous, and I assumed they wanted direct answers — if I did not know something, I just told them "I don't know." That was the truth, but it did not make a good first impression.
I learned some valuable and lifelong lessons that day. Thinking about what went wrong helped me with future meetings, and it eventually made me a better internal auditor. Three takeaways, in particular, may be helpful to practitioners about to attend their first audit committee meeting, as well as those who have prior experience and want to improve.
Internal auditors should establish a trusted relationship with committee members — before their first meeting. Over time, I learned to get on the committee chair's calendar as soon as I began working with a new organization, as well as each time the committee chair changed.
Auditors shouldn't wait to schedule this meeting; the sooner the better. And they should be sure to inform other executives or leaders about it — especially their direct supervisor. Auditors need support from these key individuals before the meeting takes place.
Other ideas for establishing trust are simple: Be honest, listen before you act, admit your mistakes and learn from them, don't blame others, be transparent, respect others, keep your promises, and seek ways to help your audit committee members.
Play by the Rules
Auditors need to learn the organization's audit committee protocol. They can start by asking others who have experience with the committee for their perspective and help. Auditors could ask, for example, what committee members know about the organization's governance, risk, and controls. Why were they appointed to the audit committee? The answers to these questions can shed light on committee protocol and rules of engagement.
Some audit committee members know little about the business, governance, risk, controls, and committee protocol. Others serve years on the audit committees and have a deep understanding of these areas. Auditors can gauge these factors and adjust how they engage and interact with committee members accordingly. Are certain topics better discussed outside the audit committee? Gaining a better understanding of how the committee operates can help auditors gain confidence in their ability to communicate in a manner that will be impactful.
Practitioners can benefit from the assistance of a mentor, coach, or trusted advisor when seeking reliable information about committee protocol. Ideally, this individual should have a deep understanding of the audit committee. What concerns do committee members share? What unites them? What divides them? By studying these dynamics and asking lots of questions, auditors can improve their ability to work with the committee members.
I found over my career that understanding protocol goes a long way toward fully engaging with the audit committee. Some committees hold formal, controlled meetings where there are no surprises and nothing is left to chance. Others maintain flexible agendas, room for impromptu discussion, and time to delve into tough questions. Internal auditors should realize that no two committees operate the same way.
Learn How to Report Bad News
No one likes to hear bad news, including the audit committee. There are many ways to communicate sensitive issues, but what works best? Unfortunately, I learned the hard way that reporting bad news to the committee without providing advance warning often does not go well.
An audit committee member once asked me, for example, how our audit team can possibly keep up with the technical demands of business disruption and innovation. "We cannot," I answered. And of course, this was bad news to the committee.
"Competition, higher pay, and signing bonuses offered by other organizations means the turnover rate on the team is high," I added. "The top highly technical audit team members, especially, tend to get hired away."
The committee members did not respond well to this news. They wanted to hear solutions, not just problems. And they were right to be concerned.
In hindsight, we should have discussed this topic first outside the audit committee. But it came up unexpectedly at the end of the meeting, and I was unprepared. A better answer might have been: "Good strategic question. Let me gather hard data first before I answer you. If I need help to solve this, can I count on your support?" Framing the response this way turns the question into an opportunity to solve a strategic challenge. Lesson learned.
A significant issue raises the temperature of the room, and the confrontation can get brutal. Auditors should learn how to deliver bad news — before they actually need to do it.
In addition to considering these three key areas, internal auditors can take several steps to prepare for their first committee meeting:
- Find out what the audit committee thinks of internal auditors.
- Determine whether the audit committee sees internal audit as valuable.
- Get senior executives' impressions of the audit committee and its value.
- Ask for coaching and feedback from other stakeholders, such as the board secretary or someone in the legal function.
- Practice and rehearse your audit committee presentation.
- Compare your presentation to other audit committee presentation materials. Are they comparable in terms of quality, depth, and substance?
- Learn how to recommend cost-effective solutions to issues raised.
- Determine what key risks and key insights the committee sees as strategic and impactful.
- Understand the committee's risk tolerance levels.
- Get to know the committee members as much as possible and develop trusted relationships with them.
- Learn to engage the committee — don't just read the audit report.
- Focus on insights, value, and forward-looking initiatives.
- Anticipate potential questions and prepare your responses.
- Learn how to handle negative feedback on your reports, conclusions, or recommendations.
Don't Get Caught Off Guard
Careful preparation is key to successful audit committee meetings — it calls for deliberate, sustained action, working with key stakeholders and members of the committee itself. Practitioners can seek informal advice through their organization or their personal networks, though formal training is available as well. Either way, it's important for auditors to be proactive and not just assume everything will go well in their first meeting.
Don't make the same rookie mistake I did by walking into the meeting cold. Knowing what you're going to say, anticipating what you might be asked, and developing relationships can make the difference between a poor showing and a great first impression. Even if pressed for time, I should have at least asked others what to expect, what the protocol is, and what to prepare ahead of the meeting. Armed with that knowledge, I could have walked into my first audit committee meeting informed, prepared, and confident.