Internal audit's credibility and reputation take a hit every time an auditor is unprepared. It's more than the damage done when an internal auditor walks into an audit not knowing a thing about the subject. It is critical for internal auditors to be prepared in every aspect of their work, as individual, leaders, report writers, trusted advisors, and professionals who are truly interested in helping their organization succeed.
Here are four tips for how to prepare to best represent yourself as an internal auditor within the organization:
Prepare yourself. Prepare your team. Early in my career when I was a staff auditor, I was assigned a highly technical audit as a test of my ability to move to a senior auditor position. I overconfidently walked into a conference room that was full of stacks of binders six-feet high and soon found out I was in trouble. In hindsight, I realize this didn't just reflect badly on me, it reflected critically on our whole internal audit team. My supervisor should have guided me through what was coming, not just expected me to sink or swim.
What was the effect of my floundering in the deep end? The client saw only that internal audit sent an uninformed auditor with insufficient training, damaging our entire department's reputation and further cementing negative stereotypes.
Before starting an audit, do research, read articles on the subject, and tap into your professional network to get grounded. Never pretend to know what you are talking about with an audit client. Most likely, they will see right through the façade.
If you don't know something, come in knowing that you are going to spend much more time learning before you start auditing. If this is the case, be open about it, ask lots of questions, and demonstrate that you respect the knowledge and expertise of those you are auditing. This will give them the sense that they are part of the process and they will be more likely to buy into your findings later.
If you bring the attitude of "we are all in this together," it will go a long way toward real cooperation and a successful result. Most importantly, if you are a senior auditor or manager, never throw someone into the deep end without the appropriate preparation and support. It might seem like you're giving them an opportunity to shine. You're not. It reflects poorly on you as a leader and, at worst, will damage the reputation of the department as a whole.
Know the audience. It is critical that you step back at the outset to think not only about what you want to say but also what your audience wants to hear. It is typically not possible for you to be at the level of expertise that your audit client is.
Your job is to be an expert at understanding risk and control and executing the audit process. This means that you need to know enough to understand what others are talking about and then be able to leverage their knowledge together with your skills as an auditor.
What most clients want is respect, of their time and talents. Be aware of any special projects being undertaken by the department at the moment, of unusual workloads, of intricate processes, and of complicated interoffice relationships. Know what you don't know and what you need to know to get the job done and minimize your impact on operations.
Take the time to craft the message. It is important as an individual to be prepared, but it is even more important for chief audit executives to provide the time for team members to develop the skills they need, including communication skills — written, verbal, and nonverbal. Even the newest member of the internal audit team represents the whole department, so one bad interaction can ruin things for everyone.
Make sure you allow enough time to not just report results, but convey the key messages that will allow audit clients to move past any failings. Simply telling people what you found wrong will naturally elicit a defensive response. Consider this as you craft your message and include points about why what you found is important and how making changes will make things better. The audit report, for example, should never be a chronicle of what internal audit did or what the business is doing wrong, but rather a thoughtful guide for management and the board on what could be done better or differently to help the organization achieve its objectives.
Be confident of the message. To be compelling, you have to be confident. This comes from fully understanding the topic as well as taking the time to know your audience and plan how you'll deliver the message. Strong leaders can easily detect weakness and will quickly become wary when they do. It's important that your communications are not only grounded in solid evidence, but that you are communicating with
So for yourself and your team, be prepared. Every interaction as an internal auditor is an opportunity to advocate for yourself, your department, and the internal audit profession.
That's my point of view. I'd be happy to hear yours.