Internal audit is a people business, and people love to be told a good story. This isn't simple conjecture; it is built into our basic biology.
Stories are how we make sense out of the human experience. How we communicate, how we think, how we make connections, how we grow as professionals and individuals, it all is derived from the stories we hear and tell.
For all the skills necessary in our profession, for all the insight we have into the factors that define our organization's risk landscape, if we can't use the power of storytelling to communicate effectively, we cannot with good conscience call ourselves truly effective internal auditors.
Previously, I discussed how we tend to leverage our independence incorrectly and how we hide behind it instead of being advocates for action. Action alone, however, is not enough. There's an element of persuasion required for our actions as advisors and consultants to have any real consequence. Our ability to tell stories is what gives our analyses and recommendations weight, and it is what prompts boards and management to make the changes our work deems necessary.
All of the great storytellers, regardless of medium, have a set of stock tools in their toolkit they rely on to work their magic, including the three I have highlighted below. Auditors would do well to incorporate them into their interactions with stakeholders.
1. Be Relevant
Relevance depends on how others perceive your views relative to what is important to them. An audit finding that seems critical to you will be lost if the intended audience doesn't see how it helps or harms their ability to achieve their objectives.
Said another way, it is not enough to simply report a finding. You must first understand your audience and communicate audit results in a way that appeals to their sense of what is important. Know your point and understand your audience. Most importantly, to drive the actions that need to be taken, don't write what you want to say; write what your audience needs to hear.
2. Avoid the Clutter
This point is closely related to the one above, but just because a detail is relevant does not mean it is necessary. Don't fall into the trap of using an audit report as a forum to prove to the board how much work your audit activity does. Many audit reports take this "look what I did" approach and lay out months of audit work in excruciating detail.
Research shows that most people do not read from beginning to end. Instead, they scan to find things they are interested in and read those things first. Avoid the clutter, make things easy to scan, and keep the focus on the information that is most important.
An auditor requires an editor's eye to know when enough is enough. Sometimes less is more.
3. Establish the Stakes
When a stunt person straps herself to the side of an airplane, why does our heart leap into our throat? It is not the crazy stunt, itself, that puts us on the edge of our seat, but the possibility of what might happen should the stunt go wrong.
Stakes are what give context to the work of internal audit, and they help people stay focused on taking action. Don't just communicate that you have a finding; explain why it is important to the organization. Don't just recommend what could be done; explain the consequences of not taking action.
I discussed these three points in a presentation I gave not too long ago. When I was done, someone raised his hand and said, "I don't disagree with your points, but when it comes down to it, management is required to respond to my audits. I don't know that I have the time to spend on stuff like this."
Not wanting to call him out, I thanked him for his comments, but it left me wondering, "How long is his list of open audit recommendations, and how often does he return for a follow-up audit and find that action hasn't been taken?"