My friend Jim DeLoach and his colleague, Brian Christensen, of Protiviti have continued their advice for internal auditors. Captioned as advice for the "future auditor," the three-part series addresses in turn risk, value, and communication.
The latest is "Focusing on Communication."
There is nothing wrong with the advice they offer. Each of their recommendations has value. But, as is so often the case, I believe they have missed the most critical point — especially if internal audit is to make a difference.
As I say in my presentations as well as in Auditing That Matters, it is essential to:
Tell them what they need to know, not what you want to tell them.
What do the senior executive team and the board need to know? What assurance, advice, and insight will help them succeed and achieve or even exceed their objectives?
They are focused on achieving earnings target, improving market share and customer satisfaction, and bringing exciting new products and services to market. How do audit reports on inventory management or accounts payable relate to what they are trying to achieve?
Not so long ago, I supported the National Association of Directors at a number of events where they provided advice to board members on cybersecurity. What I heard over and over from the directors was a need for actionable information.
CAEs and their team need to put themselves in the shoes of their stakeholders. What do they need from internal audit that will help them move with confidence to success? Do they need assurance that the controls over risks to new product introduction are reliable?
If you don't know what they need, how can you provide them with the assurance, advice, and insight that will help them succeed? If all you do is provide them with audit reports that are, at best, peripheral to enterprise objectives such as EPS growth, why should you expect a seat at the top table? Why should they give you more than momentary attention? Why should you believe you are valuable?
Audit the risks that matter, and then communicate your assurance, advice, and insight when it matters, in an actionable form.
Is that the traditional audit report?
I welcome your thoughts.